Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - May 12, 2022

SD-WAN and Cybersecurity: Two Sides of the Same Coin

SD-WAN is a natural extension of NGFWs that can leverage these devices’ content/context awareness and deep packet inspection. The same classification engines used by NGFWs to drive security decisions can also determine the best links to send traffic over. These engines can also guide queueing priorities, which in turn enables fine-grained quality-of-service (QoS) controls. ... Centralized cloud management is key to enabling incremental updates of these new features. Further, flexible policy-driven routing enables service chaining of new security features in the cloud rather than building these features into the SD-WAN customer premises equipment (CPE). For example, cloud-based services for advanced malware detection, secure web gateways, cloud-access security brokers, and other security features can be enabled via the SD-WAN platform, seamlessly bringing these and other next-gen security functions across the enterprise. The coordination between the cloud-based SD-WAN service and the on-premises SD-WAN CPE allows new security applications to benefit from both the convenience and proximity of an on-site device and the near-infinitely scalable computing power of the cloud.

Introducing AlloyDB for PostgreSQL: Free yourself from expensive, legacy databases

As organizations modernize their database estates in the cloud, many struggle to eliminate their dependency on legacy database engines. In particular, enterprise customers are looking to standardize on open systems such as PostgreSQL to eliminate expensive, unfriendly licensing and the vendor lock-in that comes with legacy products. However, running and replatforming business-critical workloads onto an open source database can be daunting: teams often struggle with performance tuning, disruptions caused by vacuuming, and managing application availability. AlloyDB combines the best of Google’s scale-out compute and storage, industry-leading availability, security, and AI/ML-powered management with full PostgreSQL compatibility, paired with the performance, scalability, manageability, and reliability benefits that enterprises expect to run their mission-critical applications. As noted by Carl Olofson, Research Vice President, Data Management Software, IDC, “databases are increasingly shifting into the cloud and we expect this trend to continue as more companies digitally transform their businesses. ...”

Visualizing the 5 Pillars of Cloud Architecture

If you understand your cloud infrastructure, you can more confidently ensure your customers can rely on your organization. With the ability to constantly meet your workload demands and quickly recover from any failures, your customers can count on you to consistently meet their service needs with little interruption to their experience. A great way to increase reliability in your cloud infrastructure is to set key performance indicators (KPIs) that allow you to both monitor your cloud and alert the proper team members when something within the architecture fails. Using a cloud visualization platform to filter your cloud diagrams and create different visuals of current, optimal and potential cloud infrastructure allows you to compare what is currently happening in the cloud to what should be happening. ... Many factors can impact cloud performance, such as the location of cloud components, latency, load, instance size and monitoring. If any of these factors become a problem, it’s essential to have procedures in place that result in minimal deficiencies in performance.

Zero Trust Does Not Imply Zero Perimeter

Don’t get me wrong, the concept of trusting the perimeter is fairly old-school/outdated and does come into conflict with more modern “cloud native” approaches. Remote users will also have issues with latency, especially if you require the users to VPN to your on-premises network and finally establish connectivity with the cloud. The theoretical modern approach is to not trust that perimeter. This doesn’t mean you have to get rid of it, but rather it’s not the default, since increasingly the perimeter is becoming more porous and ill-defined. This is as opposed to when moving to a “zero-trust” model, where everything needs to be proven for both the user identity and device prior to any data, application, assets and/or services (DAAS) being permitted to communicate to any services. Going further down memory lane, back in the day the perimeter used to mean that everything was located within your “castle” and perimeter-based system access was “all or nothing” by default. Once users were in, they were in, which also applies to any other type of actor, including malicious actors. Once the perimeter was breached, the malicious actor effectively had unlimited access to everything within the perimeter.

As Inflation Skyrockets, Is Now the Time to Pull Back on New IT Initiatives?

There are two big risks associated with pulling back, says Ken Englund, technology sector leader at business advisory firm EY Americas. Pulling back on projects may increase the risk of IT talent turnover, he warns. “Pausing or changing priorities for tactical, short-term reasons may encourage talent to depart for opportunities on other companies' transformational programs.” Also, given current inflationary pressure, “the cost to restart a project may be materially more expensive in the future than it is to complete today.” There's no doubt that pulling back on IT spend saves money over the short term, but short-sighted savings could come at the cost of long-term success. “If an organization must look to cut budgets, start with a strategic review of all projects, identifying which have the greatest possible impact and least amount of risk,” Lewis-Pinnell advises. Examine each project's total cost of ownership and rank them by cost and impact. Strategic selection of IT initiatives can help IT leaders manage through inflationary challenges. “Don’t be afraid to cut projects that aren’t bringing you enough benefit,” she adds.

