Daily Tech Digest - April 10, 2022

Robots Developing The Unique Sixth Sense

In the sense of smell and taste, robots with chemical sensors could be far more precise than humans, but building in proprioception, the robot’s awareness of itself and its body, is far more challenging and is a big reason why humanoid robots are so tough to get right. Tiny modifications can make a big difference in human-robot interaction, wearable robotics, and sensitive applications like surgery. In the case of hard robotics, this is usually solved by putting a number of strain and pressure sensors in each joint, which allow the robot to figure out where its limbs are. This is fine for rigid robots with a limited number of joints, but it is insufficient for softer, more flexible robots. Roboticists are torn between having a large, complicated array of sensors for every degree of freedom in a robot’s mobility and having limited proprioception skills. This challenge is being addressed with new solutions, which often involve new arrays of sensory material and machine-learning algorithms to fill in the gaps. They discuss the use of soft sensors spread at random through a robotic finger in a recent study in Science Robotics.


The Rise of Enterprise Data Inflation

Data inflation ensues when spending on data rises without deriving proportional enterprise value from that spending. Surprisingly, digital transformation and application modernization have created fertile ground for data inflation to run rampant. As enterprises refactor applications and ever-expanding datasets aren’t managed carefully, enterprises experience data sprawl. Moving to the cloud to deliver more capability and use can inadvertently lead to data inflation. Often, a dataset is helpful across multiple areas of a business. Different development groups or people with unrelated objectives might make numerous copies of the same data. They often change a dataset’s taxonomy or ontology for their software or business processes, making it harder for others to identify it as a duplicate. This occurs because the average data scientist trying to hone in on a particular data insight has different priorities than the data engineers responsible for pipelining that data and creating new features. And the typical IT person has little visibility into the use of the data at all. The result is that the enterprise pays for many extra copies without getting any new value – a core driver of data inflation.


Will Apple build its own blockchain?

One thing that is pretty clear is that if Apple creates a specific carve-out for NFTs in its own App Store rules, it’s going to be on its own terms. They could take a number of different paths; I could see a world where Apple could only allow certain assets on certain blockchains or even build out their own blockchain. But Apple’s path toward controlling the user experience will most likely rely on Apple taking a direct hand in crafting their own smart contracts for NFTs, which developers might be forced to use in order to stay compliant with App Store rules. This could easily be justified as an effort to ensure that consumers have a consistent experience and can trust NFT platforms on the App Store. These smart contracts could send Apple royalties automatically and lead to a new in-app payment fee pipeline, one that could even persist in transactions that took place outside of the Apple ecosystem(!). More complex functionality could be baked in as well, allowing Apple to handle workflows like reversing transactions. Needless to say, any of these moves would be highly controversial among existing developers.


A Microservice Overdose: When Engineering Trends Meet the Startup Reality

Microservices are not the only big engineering trend that is happening right now. Another big trend that naturally comes together with microservices, is using a multi-repo version control approach. The multi-repo strategy enables the microservice team to maintain a separate and isolated repository for each responsibility area. As a result, one group may own a codebase end to end, developing and deploying features autonomously. Multi-repo seems like a great idea, until you realize that code duplication and configuration duplication are still not solved. Apart from the code duplication that we already discussed, there is a whole new area of repository configurations – access, permissions, branch protection, and so on. Such duplications are expected with a multi-repo strategy because multi-repo encourages a segmented culture. Each team does its own thing, making it challenging to prevent groups from solving the same problem repeatedly. In theory, a better alternative could be the mono-repo approach. In a mono-repo approach, all services and codebase are kept in a single repository. But in practice, mono-repo is fantastic if you’re Google / Twitter / Facebook. Otherwise, it doesn’t scale very well.


Talking Ethical AI with SuperBot’s Sarvagya Mishra

AI is the most transformative technology of our era. But it brings to the fore some fundamental issues as well. One, a rapidly expanding and pervasive technology powered by mass data, may bring about a revolutionary change in society; two, the nature of AI is to process voluminous raw information which can be used to automate decisions at scale; three, all of this is happening while the technology is still in the nascent stage. If we think about it, AI is a technology that can impact our lives in multiple ways – from being the backbone of devices that we use to how our economies function and even how we live. AI algorithms are already deployed across every major industry for every major use case. Since AI algorithms are essentially sets of rules that can be used to make decisions and operate devices, they could make judgement calls that harm an individual or a larger population. For instance, consider the AI algorithm for a self-driving car. It’s trained to be cautious and follow traffic rules, but what happens if it suddenly decides that breaking the rules is more beneficial? It could lead to a lot of accidents. 


Data Science: How to Shift Toward More Transparency in Statistical Practice

A common misconception about statistics is that it can give us certainty. However, statistics only describe what is probable. Transparency can be best achieved by conveying the level of uncertainty. By quantifying research inferences about uncertainty, a greater degree of trust can be achieved. Some researchers have done studies of articles in physiology, the social sciences, and medicine. Their findings demonstrated that error bars, standard errors, and confidence intervals were not always presented in the research. In some cases, omitting these measures of uncertainty can have a dramatic impact on how the information is interpreted. Areas such as health care have stringent database compliance requirements to protect patient data. Patients could be further protected by including these measures, and researchers can convey their methodology and give readers insights into how to interpret their data. Assessing Data Preprocessing Choices Data scientists are often confronted with massive amounts of unorganized data. 


DAO regulation in Australia: Issues and solutions, Part 2

So, the role of the government is to introduce regulations and standards, to make sure that people understand that when they publish a record — say, on Ethereum — it will become immutable and protected by thousands of running nodes all around the globe. If you publish it on some private distributed ledger network controlled by a cartel, you basically need to rely on its goodwill. The conclusion for this part of the discussion is the following. With blockchain, you don’t need any external registry database, as blockchain is the registry, and there is no need for the government to maintain this infrastructure, as the blockchain network is self-sustainable. Users can publish and manage records on a blockchain without a registrar, and there must be standards that allow us to distinguish reliable blockchain systems. ... The difference is that this must be designed as a standard requirement for the development of a compliant DAO. Those who desire to work under the Australian jurisdiction must develop the code of their decentralized applications and smart contacts compliant with these standards.


Data Governance Adoption: Bob Seiner on How to Empower Your People to Participate

When you consider the ADKAR model for change, any program adoption requires personal activation. “You need to find a way to make that connection with people,” Bob says. “ADKAR relies on personal traits and things that people need to adjust to and adopt to further the way they’re able to govern and steward data in their organization. Make it personable, make it reasonable, and help them understand they play a big role in data governance.” But even the most energized workforce can’t participate in active data governance without the right tools — your drivers won’t win their race without cars, after all. Like most large organizations, Fifth Third has a very divided data platform ecosystem, with several dozen tools employing both old and new technology. But as their vice president of enterprise data, Greg Swygart, notes, where data consumption starts and ends — curation and interaction — “the first step in the data marketplace is always Alation.” “Implementing an effective data governance program really requires getting people involved,” Bob concludes. 