Cyber-Espionage Attack Drops Post-Exploit Malware Framework on Microsoft Exchange Servers

CrowdStrike's analysis shows the modules are designed to run only in-memory to reduce the malware's footprint on an infected system — a tactic that adversaries often employ in long-running campaigns. The framework also has several other detection-evasion techniques that suggest the adversary has deep knowledge of Internet Information Services (IIS) Web applications. For instance, CrowdStrike observed one of the modules leveraging undocumented fields in IIS software that are not intended to be used by third-party developers. Over the course of their investigation of the threat, CrowdStrike researchers saw evidence of the adversaries repeatedly returning to compromised systems and using IceApple to execute post-exploitation activities. Param Singh, vice president of CrowdStrike's Falcon OverWatch threat-hunting services, says IceApple is different from other post-exploitation toolkits in that it is under constant ongoing development even as it is being actively deployed and used.

Zero Trust, Cloud Adoption Drive Demand for Authorization

Hutchinson advises enterprises to leverage a model that combines traditional coarse-grained role-based access rules, or RBAC, with a collection of finer-grained attributes-based access rules, or ABAC, that can describe not only the consumer of a service but also the data, system, environment and function. "While traditional RBAC models are easier for developers and auditors to understand, they usually result in role explosion as the system struggles to provide finer-grained authorization. ABAC addresses that fine-grained need but sacrifices both management and understanding as the vast array of elements necessary for such a system makes organizing the data extremely complex," says Hutchinson. He adds: "A complex policy rule might say: 'A customer's transactional data can only be viewed via a secure device at a bank branch by an accredited teller who is from the same country of origin as the customer.' Instead of creating a plethora of new roles to cover all of the different possible combinations, I can use the teller role while also checking attributes that will provide device profile, location, accreditation status and country of origin.

The Cloud Native Community Needs to Talk about Testing

After getting feedback from the community, including DevOps and QA engineers, the general consensus I received was that it’s easy to tell that cloud native is a developing field that is still establishing its best practices. We can look into different examples of areas that are still maturing. Not that long ago, we started to hear about DevOps, which brought the concept of shorter and more efficient release cycles, which today feels like a normal standard. More recently, we saw GitOps following the same tracks, and we are seeing that more teams are using Git to manage their infrastructure. It’s my belief that cloud native testing will soon follow suit, where teams will not see testing as a burden or an extra amount of work that is only “nice to have” but something that is part of the process that will save them a lot of development time. I’m sure all of you reading this are tech enthusiasts like me and probably have been building and shipping products for quite some time, and I’m also sure many of you noticed that there are major challenges with integration testing on Kubernetes, especially when it comes to configuring tests in your continuous integration/continuous delivery (CI/CD) pipelines to follow a GitOps approach.

Hybrid work: Best practices in times of uncertainty

Humans are social creatures who require some contact with others, but determining the right balance between proximity and contact in the virtual workplace is difficult – too much contact can be exhausting, and too little can lead to isolation. Work to find a balance that can help support your staff as they navigate the nuanced world of remote work. It’s also important to adopt a blended approach to technology and physical space. A combination of co-working spaces and telepresence tools can be just what you need to facilitate contact and collaboration among employees. This allows for an open environment where people can both collaborate and decompress in their own way while also bringing a sense of connection that may be impossible to achieve in a virtual environment. ... It’s not easy to develop policies that address both business and human needs in remote and hybrid work environments, but one thing remains certain: flexibility paired with autonomy is essential for success. CIOs play a critical role in creating an environment of flexibility and autonomy for staff members – one that can help support their professional development while also fostering increased satisfaction and success.

10 best practices to reduce the probability of a material breach

Cybersecurity is as much about humans as it is about technology. Organizations see fewer breaches and faster times to respond when they build a “human layer” of security, create a culture sensitive to cybersecurity risks, build more effective training programs, and develop clear processes for recruiting and retaining cyber staff. ... Organizations with no breaches invest in a mix of solutions, from the fundamentals such as email security and identity management, to more specialized tools such as security information and event management systems (SIEMs). These organizations are also more likely to take a multi-layered, multi-vendor security approach to monitor and manage risks better through a strong infrastructure. ... With digital and physical worlds converging, the attack surfaces for respondents are widening. Organizations that prioritize protection of interconnected IT and OT assets experience fewer material breaches and faster times to detect and respond.

Quote for the day:

"Good leaders make people feel that they're at the very heart of things, not at the periphery." -- Warren G. Bennis

Daily Tech Digest - May 11, 2022

Doing data warehousing the wrong way

Ask enterprises how they feel about their data warehouses, and a high percentage express dissatisfaction. They struggle to load data. They have unstructured data but the data warehouse can’t handle it, etc. These aren’t necessarily problems with the data warehouse, however. I’d hazard a guess that usually, the dissatisfaction arises from trying to force the data warehouse (or analytical database if you prefer) to do something for which it’s not well suited. Here’s one way the error starts, according to Sammer: By now, everyone has seen the rETL (reverse ETL) trend: You want to use data from app #1 (say, Salesforce) to enrich data in app #2 (Marketo, for example). Because most shops are already sending data from app #1 to the data warehouse with an ELT tool like Fivetran, many people took what they think was a shortcut, doing the transformation in the data warehouse and then using an rETL tool to move the data out of the warehouse and into app #2. The high-priced data warehouses and data lakes, ELT, and rETL companies were happy to help users deploy what seemed like a pragmatic way to bring applications together, even at serious cost and complexity.

5 ways AI can help solve the privacy dilemma

Protecting privacy while allowing the economy to flourish is a data challenge. AI, machine learning, and neural networks have already transformed our lives, from robots to self-driving cars to drug development to a generation of smart assistants that will never double book you. There is no doubt that AI can power solutions and platforms that protect privacy while giving people the digital experiences they want and allowing businesses to profit. What are those experiences? It’s simple and intuitive to every Internet user. We want to be recognized only when it makes our lives easier. That means recognizing me so I don’t have to go through the painful process of re-entering my data. It means giving me information — and yes, serving me an ad — that is timely, relevant, and aligns with my needs. The opportunities within the “personalization economy,” as I call it, are vast. McKinsey published two white papers about the size of the opportunity and how to do it right. Interestingly — and tellingly — the word “privacy” isn’t mentioned a single time in either of those white papers. That oversight is remarkable and overlooks the tension between privacy and personalization.

Building a Strong Business Case for Security and Compliance

Cybersecurity is not a service or product; it is prudent to show how protecting an organisation from losses is the only way for any financial benefit to be gained. Try to communicate to the board in numbers, for example, show that a £1 investment would stop a security event that could potentially cost £10 to the company. That way, it should be possible to get the board to vote on your side by demonstrating the business case and return on investment in security measures and protection. In order for the board to determine their investment decision in security, you should give them data that focuses on any threat vectors that are already evident, such as inadequate services for security awareness and employee training, processes and policies that are not adequately applied and recorded or a lack of data backup practices and patching updates. Formulating a risk/reward equation using a tiered security approach is a good way forward, as you can then direct investments towards incident response and detecting compliance. Once you have created a robust and compelling business case for your organisation, you need to share the proposal with the board.

How to Stop Failing at Data

Data projects are doomed when the people who plan and the people who execute don’t have the same tools, the same access, or even the same goals. Data scientists are really good at asking the right questions and running exploratory models, but they don’t know how to scale. Meanwhile, data engineers are experts at making data pipelines that scale, but they don’t know how to find the insights. We’ve been using tools that require such a high level of specialist expertise that it’s impossible to get everyone on the same page. Because data scientists only ever touch small subsets of the data, there’s no way for them to extrapolate their models to function at scale. They don’t have access to production-grade data technology, so they have no way of understanding the constraints of building complex pipelines. Meanwhile, data engineers are being handed algorithms to implement with the barest context of the business problem they’re trying to solve and with little understanding of how and why data scientists have settled on this solution. There may be some back and forth, but there’s rarely enough common ground to build a foundation.

Exploring the Gaps in Scrum Mastery

Often people assume that Scrum is just a work management approach that helps us increase efficiency by organizing our tasks. Instead, it is intended to enable people to work in focused, collaborative, autonomous teams that use empiricism, creativity, and innovation to pursue opportunities to deliver value to customers by solving complex problems. To be creative in solving challenging problems, the Scrum Team must feel safe enough to experiment, fail, and learn through empiricism. They need to view each backlog item, interaction, and piece of data as an opportunity to learn and optimize. If these things are not possible, the team will not thrive. How do we, as Scrum Masters, build an environment where this is possible? To help groups of people form into high-functioning teams, they need ownership, inspiring purpose, and self-accountability. These traits inspire curiosity and will encourage them to take responsibility for their own work, how they work as a team, and how they work with those outside of the team. How do we, as Scrum Masters, build an environment where this is possible?