AI Regulatory Updates From Around the World

Under the proposed ‘Artificial Intelligence Act,' all AI systems in the EU would be categorized in terms of their risk to citizens' privacy, livelihoods, and rights. ‘Unacceptable risk' covers systems that are deemed to be a "clear threat to the safety, livelihoods, and rights of people.” Any product or system which falls under this category will be banned. This category includes AI systems or applications that manipulate human behavior to circumvent users' free will and systems that allow ‘social scoring' by governments. The next category, 'High-risk,' includes systems for critical infrastructure which could put life or health at risk, systems for law enforcement that may interfere with people's fundamental rights, and systems for migration, asylum-seeking, and border control management, such as verification of the authenticity of travel documents. AI systems deemed to be high-risk will be subject to “strict obligations” before they can be put on the market, including risk assessments, high quality of the datasets, ‘appropriate’ human oversight measures, and high levels of security.


SEC Breach Disclosure Rule Makes CISOs Assess Damage Sooner

The central question facing CISOs who've experienced a security incident will be around how materiality is determined. The easiest way to assess whether an incident is material is by looking at the impact to sales as a percentage of the company's overall revenue or by tracking how many days a company's systems or operations are down as the result of a ransomware attack, Borgia says. But the SEC has pressured companies to consider qualitative factors such as reputation and the centrality of a breach to the business, he says. For instance, Pearson paid the SEC $1 million to settle charges that it misled investors about a breach involving millions of student records. Though the breach might not have been financially material, he says it put into doubt Pearson's ability to keep student data safe. The impact of the proposed rule will largely come down it how much leeway the SEC provides breach victims in determining whether an incident is material. If the SEC goes after businesses for initially classifying an incident as immaterial and then changing their minds weeks or months later when new facts emerge, he says, companies will start putting out vague and generic disclosures that aren't helpful.



Quote for the day:

"Give whatever you are doing and whoever you are with the gift of your attention." -- Jim Rohn

Daily Tech Digest - April 09, 2022

Essentials of Enterprise Architecture Tool

EA tools allow organizations to map out their business process architecture, business capability architecture, application architecture, data architecture, integration architecture, and technology architecture. The common capabilities of EA Tool are, EA Repository supports business, information, technology, and solution viewpoints and their relationships and supports business direction, vision, strategy, etc EA Modelling, support the minimum viewpoints of business, information, solutions, and technology. Modeling of As-Is and Target state, Impact Analysis, and Roadmaps Decision Analysis, capabilities such as gap analysis, traceability, impact analysis, scenario planning, and system thinking. Multiple Views support multiple views for different types of audiences/users such as Executives, Architects/Designers, Business Planners, Suppliers, etc. Support customization and extensions of meta-model, diagrams, menus, matrices, and reports Collaboration and Sharing, provide good collaboration-oriented features, which include simultaneous model editing, a shared remote repository, version management including model comparison and merge, easy publishing, and review capabilities


Could Blockchain Be Sustainability’s Missing Link?

Environmental sustainability is only one use case for blockchain technology. Companies can use distributed ledgers for social sustainability and governance. For example, pharmaceutical companies can collect data on a blockchain that identifies and traces prescription drugs. This data collection can prevent consumers from falling prey to counterfeit, stolen, or harmful products. Banks can collateralize physical assets, such as land titles, on a blockchain to keep an unalterable record and protect consumers from fraud. In supply chain finance, organizations can use distributed ledger technology to match the downstream flow of goods with the upstream flow of payments and information. That can help level the playing field for smaller financial institutions. Sustainability must be seamless. ServiceNow recently partnered with Hedera to help organizations easily adopt digital ledger technology on the Now Platform. This partnership provides a seamless connection between trusted workflows across organizations.


Supply chain woes? Analytics may be the answer

Enterprises face multiple risks throughout their supply chains, Deloitte says, including shortened product life cycles and rapidly changing consumer preferences; increasing volatility and availability of resources; heightened regulatory enforcement and noncompliance penalties; and shifting economic landscapes with significant supplier consolidation. ... “Often people think of the supply chain as one thing and it is not,” Korba says. “We think of the supply chain as the sum of several parts of the whole business operation — from understanding customer demand to materials management and manufacturing or sourcing and purchasing, to logistics and transportation, to inventory management and automated replenishment orders at Optimas and at our customers’ locations.” A key to success is the ability for all the supply chain tools the company uses to work together seamlessly, to help keep customers appropriately stocked and better manage costs, demand, inventory, production, and suppliers. The information provided through analytics needs to address financial issues such as cashflow and pricing on the supply and demand sides.


Cloud 2.0: Serverless architecture and the next wave of enterprise offerings

Serverless architecture brings two benefits. First, it enables a pay-as-you-go model on the full stack of technology and on the most granular basis possible, thereby reducing the overall run cost. The pay-as-you-go model is activated by putting functions into production via the operator of the serverless ecosystem only when they are needed. Therefore, serverless architecture not only reduces costs below the economies of scale provided by cloud-based setups capable of operating infrastructure at large scale, but also reduces idle capacity. Second, serverless architecture provides ecosystem access for the underlying infrastructure as well as the entire functionality, thereby drastically reducing the cost to transform the company’s IT environment. Ecosystem access for functions is achieved through the provider’s FaaS and BaaS models instead of being redeveloped for every client. While ecosystem access in SaaS was only possible for the entire software package, with serverless architecture even small-scale functions can be reused, thereby offering more flexibility and reusability on a broad basis.


Meta wants to turn real life into a free-to-play

Companies adopting the free-to-play monetization techniques in their titles naturally have an incentive to max out the users’ shopping sprees. To this end, they can deploy a whole array of design decisions, from annoying pop-ups with links to in-game shops to more sophisticated tools. The latter use behavioral data and psychological tricks to goad the users into spending more. Some of the latest patents coming from leading industry names, such as Activision, put machine learning at the service of the company’s bottom line. Tweaking the matchmaking system to prompt new players to spend more? Check. Clustering players in groups to target them with tailored messaging, offerings, and prices? Check. These and other techniques live and breathe behavioral data. As such, they do raise red flags in terms of data exploitation, especially if you consider who tends to fall for them the hardest. Free-to-play games make a solid chunk of their revenues off a very small subset of their player base, the so-called “whales,” as high-paying players are known in the industry.