Agile/Scrum is a Failure – Here’s Why

The Church of Agile is being corrupted from within by institutional forces that [can’t] adapt to the radical humanity [of] collaborative, self-organizing, cross-functional teams. … Agile wasn’t supposed to be this way. … Agile is supposed to be centered on people, not processes. … But many businesses instead prioritize controlling their commodity human resources. … Companies have dressed it up in Scrum’s clothing, claiming Agile ideology while reasserting Waterfall’s hierarchical micromanagement. … Properly implemented Scrum or Kanban [should] lead to the desired outcome within finite time and budget. … Stories as mini-Waterfalls [treat] the engineer as a cog in their employer’s machine … with no understanding of the craft, creativity, and critical thinking required to solve such complex problems. … Scrumfall relies, in other words, on the product team … providing a complete and perfect specification before development begins. And it relies on the development team … planning out a complete and perfect implementation before a single line of code is written. … The invading Waterfall taskmasters hidden in Scrum’s Trojan Horse absolutely hate uncertainty.

All About Ecstasy, a Language Designed for the Cloud

Ecstasy’s emphasis on predictability is perhaps best illustrated via the type system, known as the Turtles Type System, because it is bootstrapped on itself. As in Smalltalk, everything in Ecstasy is an object, and all Ecstasy types are built out of other Ecstasy types. In other words, unlike in Java or C#, there is no secondary primitive type system and chars, ints, bits, and booleans are all objects. In common with Java and C# there is a single root called Object — although, In Ecstasy, Object is an interface, not a class. Technically the type system supports a long and rather intimidating-looking list of features. It is fully generic and fully reified, covariant, module-based, transitively closed, type-checked and type-safe. The majority of type safety checks are performed by the compiler and re-checked by the link-time verifier, with only those checks in which the types cannot be fully known beforehand performed at runtime — specifically to allow support for type variance. “The Ecstasy language rules automatically handle covariance and contravariance,” Purdy wrote in an email response to The New Stack.

An offensive mindset is crucial for effective cyber defense

Threat intelligence is a key component to developing an offensive mindset. That’s why proactive cybersecurity auditing can be one of the best courses of action in stopping cyberattacks before they can impact an organization. To implement the right changes to cybersecurity strategy, an organization needs to understand fully existing network vulnerabilities. This can be accomplished through a few different tactics, including penetration testing and vulnerability scanning. Penetration testing involves a person purposefully hacking into a network to identify weaknesses to an organization’s system, while vulnerability scanning consists of an automated test that looks for potential security vulnerabilities. Both tactics enable organizations to better grasp the mind of a hacker and understand the “how” behind a potential attack. Something else to be considered – under the right circumstances – is the possibility of hiring a former hacker. Their insight could prove to be extremely helpful, as aptitude in identifying weaknesses can be a useful asset. Many former hackers find roles as a penetration tester / red team member fulfills their desire to expose system flaws while doing so legally, for the betterment of security.

Why businesses need to help employees build friendships

The past few years have made this worse. At many companies, the entire staff quickly became remote, and the days of team lunches, onsite gyms, happy hours, and chats in the hallway disappeared. Suddenly, that company culture ceased to exist. Even as some people returned to the office many weeks or months later, many others did not. As companies institute remote or hybrid working environments on a permanent basis, there are fewer opportunities to build relationships with colleagues in person. The loss of work friendships is likely one reason so many people are choosing to leave their jobs, as CNBC reported. And among those who stay, success and creativity take a hit. In a recent study, Yasin Rofcanin, a professor of management at the University of Bath in the UK, and a group of colleagues found that friendship between coworkers is the most crucial element for enhancing employee performance. The isolation takes perhaps the biggest toll on mental and emotional health. Feelings of isolation are deeply intertwined with stress and anxiety. Without other people to lean on, it can be much more difficult for colleagues to find the resiliency they need to face each workday.

The three most dangerous types of internal users to be aware of

Cautious users are willing to comply with new protocol changes, but just need some time to fully adjust. They may need more gentle encouragement than the typical user, as they take more of a “wait-and-see” approach to new cyber security changes. This may be due to fear that any changes could disrupt their workflow. This can pose a serious risk as vulnerabilities are more exposed during major changes to security. ... Traditionalist users are generally hostile to change and often do not trust IT help desks, thinking that the processes for asking for help are too time consuming. Because they do not engage with understanding how these new changes will directly impact their everyday workloads, some may either wait until the last minute before integrating the new security changes, or resist altogether. ... Like traditionalists, overachievers may ignore cyber training sessions, emails from IT, or avoid learning new authentication processes – seeing these as below their skill level. However, this group of users is often overlooked when an assessment is performed, as through their own experiences, they may feel that the resources within the organisation are not adequate.