Managing Complex Dependencies with Distributed Architecture at eBay

The eBay engineering team recently outlined how they came up with a scalable release system. The release solution leverages distributed architecture to release more than 3,000 dependent libraries in about two hours. The team is using Jenkins to perform the release in combination with Groovy scripts. As we learnt from Randy Shoup (VP of engineering and chief architect at eBay) and Mark Weinberg (VP, core product engineering at eBay) had systemic challenges with releasing major dependencies, leading to the equivalent of distributed monoliths. Late last year, eBay began migrating their legacy libraries to a Mavenized source code. The engineering team needed to consider the complicated dependency relationships between the libraries before the release. The prerequisite of one library release is that all the dependencies of it must have been released already, but considering the large number of candidate libraries and the complicated dependency relationships in each other, it will cause a considerable impact on release performance if the libraries release sequence cannot be orchestrated well.


Mark Zuckerberg’s vision for the metaverse is off to an abysmal start

While Meta’s promotional vision for metaverse worlds is a series of distinct snapshots, other metaverse platforms, such as Decentraland, The Sandbox, and Cryptovoxels, feature some level of urban planning. Like in many real-world cities, they use a grid system with plots of land distributed on a horizontal plane. This allows for property to be easily parceled and sold. However, many of these plots have remained empty, demonstrating that they are primarily traded speculatively. In some instances, content—buildings and things to do, see, and buy within them—has been added to plots of land, in an effort to create value. Virtual property developer the Metaverse Group is leasing Decentraland parcels and offering in-house architectural services to tenants. Its parent company, Tokens.com, has virtual headquarters there too, a blocky sci-fi-style tower in an area called Crypto Valley. ... Real cities are now choosing to emulate themselves in the metaverse. South Korea’s Metaverse 120 Centre will provide both recreational and administrative public services. 


SARB notes benefits, risks in using distributed ledger technology

One of the primary risks stems from the lack of regulatory certainty as the existing legal and regulatory frameworks for financial markets were not designed for trading, clearing or settling on DLT, he added. Innovation should be done in a way that the financial system is taken forward to benefit society as a whole, including contributing to achieving objectives such as improving efficiency, lowering barriers to entry for financial activity and addressing any challenges restricting access to meaningful financial services. ... “PK2 has demonstrated that building a platform for a tokenised security would impact on the existing participants in the financial market ecosystem, as several functions currently being performed by separately licensed market infrastructures could be carried out on a single shared platform. ... Further, the report, produced in partnership with the Intergovernmental Fintech Working Group and financial industry participants, highlights several legal, regulatory and policy implications that need to be carefully considered in the application of DLT to financial markets.


Why There is No Digital Future Without Blockchain

In web3, new storage solutions allow people to store data for each other in a secure and decentralized way. This makes it much, much, more difficult to obtain user data through hacking a server full of data. At the same time, the way data will be managed on the user-side is that it will be completely permission-based. Users will be able to manage data access on the fly, giving and withdrawing permission to personal data when needed. In our vision, this will end up being the way the internet is going to work in the future, whether you apply for a loan or do an online personality test. ... The power of blockchain here lies in the power of digital sovereignty, in other words, the freedom to do whatever you want online without anybody telling you otherwise. Here again, the decentralized nature of blockchain is key, because it makes it virtually impossible for any third party to interfere with the process. ... The idea is that the decentralized nature of blockchain allows people to transact wealth freely, without the need for banks, governments, or anybody else. This once sounded like a futuristic libertarian utopia, now it’s becoming a reality.


How to Measure Agile Maturity

Delivering successful products is essential and goes hand in hand with knowing how good we are at creating the product: our performance. I suggest resisting the urge to measure our performance as a cost. There are many useful metrics available such as speed, quality, predictability, etc that monitor our performance. A word of caution is needed to decide which metrics are valuable and which are not. For example, Velocity is not suitable to compare team performance. Although it can be a valuable metric at a team level, intended for the team to monitor its own speed. However, velocity does not add up to give you a number on your organisational speed. Some suggestions for useful metrics: cycle time, release frequency, product index, innovation rate, etc. ... Measuring how well we perform in delivering value to the customer also serves as a metric for organisational change. How? If it takes multiple sprints and 16 hand-offs to ship an integrated product, we can monitor how we are doing in trying to deliver that integrated product without hand-offs in a single sprint. If the number of handoffs of a team goes down, their ability to deliver Done goes up, which is a metric of organisational improvement.



Quote for the day:

"Leaders must encourage their organizations to dance to forms of music yet to be heard." -- Warren G. Bennis

Daily Tech Digest - April 08, 2022

Why Literate Programming Might Help You Write Better Code

Literate programming is an approach to programming in which the code is explained using natural language alongside the source code. This is distinct from related practices such as documentation or code comments; there, the code is primary, with commentary and explanation being secondary. In literate programming, however, explanation has equal billing with the code itself. “Documentation is fundamentally disconnected from the code,” Franusic noted. Often, “documentation is written by someone who doesn’t work on the code. This distance between code and documentation makes it harder to really understand what the code is doing.” This underlines what makes literate programming particularly valuable: it’s a means of gaining greater transparency or clarity over code. Having been developed in the early ‘80s by Donald Knuth, a computer scientist now professor emeritus at Stanford University, it would be easy to dismiss literate programming as a relic of a much earlier era of computing.


FBI Cybersecurity Strike Against Russian Botnet Is ‘Awesome Moment’ For MSPs

The FBI operation marks the beginning of a new era in the continuing battle MSPs are waging to protect SMBs and themselves from all kinds of attacks, including nation-state attacks, said Stinner. “Big businesses have invested heavily in cybersecurity, and their defenses are high,” he said. “They are harder to attack. This was an attempt by Russia to inflict maximum chaos in the United States economy by taking down small businesses. This could potentially have impacted millions of small businesses. The Russian government was looking to take down Main Street, and they targeted WatchGuard devices. If Russia was successful, this could have caused mass pandemonium.” Michael Goldstein, president and CEO of Fort Lauderdale, Fla.-based MSP LAN Infotech, applauded the FBI for working closely with WatchGuard to take “action” to prevent what could have been a devastating attack. “It looks like the firewalls were there, [and they were] planting malware that were botnets that were going out and reporting back [to the hackers],” he said.


Is Crypto Re-Creating the 2008 Financial Crisis?

I’ve definitely heard that a selling point of DeFi is that it gets rid of the need for bailouts. And yes: I’ve had people accuse me on this point of shilling for big banks, and it’s just not true. If you’re asking me to choose, I’d absolutely rather see a bailout that prevents broader, sustained economic chaos than not. And the reason for that isn’t because I care about protecting executives at banks. In all my work, I’m speaking for the people downwind of all of this. The already vulnerable people who end up being hurt the most by financial collapse. ... Complexity is weaponized in some of these instances to deflect scrutiny. This is an old trick from the financial industry: Make things more complex. In DeFi, you have financial complexity overlaid with technical complexity, too—so there is, really, just the thinnest subset of people who can do both. And those people will be paid a LOT of money to participate and build these tools. And when the slice of people is so small and they’re so handsomely rewarded, there’s not going to be many savvy watchdogs—there’s less incentive to be a policeman on the beat. It’s much easier to just go work on a project.


How To Get Started With IoT Device Security

An organization’s first step is to know the locations of all its intelligent devices. That’s harder to do than it might seem. These devices are commonly installed by one user or department without coordination of the rest of the organization. The move to remote work has exacerbated the problem at the edge, with organizations lacking visibility into the devices used by remote employees. To locate intelligent devices, an organization must map the IoT security architecture. In doing so, the organization should have a clear view of how each device interacts with the application and technology stack. Additionally, the organization must understand who in the organization is responsible for updating and managing devices. Having a full list of the devices is also important. Traditionally, companies use network device monitoring or asset management and monitoring software. That’s a good start, but using IoT-specific tools can be more accurate. These include IoT asset management software and network sensors. IoT security platform vendors include Ordr, Tele2, BeWhere, and Particle.


Comparing Go vs. C in embedded applications

Compiled Go code is generally slower than C executables. Go is fully garbage collected and this itself slows things down. With C, you can decide precisely where you want to allocate memory for the variables and whether that is on the stack or on the heap. With Go, the compiler tries to make an educated decision on where to allocate the variables. You can see where the variables will be allocated (go build -gcflags -m), but you cannot force the compiler to use only the stack, for example. However, when it comes to speed we can not forget about compilation speed and developer speed. Go provides extremely fast compilation; for example, 15,000 lines of Go client code takes 1.4 seconds to compile. Go is very well designed for concurrent execution (goroutines and channels) and the aforementioned rich standard library covers most of the basic needs, so development is faster. ... There are two Go compilers you can use: the original one is called gc. It is part of the default installation and is written and maintained by Google. The second is called gccgo and is a frontend for GCC. With gccgo, compilation is extremely fast and large modules can be compiled within seconds. 


Transformers for software engineers

This post is an attempt to present the Transformer architecture in a way that highlights some of the perspectives and intuitions that view affords. We’ll walk through a (mostly) complete implementation of a GPT-style Transformer, but the goal will not be running code; instead, I’m going to use the language of software engineering and programming to explain how these models work and articulate some of the perspectives we bring to them when doing interpretability work. ... At the highest level, an autoregressive language model (including the decoder-only Transformer) will take in a sequence of text (which we’ll refer to as a “context”), and output a sequence of “logits” the same length as the context. These logits represent, at each position, the model’s prediction for the next token. At each position, there is one logit value per entry in our vocabulary; by taking a softmax over the logit vector, we can get a probability distribution over tokens.


FDA Document Details Cyber Expectations for Device Makers

"The structure of the guidance document has changed to align with a secure product development framework and associated ties to the quality system regulations," she says. The FDA also removed "risk tiers" that were contained in previous 2018 draft guidance. "The cybersecurity of the healthcare sector depends on the cybersecurity of all medical devices," according to Schwartz. "To ensure that all manufacturers are appropriately addressing cybersecurity risks, the FDA recommends that all manufacturers provide the requested cybersecurity information; however, the amount of cybersecurity documentation is expected to scale with the cybersecurity risk of the device." Also, the new draft guidance - unlike the draft issued in 2018 - does not refer to "cybersecurity bill of materials," but instead refers to "software bills of materials," she says. "The primary difference between a CBOM and an SBOM, as outlined, is that CBOM also includes hardware. SBOM includes firmware, which is a type of software." 


4 tips for transitioning into an IT management role

Micromanagement is about mistrust. The micromanager believes that they can do things better or faster than anyone else. What micromanagers usually fail to understand is that their behavior causes long-term problems. Team members of micromanagers often feel demoralized. They begin to question their purpose at work and whether their boss values their input. Some employees kick back and ride the wave, figuring their manager will make corrections regardless of what they do. Others look to escape. Meanwhile, the micromanager is stressed out because there aren’t enough hours in the day to do their job and everyone else’s. It usually takes an intervention to get these leaders back on track. Reformed micromanagers usually have experienced an epiphany. Perhaps they’ve received a 360-degree assessment that reveals their behavior, or perhaps someone they respect calls them out on their conduct. These leaders eventually realize that employee engagement depends entirely on the very trust they’re eroding.


Accommodating the influx of data in the metaverse

One of the foundational pillars to enable the metaverse is more efficient and less energy-hungry data compression. As XR technologies advance and become more mainstream, the metaverse needs to accommodate higher resolution displays and higher streaming quality, for both video feeds and volumetric objects, to allow its users to completely immerse themselves. By reducing the mammoth file sizes needed, businesses can conserve storage capacity and power, and minimise the need to expand their infrastructure to cope. They can also effectively manage the growing volumes of data from XR devices without compromising on viewer quality. The low-complexity coding enhancement standard, MPEG-5 LCEVC (LCEVC), is an example of technology ideally suited to metaverse applications. It allows highly efficient compression of low-latency video feeds, making higher quality streaming in the new XR reality possible and mass adoption more feasible. LCEVC also offers various multi-layering features which are ideal to video streaming and rendering within a complex 3D space, swiftly displaying and updating the image pixels without any apparent lag for the user.


Organizations underestimating the seriousness of insider threats

“Despite increased investment in cybersecurity, organizations are focused more on protecting themselves from external threats than paying attention to the risks that might be lurking within their own network,“ says Chris Waynforth, AVP Northern Europe at Imperva. “Insider threats are hard to detect because internal users have legitimate access to critical systems, making them invisible to traditional security solutions like firewalls and intrusion detection systems. The lack of visibility into insider threats is creating a significant risk to the security of organization’s data.” The main strategies currently being used by organizations in EMEA to protect against insider threats and unauthorized usage of credentials are periodical manual monitoring/auditing of employee activity (50%) and encryption (47%). Many are also training employees to ensure they comply with data protection/data loss prevention policies (65%). Despite these efforts, breaches and other data security incidents are still occurring and 56% of respondents said that end users have devised ways to circumvent their data protection policies.