Quote for the day:

"Increasingly, management's role is not to organize work, but to direct passion and purpose." -- Greg Satell

Daily Tech Digest - May 10, 2022

Tackling tech anxiety within the workforce

The average employee spends over two hours each day on work admin, manual paperwork, and unnecessary meetings. As a result, 81% of workers are unable to dedicate more than three hours of their day to creative, strategic tasks — the very work most ill-suited to machines. Fortunately, this is where digital collaboration comes in. When AI is set to automate certain processes, employees are freer to work on what they love, which often also happens to be what they do best. This extra time back then offers more opportunities to learn, create, and innovate on the job. Take Google’s ‘20% time’ rule, for instance. The policy involves Google employees spending a fifth of their week away from their usual, everyday responsibilities. Instead, they use the time to explore, work, and collaborate on exciting ideas that might not pay off immediately, or even at all, but could eventually reveal big business opportunities. It’s a win-win model for almost every business. At worst, colleagues enjoy the time to strengthen team bonds, improve problem-solving skills, and boost their morale. And at best, they uncover incredible ideas that can change the course of the company.

NFTs Emerge as the Next Enterprise Attack Vector

"The most common attacks try to trick cryptocurrency enthusiasts into handing over their wallet’s recovery phrase," he says. Users who fall for the scam often stand to lose access to their funds permanently, he says. "Bogus Airdrops, which are fake promotional giveaways, are also common and ask for recovery phrases or have the victim connect their wallets to malicious Airdrop sites, he adds, noting that many fake Airdrop sites are imitations of real NFT projects. And with so many small unverified projects around, it’s often hard to determine authenticity, he notes. Oded Vanunu, head of product vulnerability at Check Point Software, says what his company has observed by way of NFT-centric attacks is activity focused on exploiting weaknesses in NFT marketplaces and applications. "We need to understand that all NFT or crypto markets are using Web3 protocols," Vanunu says, referring to the emerging idea of a new Internet based on blockchain technology. Attackers are trying to figure out new ways to exploit vulnerabilities in applications connected to decentralized networks such as blockchain, he notes.

The OT security skills gap

Though often the responsibility for OT security is combined with the OT Infrastructure design role, in the OT world this is in my opinion less logical because it is the automation design engineer that has the wider overview of overall business functions in the system. If OT would be like IT, so primarily data manipulation, it makes sense to put the lead with OT infrastructure design. But because OT is not only data manipulation but also initiating various control actions that need to operate within a restricted operating window, it makes sense to give automation design this coordinating role. This is because automation design oversees all three skill elements and has more detailed knowledge of the production process than the OT infrastructure design role. It is very comparable to cyber security in a bank, where the lead role is linked to the overall business process and the infrastructure security is in a more supportive role. Finally, there is the process design role, what are the cyber security responsibilities for this role? First of all the process design role understands all the process deviations that can lead to trouble, and they know what that trouble is, they know how to handle it, and they have set criteria for limiting the risk that this trouble occurs.

Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself

The cybercriminal economy—a connected ecosystem of many players with different techniques, goals, and skillsets—is evolving. The industrialization of attacks has progressed from attackers using off-the-shelf tools, such as Cobalt Strike, to attackers being able to purchase access to networks and the payloads they deploy to them. This means that the impact of a successful ransomware and extortion attack remains the same regardless of the attacker’s skills. RaaS is an arrangement between an operator and an affiliate. The RaaS operator develops and maintains the tools to power the ransomware operations, including the builders that produce the ransomware payloads and payment portals for communicating with victims. The RaaS program may also include a leak site to share snippets of data exfiltrated from victims, allowing attackers to show that the exfiltration is real and try to extort payment. Many RaaS programs further incorporate a suite of extortion support offerings, including leak site hosting and integration into ransom notes, as well as decryption negotiation, payment pressure, and cryptocurrency transaction services

U.S. White House releases ambitious agenda to mitigate the risks of quantum computing

The first directive, the executive order, seeks to advance QIS by placing the National Quantum Initiative Advisory Committee, the federal government’s main independent expert advisory body for quantum information science and technology, under the authority of the White House. The National Quantum Initiative, established by a law known as the NQI Act, encompasses activities by executive departments and agencies (agencies) with membership on either the National Science and Technology Council (NSTC) Subcommittee on Quantum Information Science (SCQIS) or the NSTC Subcommittee on Economic and Security Implications of Quantum Science (ESIX).” ... The national security memorandum (NSM) plans to tackle the risks posed to encryption by quantum computing. It establishes a national policy to promote U.S. leadership in quantum computing and initiates collaboration among the federal government, industry, and academia as the nation begins migrating to new quantum-resistant cryptographic standards developed by the National Institute of Standards and Technology (NIST).