Quote for the day:

"Leaders are more powerful role models when they learn than when they teach." -- Rosabeth Moss Kantor

Daily Tech Digest - April 07, 2022

Researchers Identify ‘Master Problem’ Underlying All Cryptography

In the absence of proofs, cryptographers simply hope that the functions that have survived attacks really are secure. Researchers don’t have a unified approach to studying the security of these functions because each function “comes from a different domain, from a different set of experts,” Ishai said. Cryptographers have long wondered whether there is a less ad hoc approach. “Does there exist some problem, just one master problem, that tells us whether cryptography is possible?” Pass asked. Now he and Yanyi Liu, a graduate student at Cornell, have shown that the answer is yes. The existence of true one-way functions, they proved, depends on one of the oldest and most central problems in another area of computer science called complexity theory, or computational complexity. This problem, known as Kolmogorov complexity, concerns how hard it is to tell the difference between random strings of numbers and strings that contain some information. ... The finding suggests that instead of looking far and wide for candidate one-way functions, cryptographers could just concentrate their efforts on understanding Kolmogorov complexity. “It all hinges on this problem,” Ishai said. 


4 Reasons Decentralized Business Management Is Booming

Organizations face employee churn all the time, whether due to a lack of challenging work or dissatisfaction with the company's overall direction. Both of these reasons are interconnected. An inflexible organizational hierarchy leaves employees fighting to impress their managers instead of creating revenue-generating assets. With power consolidated in the hands of a few, leadership skills are scarce. Thus, when top-level executives move on, the company faces a tough time replacing those who departed and must engage resources to locate and vet suitable leadership. Promoting from within is ideal because long-term employees understand the company and its products well. They've witnessed the company's processes from the ground up, which makes them ideal leaders. However, centralized organizations don't provide low-level employees with the opportunity to ascend to leadership roles. A decentralized organization forces employees to act as leaders. Thanks to greater autonomy and priority on responsiveness, employees must act decisively. Intrapreneurship increases, promoting creativity, and the organization is energized.


DeFi can breathe new life into traditional assets

Tokenization of commodities enables blockchain-based ownership of a physical asset, which is essentially just a decentralized version of an already-existing practice in traditional finance. Tokenized precious metals are somewhat similar conceptually to a share in a gold exchange-traded fund (ETF), as they represent the investor’s stake in physical gold stored elsewhere and largely work toward the same purpose. Projects like VNX offer digital ownership of tokenized commodities that are backed by physical assets including gold, giving the investor the same benefits as investing in physical gold but have the versatility of a crypto asset on top of that. Stablecoins are also a viable option, allowing investors to reap the benefits of decentralization while maintaining the security of traditional finance. Backing from fiat and other real-world assets removes the common fear that crypto has no basis. Stablecoins like TrustToken (TUSD) grant investors more certainty and flexibility, lowering the stakes for any user by enabling easy redeeming of their funds at any given moment.


Chinese APT Targets Global Firms in Monthslong Attack

The campaign, which began in October 2019, targeted Japanese firms and their subsidiaries in 17 locations across the world, Symantec said in its report. The focus of the campaign was to exfiltrate data, particularly from automotive organizations, as part of an industrial cyberespionage effort. The APT group was then using a custom malware variant called Backdoor.Hartup as well as "living off the land" tools to target its victims. Once the victim's network was compromised, the hackers remained active for up to a year to exfiltrate data. Cicada then used a Dynamic Link Library side-loading technique to compromise the victims' domain controllers and file servers. "Various tools (were) deployed in this campaign, and Cicada’s past activity indicates that the most likely goal of this campaign is espionage. Cicada activity was linked by U.S. government officials to the Chinese government in 2018," the latest report says. Upon successfully gaining access to victim machines, the Symantec researchers observed APT actors deploying a custom loader and the SodaMaster backdoor. 


First malware targeting AWS Lambda serverless platform disclosed

The researchers have dubbed the malware “Denonia” — the name of the domain that the attackers communicated with — and say that it was utilized to enable cryptocurrency mining. But the arrival of malware targeting AWS Lambda suggests that cyberattacks against the service that bring greater damage are inevitable, as well. Cado Security said it has reported its findings to AWS. In a statement in response to an inquiry about the reported malware discovery, AWS said that “Lambda is secure by default, and AWS continues to operate as designed.” ... Cado Security cofounder and CTO Chris Doman said that businesses should expect that serverless environments will follow a similar threat trajectory to that of container environments, which he noted are now commonly impacted by malware attacks. Among other things, that means that threat detection in serverless environments will need to catch up, Doman said. “The new way of running code in serverless environments requires new security tools, because the existing ones simply don’t have that visibility. They won’t see what’s going on,” Doman said. “It’s just so different.”


Why We’re Porting Our Database Drivers to Async Rust

Similar to the way Python relies on modules compiled in C to make other modules less unbearably slow faster, our CQL drivers could benefit from a Rust core. A lightweight API layer would ensure that the drivers are still backward compatible with their previous versions, but the new ones will delegate as much work as possible straight to the Rust driver, trusting that it’s going to perform the job faster and safer. Rust’s asynchronous model is a great fit for implementing high-performance, low-latency database drivers because it’s scalable and allows high concurrency in your applications. Contrary to what other languages implement, Rust abstracts away the layer responsible for running asynchronous tasks. This layer is called runtime. Being able to select, or even implement, your own runtime is a powerful tool for developers. After careful research, we picked Tokio as our runtime due to its active open source community, focus on performance; rich feature set, including complete implementation for network streams, timers, etc., and lots of fantastic utilities like tokio-console.


How David Chaum Went From Inventing Digital Cash to Pioneering Digital Privacy

Shocked by the surveillance operations exposed by Edward Snowden, Chaum refined the mixing technologies developed at the end of the 1970s to provide untraceable message sending, using sophisticated cryptography not only to encrypt the content of message but to hide the identity of the user by eliminating the "metadata" of who sends messages to whom, how often and from where. Chaum is horrified by the promises of “end-to-end” message content encryption offered by companies such as Meta (formerly Facebook.) It leaves user metadata intact, which means it can still be harvested and sold, he warns. “It's criminal. It's exploitative of the public in the worst way,” says Chaum. “Because the real value in the information is the traffic data,” and “the sender's social graph and its relation to the timing of events,” he says—it could be used to predict our behavior and to further political ends (as was the case in the Cambridge Analytica scandal).


Reproducibility in Deep Learning and Smooth Activations

The Smooth reLU (SmeLU) activation function is designed as a simple function that addresses the concerns with other smooth activations. It connects a 0 slope on the left with a slope 1 line on the right through a quadratic middle region, constraining continuous gradients at the connection points (as an asymmetric version of a Huber loss function). SmeLU can be viewed as a convolution of ReLU with a box. It provides a cheap and simple smooth solution that is comparable in reproducibility-accuracy tradeoffs to more computationally expensive and complex smooth activations. The figure below illustrates the transition of the loss (objective) surface as we gradually transition from a non-smooth ReLU to a smoother SmeLU. A transition of width 0 is the basic ReLU function for which the loss objective has many local minima. As the transition region widens (SmeLU), the loss surface becomes smoother. If the transition is too wide, i.e., too smooth, the benefit of using a deep network wanes and we approach the linear model solution — the objective surface flattens, potentially losing the ability of the network to express much information.


The security implications of the hybrid working mega-trend

Ultimately, any high-level security model really breaks down into a trust issue: Who and what can I trust? – the employee, the devices, and the applications the employee is trying to connect to. In the middle is the network, but today, more often than not, the network is the internet. Think about it. Employees sit in coffee shops and log onto public browsers to access their email. So now what organisations are looking for is a secure solution for their applications, devices, and users. Every trusted or ‘would-be trusted’ end-user computing device has security software installed on it by the enterprise IT department. That software makes sure the device and the user who is on the device is validated, so the device becomes the proxy to talk to the applications on the corporate network. So now the challenge lies in securing the application itself. Today’s cloud infrastructure connects the user directly to the application, so there is no need to have the user connect via an enterprise server or network. The client is always treated as an outsider, even while sitting in a corporate office.


The Principles of Test Automation

The only way to reliably find errors is to build a comprehensive automated test suite. Tests can check the whole application from top to bottom. They catch errors before they can do any harm, find regressions, and run the application on various devices and environments at a scale that is otherwise prohibitively expensive to attempt manually. Even if everyone on the team was an exceptionally clever developer that somehow never made a mistake, third-party dependencies can still introduce errors and pose risks. Automated tests can scan every line of code in the project for errors and security issues. ... Some tests start their lives as manual tests and get automated down the road. But, more often than not, this results in overcomplicated, slow, and awkward tests. The best results come when tests and code have a certain synergy. The act of writing a test nudges developers to produce more modular code, which in turn makes tests simpler and more granular. Test simplicity is important because it’s not practical to write tests for tests. Code should also be straightforward to read and write. Otherwise, we risk introducing failures with the test themselves, leading to false positives and flakiness.



Quote for the day:

"Without courage, it doesn't matter how good the leader's intentions are." -- Orrin Woodward

Daily Tech Digest - April 06, 2022

How One Airline Is Using AR to Improve Operations

While the AR glasses are expected to shave 6 percent off those 1,000 daily hours, we have found in our research on the integration of this technology at CSA that the advantages of the AR glasses go far beyond the labor dividend. They aren’t just a new way to get information – they’re a whole new way of working. CSA’s AR glasses allow engineers to edit and reorganize their job list, change the information they see, and how they want it shown. Their displays can be adjusted by aircraft, season, and even individual preference. They offer the engineers step-by-step multimedia support and immersive experiences during the execution of the tasks, including AI object recognition and collaboration with a remote expert. “Combined with some [artificial intelligence], the AR glasses can really make our job a lot easier,” one MRO engineer said. “I can now point my fingers to a place, for example, a lubricating oil cap, and it automatically recognizes the object or the key parts and tells me that it’s open but should be closed. It also can show me, in a picture or a short video, how the object looked in normal condition or in its last service.”


It’s Not Only Banking APIs That Must Be Secured

With the growing number of APIs developed by organizations, there should be a standard method for developers to understand how to use them. This is where a good developer portal is the critical link between the API provider and the developer that needs to consume it. We won’t explore the inner workings of a DevPortal here, but one key component is managing API access. This typically involves generating a client_id or secret, or managing certificates that can be used to obtain access tokens that will grant access to the API. The DevPortal is also used to track API usage and can correlate who or what is accessing an API and how often. A token-based architecture can help protect the APIs by mapping a specific client_id to a developer (or app). This way, the API gateway, for example, can determine who is accessing an API based on the token presented. To automate this process, an integration between the DevPortal and the identity provider (IdP) using dynamic client registration (DCR) is typically set up. 


Cybersecurity Mesh: IT's Answer to Cloud Security

Security analytics and intelligence describes a layer comprised of various security tools, all of which communicate with each other. In conjunction with the individual security perimeter around every user and device, UEBA tools work to detect behavioral anomalies, reduce insider attacks, and gain contextual data for further investigation. Distributed identity fabric denotes a layer comprised of data and connected processes. Within this layer, analytics tools continuously assess data points from disparate applications; these tools not only actively recommend where data should be used and modified, but they also help to differentiate between genuine, approved users and malicious attackers. Consolidated policy and posture management is the layer through which IT personnel can define application access policies for users and devices — all from a central location. These layers, which can be thought of as the "data security mesh," all exist beneath the network layer; put differently, they work together to monitor where data is used, stored, and shared by every user and device in the network.


Everything You Should Know About Data Integration

Data integration brings together data gathered from disparate sources into a valuable, meaningful data set for business analytics and business intelligence. By consolidating data, say, transactional, warehouse status, social media, etc., in various formats and structures, into one single place, business users get its 360-degree view. The unified view empowers users to comprehend the intricacies of business by deriving analytics and, therefore, helps them make decisions accordingly. Without data integration, companies cannot access bi-directional data streams gathered in one system in another. For instance, a business can collect data in a CRM, which nobody can access outside its sales and marketing. No doubt, other teams in the company will want to gain access to that data, perhaps when completing an order or managing credit accounts. This leads to data being shared manually, via emails, phone calls, spreadsheets, etc. And when that happens, mistakes are inevitable. With data integration, data is shared between systems in a seamless manner. 


8 DevOps Best Practices That You Must Know

CD or Continuous Delivery is a process that begins after Continuous Integration (CI). All the codes that are from CI are taken for production. This is a very important process for shifting the left. The CD process begins by developing, building, and testing the CI. The CD process is not as much adopted and implemented as the CI process but is crucial for a wholesome DevOps integration. ... In today’s world, security is very important, especially for software that can be hacked and breached. So it becomes mandatory that all the processes are constantly monitored in real-time to detect the presence of security issues. Using a security-first approach will help detect any security threat and risk earlier so that a lot of consequences of delayed action can be prevented with low cost and loss of data. This also increases security. ... For a DevOps approach to be successful, the processes have to be automated. In order to effectively automate software development processes, DevOps tools are absolutely necessary. There are so many DevOps tools available for different purposes, such as measuring different metrics, detecting security issues, etc. 