Industry pushes back against India's data security breach reporting requirements

India's Internet Freedom Foundation has offered an extensive criticism of the regulations, arguing that they were formulated and announced without consultation, lack a data breach reporting mechanism that would benefit end-users, and include data localization requirements that could prevent some cross-border data flows. The foundation also points out that the privacy implications of the rules – especially five-year retention of personal information – is a very significant requirement at a time when India's Draft Data Protection Bill has proven so controversial it has failed to reach a vote in Parliament, and debate about digital privacy in India is ongoing and fierce. Indian outlet Medianama has quoted infosec researcher Anand Venkatanarayanan, who claimed one way to report security incidents to CERT-In involves a non-interactive PDF that has to be printed out and filled in by hand. Venkatanarayanan also pointed out that the rules' requirement to report incidents as trivial as port scanning has not been explained – is it one PDF per IP address scanned, or can one report cover many IP addresses?

When—and how—to prepare for post-quantum cryptography

Consider data shelf life. Some data produced today—such as classified government data, personal health information, or trade secrets—will still be valuable when the first error-corrected quantum computers are expected to become available. For instance, a long-term life insurance contract may already be sensitive to future quantum threats because it could still be active when quantum computers become commercially available. Any long-term data transferred now on public channels will be at risk of interception and future decryption. Because regulations on PQC do not yet exist, the possibility of data transferred today being decrypted in the future does not yet pose a compliance risk. For the moment, far more significant are the future consequences for organizations, for their customers and suppliers, and for those relationships. However, regulatory considerations will also become relevant as the field develops, which could speed up the need for some organizations to act. Just as with data, some critical physical systems developed today ... will still be in use when the first fully error-corrected quantum computer is expected to come online.

Data centers on steel wheels: Can we trust the safety of the railway infrastructure?

If we compare railways with, for example, the banking sector then we see we have some catching up to do but given the fact that we are used to dealing with risks I am confident that this sector is fully able to develop the necessary mechanisms to stay resilient to these new emerging threats. Of course, we can fall victim to some kind of attack someday just like any other organization. It is up to us to be prepared and stay resilient; I am confident we can do that. ... Actually, any technique, tactic, or procedure (TTP) that can be used in other organizations as well. What we will see is, now that our sector is speeding up the digitization process, that the attack surface is broadening and becoming more complex. Trains will become Tesla’s on rails having many connections with other digital services such as the European Rail Traffic Management System (ERTMS) and driving via Automatic Train Automation (ATO). The obvious consequence is that we need to be able to withstand those TTP’s and plan for mitigation in our digital roadmaps. In the most ideal world, we develop our services cybersafe by design and default. There’s work to do there!

How data can improve your website’s accessibility

With an understanding of how data can inform accessibility, it’s time to apply that data towards accessibility improvements. This entails framing your tracked data in the context of Web Content Accessibility Guidelines (WCAG), which provides the latest standards for ensuring web accessibility. ... WCAG 2.1 focuses on five accessibility principles. These are perceivability, operability, understandability, robustness, and conformance. Your KPIs for accessibility should be tied to these features. For example, measure conformance through the number of criteria violations that occur through site testing. This and similar metrics will help you identify areas of improvement. ... Your approach to gathering accessibility data should not be limited to one tool or testing procedure. Instead, diversify your data to ensure quality. Both quantitative and qualitative metrics factor in, including user feedback, numbers of flagged issues, and insights from all kinds of tests and validation procedures. ... The gamut of usability considerations is broader than most testers can accommodate in one go.

Low Code: Satisfying Meal or Junk Food?

“If low code is treated as strictly an IT tool and excludes the line of business -- just like manual coding -- you seriously run the risk of just creating new technical debt, but with pictures this time,” says Rachel Brennan, vice president of Product Marketing at Bizagi, a low-code process automation provider. However, when no-code and low-code platforms are used as much by citizen developers as by software developers, whether it satisfies the hunger for more development stems from “how” it is used rather than by whom. But first, it's important to note the differences between low-code platforms for developers and those for citizen developers. Low code for the masses usually means visual tools and simple frameworks that mask the complex coded operations that lie beneath. Typically, these tools can only realistically be used for fairly simple applications. “Low-code tools for developers offer tooling, frameworks, and drag-and drop options but ALSO include the option to code when the developer wants to customize the application -- for example, to develop APIs, or to integrate the application with other systems, or to customize front end interfaces,” explains Miguel Valdes Faura

Quote for the day:

"One machine can do the work of fifty ordinary men. No machine can do the work of one extraordinary man." -- Elbert Hubbard

Daily Tech Digest - May 09, 2022

Does low code make applications overly complex?