JPMorgan CEO Jamie Dimon Says DeFi Is ‘Real’

“It’s obviously very early. We will assess use cases and and customers demand. But it’s still too early to see where this goes for us.“ And the JPMorgan Chase CEO added: “And we are using blockchain for sharing data with banks already, and so we are at the forefront of that, which is good. The other question was about FinTech… Look, first of all, they are very good competitors… They are strong. They are smart. Some effectively ride the rails. So we bank a lot of them. You know, we help them accomplish what they want to accomplish… “My view is we are going to compete –we need to — and we have to look at our split inside of what we could do better, or could have done better, and things like that. So I am confident we will compete, but I think we now are facing a whole generation of newer, tougher, faster competitors who if they don’t ride the rails of JP Morgan, they can ride the rails of someone else… “I have told you before: everyone is going to be involved in payments. Some banks going to white label, which makes FinTech competitors white label banks and build whatever service on top of it, and we have to be prepared for that. ...“


Stanford engineers invent a solar panel that generates electricity at night

The new technology takes advantage of a surprising fact about solar panels. “During the day, there's a light coming in from the Sun and hitting the solar cell, but during the night, something of a reverse happens,” Assawaworrarit says. That’s because solar panels — like everything warmer than absolute zero — emit infrared radiation. “There’s actually light going out [from the solar panel], and we use that to generate electricity at night. The photons going out into the night sky actually cool down the solar cell,” he says. As those photons leave the skyward surface of the solar panel, they cary heat with them. That means that on a clear night — when there are no clouds to reflect infrared light back toward the Earth — the surface of a solar panel will be a few degrees cooler than the air around it. That temperature differential is what Assawaworrarit and his colleagues are taking advantage of. A device called a thermoelectric generator can capture some of the heat flowing from the warmer air to the cooler solar panel and convert it into electricity.


Postgres everywhere

In a world where Postgres is everywhere, instances will need to synchronize with other instances in many different ways. Postgres offers a wealth of mechanisms for doing that. When using the built-in streaming replication feature, a primary server transfers data synchronously to one or more standby receivers. Another built-in feature, log shipping, asynchronously transfers batches of log records from a primary to a standby. As always, Postgres’s robust extension ecosystem augments the built-in capabilities. One third-party extension, pglogical, implements logical replication for non-Postgres publishers and subscribers such as Kafka and RabbitMQ. You can find a number of other solutions in this expanding category. Meanwhile the bundled postgres_fdw extension leverages Postgres’s foreign data wrapper mechanism to connect local and remote tables for both read and write operations. One way or another a Postgres instance running on your devices, or in your personal and team clouds, will be able to sync with instances running elsewhere.


Policy-as-Code or Policy-as-Data? Why Choose?

Policy-as-code provides a powerful abstraction for lifting authorization logic out of an application and centralizing it in a different source code repository, allowing for separation of duties between application developers, who only need to worry about enforcing the policy by passing it the correct inputs, and security engineers, that can evolve the policy without direct involvement from developers. Expressing policy as code makes it inherently easier to reason about – an engineer that is familiar with the language syntax can easily determine how a policy works, and can test a policy with different inputs to determine what it will do. Providing a standard mechanism for building policies into immutable images and signing them is an important aspect of ensuring a secure software supply chain for policy artifacts. The Open Policy Registry provides this capability for OPA policies. Finally, having complete decision logs that include the policy image, user context, and resource context that were used to make each decision helps auditors reconstruct and replay these decisions, making it easier to attest to why each decision was made.


Introducing Einblick, the first visual data computing platform

“What is missing is a tool that facilitates a data discussion for a domain expert via a friendly visual interface with explainability, plus on that same canvas exists a “code cave” interface familiar to a data scientist such as a notebook or IDE. Furthermore, all of this needs to run on a nimble but powerful computation engine to handle any amount of data or user interactions,” said Kraska. This is where data collaboration and data visualisation tool Einblick come into play. It rethinks the design of data workflows, which traditionally focused on linearly solving problems as an individual contributor. Instead, it creates a multiplayer digital whiteboard that supports drag-and-drop interactions, no code data science operators, and Python. ... Einblick has been built on the idea that live collaboration is possible and code is optional. To make both of these conditions true, the team rethought the structure of analytics software from the ground up and developed several innovations, from the computational engine to UX. While most analytics platforms allow for sharing code or copying workflows, Einblick is the only platform that enables live conversation and multiplayer mode on the canvas.



Quote for the day:

"The actions of a responsible executive are contagious." -- Joe D. Batton

Daily Tech Digest - April 05, 2022

Want to build a relationship with your CIO? 5 things you shouldn't do

Increasingly, CIOs are tasked with the adoption and orchestration of many technology platforms that influence digital transformation and enable the business strategy. This adoption involves a delicate balance of ensuring adequate guardrails exist through technology and security governance, while at the same time striving for speed and agility. When an employee develops a reputation for being a blocker, it starts to create an adversarial relationship between the business and IT. That often leads to shadow IT, in which employees start going around the IT or information security departments to get things done. Certainly, IT and information security need to have a strong voice in highlighting risks or technical barriers, but it’s equally important that we do our best to be solution-oriented, finding creative ways to make technology work for the business and implementing it securely. When an employee becomes a chronic blocker to business objectives and every issue becomes an immovable object, it undermines the trust and collaboration that the CIO is working to promote with the business.


In search of elegance

Unfortunately, many respond to complexity by increasing complication—and thus increasing inelegance—through extensive bureaucracy with a rule for every contingency. Instead, leaders would be wise to pursue elegant simplicity: the fewest rules possible or, even better, a few rock-solid principles. This enables and empowers individuals and teams to quickly respond to the dynamism inherent in complexity. For example, look at Netflix’s five-word expense policy—“Act in Netflix’s best interest”—or Metro Bank’s customer service principle that requires only one person to say “yes” to a customer request, but two to say “no.” Authors Marc Effron and Miriam Ort, in their book, One Page Talent Management: Eliminating Complexity, Adding Value, argue, “Simplicity plays to basic human desires and cognitive processes. We crave it.” Insisting on simplicity rewards concise, coherent thinking and action; elegance recognizes and works with our core humanity. How better to engage and energize your workers? A fundamental challenge for leaders today is to reset and refocus their organizations to move with hope and confidence into an uncertain future.


Utilizing biological algorithms to detect cyber attacks

A standard approach to addressing spoofed domains is to compare them to a database of known domains and to look for differences. When an email arrives, the cybersecurity solution counts the number of changes between the attacker’s signature and each instance in the known domain database. If there are a few changes, the domain is deemed suspicious. Measuring the number of changes between two sequences in this traditional way is done via the Levenshtein distance. While this technique works in some instances – such as when it detects a spoofed domain like m1crosoft – it struggles to identify more significant obfuscations such as MlCR0S0FT (with an “L” in place of an “I” and zeros in place of the letter “O”). The Levenshtein distance metric also finds it challenging to distinguish between microsoft-support and a microsoft domain. Since the traditional method is sometimes insufficient in detecting phishing scams, researchers have turned to nature and to a method called biomimicry.


The Machines Are Coming: Financial Services Can Reduce the Blast Surface with Zero Trust

While the financial services industry has always been an attractive target for hackers, the impact of how work has changed during COVID-19 has raised the stakes even higher. Research done with UK-based IT and security professionals points out that most believe COVID-induced work-from-home practices and remote work are accelerating attack risks in the financial services industry. I’m sure no one was surprised by these revelations, given the attractiveness of financial services data, such as customer records and personally identifiable information…let alone the ability to actually steal money and other financial assets. Many of us also know that cyber thieves are using “machines” to do their dirty work, such as automated attack tools, as well as artificial intelligence and machine learning algorithms. Another challenge is that our industry has an increased use of what I call “ephemeral computing,” such as cloud services and on demand technology services. While cloud is arguably more secure than any single organization’s data center, misconfigurations and oversight can leave an organization’s crown jewel data exposed in public, as we’ve seen with an increased number of highly public stories.


Using Patterns to Drive a Transformation towards Agility

Looking at stories like the one outlined before, a pattern becomes visible: adaptability is mainly about organisational capabilities like situational awareness, clear alignment and focus on goals, and the ability to react fast to changes and to learn and improve and to deliver customer value constantly. Practically, there are many ways this can be accomplished. There is not “the one” blueprint that fits all organisations because much depends on the business, the environment, the evolution, and last but not least, the culture. This key insight triggered the idea to work on the travel guide for growing an adaptive organisation to give guidance, inspiration, orientation and ideas for experimenting in your concrete context so that you can find out what works for you - every transformation journey is different in the end. The idea of the travel guide is, that while we cannot give people a recipe for doing an agile transformation, we can share the transformation journeys we have lived through and show emerging success patterns that can guide others in their journey. 


An Introduction to Bluetooth Mesh Networking

Since the nodes in a mesh can act as repeaters, the range of the network can be extended beyond that of a single radio. Due to these advantages, wireless communication protocols that are designed for IoT applications have included mesh networking capability in their standards to enable scaling the network geographically through multi-hop operations. ... Many basic features of mesh networking are supported by all of these three protocols. For example, they all include the ability to self-heal, meaning that if a node is disabled or removed, the network reconfigures automatically to repair itself. However, there are major differences between these protocols. For instance, Bluetooth mesh uses a technique known as managed flooding to route data packets through the network where messages are simply broadcast to all nearby nodes, while Zigbee and Thread use the full routing technique in which. a specific path is chosen for the messages going from node A to node B. Such differences can have a significant impact on the network performance depending on the application requirements and conditions. Evaluating certain aspects of the Bluetooth mesh technology, such as the network latency, reliability, scalability, etc., might not be straightforward in some cases.


How retail is using digital twins

The biggest takeaway is how digital twins make it easy to visualize complex relationships between physical things, including product placement, physical customer journeys and the paths robots might take down store aisles for inventory and floor cleaning. Managers and staff can explore how layouts, schedules, team movements and customer journeys interact in one visualization tool. They can also visually assess the impact of a new store layout, schedule or technology might impact cleaning, restocking and staffing requirements. Digital twins also have the potential to improve customer experiences in various ways. They could help customers connect the dots between home improvement projects, required materials and materials costs. They could also help improve physical customer journeys within stores by organizing the order shopping lists to line up with a route through the store. ... Emerging tech like digital twins, mixed reality and computer vision help capture data about the home and keep track of all the details to reduce this friction. The Lowe’s app takes advantage of the lidar built into the latest iPhones to capture home measurements quickly.


The Black Swan Events in Distributed Systems

When a system is asked to do more work than it possibly can, something is eventually going to fail. Maybe the CPU usage is very high that it has become the bottleneck and user requests start to time out suggesting the users that system is down. Or maybe the disk space has become the bottleneck and system can not store any more data. In a normal system overload case, if the source of load or trigger is removed, the problem goes away and everything sets back to normal state or stable state. ... Once we put a blocklist to stop the traffic from offending IP addresses, the trigger will go away , load on the network returns back to normal , user traffic begins to go through and the system comes back to its stable state. It’s hard to prevent such overloading incidents but, usually easy to recover from them. There’s another class of overloading incidents that are much harder to resolve, where the system does not recover back to its stable state by just removing the initial trigger These incidents can cause system outages down for a long period of time, it could be hours or even days in some cases. This class of incidents that continue to keep going even after the initial trigger has been removed are called metastable failures.


Citrix® Modernizes Security to Accommodate Hybrid Work

Citrix Secure Private Access is a cloud-delivered, ZTNA solution that provides contextual access to IT-sanctioned applications whether they are deployed on-prem, or in the cloud and delivers security controls for managed, unmanaged and BYO devices. Using the solution, IT organizations can: Provide zero trust network access to all apps, with adaptive authentication to continually evaluate access based on end user roles, locations, device posture, and user risk profiles. Securely support distributed work and BYO programs without risking exposure to malicious content and web-borne threats.
Simplify IT while enhancing the digital workspace experience for users. They can also enact a fresh approach to security that accommodates the realities of work today by giving employees the flexibility to work where they want using the devices of their choice, while ensuring that corporate data and assets remain safe. And many already are. Take HDI Global. With a rapidly growing work-from-home staff in Brazil, the international insurance company had a choice to make: increase investments in traditional servers and virtual machines, or enact a more modern approach to securely delivering apps.


Generations in the Workplace: Stereotypes and Facts

According to this report, ingrained stereotypes about age are actually far more likely to damage an IT team than failing to account for generational differences. It says, “What might really matter at work are not actual differences between generations, but people’s beliefs that these differences exist. These beliefs can get in the way of how people collaborate with their colleagues and have troubling implications for how we people are managed and trained.” That's not to say that there are not some true differences among the generations. For example, when you look at the age when people get married (or if they get married at all), you will spot some notable disparities among various age groups. But those disparities might be smaller than you think. And even if many people in an age category share a particular trait, it doesn't mean that every person you work with from that category will have the characteristics you expect. So how should IT managers handle teams with members of varying ages? A good way to start is by examining your own attitudes to see if you are being shaped by prevailing opinions. 



Quote for the day:

"Listening to the inner voice trusting the inner voice is one of the most important lessons of leadership. " -- Warren Bennis