To be clear, the inevitable outcome of low code is not necessarily complexity. Just like traditional application development, complexity can and often does make its way into the lifecycle of the product code base. While not inevitable, it is common. There are many steps you can take to reduce complexity in apps regardless of how they are built, which improves performance, scalability, availability, and speed of innovation. Yes, a low code application, like all applications, can become complex, and requires the use of simplification techniques to reduce complexity. But these issues are not tied to the use of low code. They are just as significant in regular product development processes. What low code does increase is the amount of code in your application that was not written directly by your development team. There is more code that was auto-generated by the low code platform, or included in libraries required for your application to function, but was not the product of your developers. Thus there is often more “unknown” code in your application when you use low code techniques. But unknown is not the same thing as complexity.

Ultra-fast Microservices: When Microstream Meets Wildfly

Microservices provide several challenges to software engineers, especially as a first step to facing distributed systems. But it does not mean that we're alone. Indeed there are several tools to make our life easier in the Java world, especially MicroProfile. MicroProfile has a goal to optimize enterprise Java for a microservices architecture. It is based on the Java EE/Jakarta EE standard plus API specifically for microservices such as a REST Client, Configuration, Open API, etc. Wildfly is a powerful, modular, and lightweight application server that helps you build amazing applications. ... Unfortunately, we don't have enough articles that talk about it. We should have a model, even the schemaless databases, when you have more uncertain information about the business. Still, the persistence layer has more issues, mainly because it is harder to change. One of the secrets to making a scalable application is statelessness, but we cannot afford it in the persistence layer. Primarily, the database aims to keep the information and its state.

CPaaS – a technology for the future

What has made CPaaS the go-to method for customer engagement is the ubiquity of cloud technology and how it has transformed the way businesses operate. “Companies had to come up with different ways to interact with customers,” says IDC research VP Courtney Munroe, who points out that in the last few years there has been a steady move to cloud and, in particular, there has been a confluence of mobility and cloud. “More people use smartphones and companies realised that they could develop apps for them,” he says. Steve Forcum, chief evangelist at Avaya, is also aware of the importance of cloud within enterprises looking to engage with customers. “Some customers may keep elements of their communications stack in their datacentres, but more are then infusing cloud-based capabilities,” he says. “We’ve moved to help customers across this spectrum by bringing cloud-based benefits to their datacentres.” But the technology on its own is in second place to the need that companies have to be more responsive to customers. The underlying drive towards CPaaS is the need to offer a more flexible way to interact with customers.

How Should you Protect your Machine Learning Models and IP?

The most concerning threat is frequently “Will releasing this make it easy for my main competitor to copy this new feature and hurt our differentiation in the market?”. If you haven’t spent time personally engineering ML features, you might think that releasing a model file, for example as part of a phone app, would make this easy, especially if it’s in a common format like a TensorFlow Lite flatbuffer. In practice, I recommend thinking about these model files like the binary executables that contain your application code. By releasing it you are making it possible to inspect the final result of your product engineering process, but trying to do anything useful with it is usually like trying to turn a hamburger back into a cow. Just as with executables you can disassemble them to get the overall structure, by loading them into a tool like Netron. You may be able to learn something about the model architecture, but just like disassembling machine code it won’t actually give you a lot of help reproducing the results. Knowing the model architecture is mildly useful, but most architectures are well known in the field anyway, and only differ from each other incrementally.

The new cybersecurity mandate

Bearing security in mind at all times rings true, as it inspires us to think about what the security implications are as we are making changes. On the other hand, it has something of a resemblance to the old premature performance optimization debate. We’re not going to wade into that here (or the test-driven development debate, or any other similar one). I just want to point out that software development is latent with complexity and obstacles to action. Security considerations must be harmonized into the equation. The next bullet point in the fact sheet makes the following statement: “Develop software only on a system that is highly secure and accessible only to those actually working on a particular project.” This one makes the reader pause for a moment. It seems to have arrived at the conclusion that in order to build secure systems, we should build secure systems. If we are patient, the next sentence helps deliver the full meaning: “This will make it much harder for an intruder to jump from system to system and compromise a product or steal your intellectual property.” What the framers of this fact sheet are driving at here is actually something like a rephrasing of zero trust architecture.

US Passes Law Requiring Better Cybercrime Data Collection

The impact of this legislation depends entirely on the usefulness of the taxonomy itself, says Jennifer Fernick, senior vice president and global head of research at security consultancy NCC Group. "The authors of that taxonomy need to meaningfully answer what data points about cybercrime will enable meaningful intervention for the future prevention of these crimes," Fernick, who is also a National Security Institute visiting technologist fellow at George Mason University, tells Information Security Media Group. "It is important, for example, to distinguish at minimum between computer-related crimes that attack human judgment or exploit edge cases in business processes from crime that is enabled through specific hardware or software flaws that can be exploited by criminals attacking an organization's IT infrastructure. In the latter case, it would be valuable in particular to identify the specific software or hardware components, or even specific security vulnerabilities or CVEs, which served as the substrate for the attack, to help inform organizations about where they would most benefit from strengthening their cybersecurity defenses," Fernick says.

How smart data capture is innovating the air travel experience

Using smart data capture on mobile devices has multiple benefits. Unlike fixed scanners, it enables customer service agents to perform multiple tasks anywhere in the airport. Airlines can automate processes such as check-in, security queues, lounge access, and luggage management, providing a modern, sleek impression from the first moment a passenger enters the terminal. Compared with the old approach of using rugged devices at fixed stations, smart data capture on mobile devices delivers significant customer benefits and staff efficiencies. Airport queues have been big news recently, but with staff equipped with smart mobile devices, waiting times can be cut as they can patrol queues and scan IDs, passports and QR codes to speed passengers through check-in and deliver a more personalised experience — accessing details about a passenger’s seat preferences or dietary requirements, for example. Customer service agents using smart mobile devices can easily manage oversized luggage presented at the gate and quickly check it into the hold.

Are Blockchain and Decentralized Cloud Making Much Headway?

Basically, the value of decentralized cloud in its current form boils down to the circumstances and needs of the users. “If you’re setting up a mining node and need some cloud power, why would you want to pay AWS?” Litan asks. A decentralized cloud might be cheaper to run in such cases, she says, which appeals to miners who want cheap computing in order to make money on the margins. At the moment, when many developers write applications, they look to the most readily available cloud service, Litan says, and then wind up deploying on the main blockchain where there is no control over where Ethereum or Bitcoin run. “It’s like saying, ‘Where’s the internet running?’” There is some possibility for blockchain and decentralized cloud to gain more momentum down the road, but for now their impact on the entirety of cloud computing remains rather niche. “It may become more important as people start writing compute-intensive workloads and they want to keep the cost down,” Litan says. Decentralized cloud computing may also be useful for organizations running non-blockchain applications, she says.

IT hiring: Assumptions and truths about the current talent shortage

It can be difficult to drive growth when teams are stretched and global tensions are high, as they have been for the better part of two years. New process adoption can meet resistance from employees who are already overwhelmed. If and when this happens, a stalemate often follows, and team leaders opt to wait it out, deferring change to another team or another time. ... The pandemic challenged us all to rethink the way we work. Investments in software took the place of physical office space, and teams were pushed to automate repeatable tasks to maintain a pre-pandemic level of efficiency. With the implementation of artificial intelligence and machine learning, workflow improvements can be expedited, lessening the need for as many employees. Technologies like low-code and no-code are easing the burden felt by developers by enabling employees outside of IT to build systems unique to their needs without the slowdown created by a backlog of IT tickets. In turn, this frees the bandwidth for developers to turn toward other pressing concerns like security.

Is it time to fire yourself?

This idea was brought to life when I interviewed Bracken Darrell, the CEO of Logitech International, a computer peripherals manufacturer headquartered in Switzerland and the US. In that conversation, he shared with me the story of how, about five years into his tenure at the company, he asked himself one Sunday night, “Am I the right person for the next five years? On paper, he certainly was, he told me, given that all his changes at the company had lifted the stock about 500%. “On the other hand, I had been involved in every single personnel and strategic decision,” he said. “My disadvantage was that I knew too much, and that I was too embedded in everything we were doing. I just thought to myself that I might be done.” So he decided that night that he was going to fire himself, but he would sleep on the decision. The punchline is that he didn’t fire himself, but he did wake up the next morning with a sense of clarity of what he needed to do: “I have to rehire myself but have no sacred cows. It was super exciting and fun, and I started changing things that I had put in place. Fortunately, I didn’t have to change things radically, but I felt new again.”

Quote for the day:

"Risks are the seeds from which successes grow." -- Gordon Tredgold

Daily Tech Digest - May 08, 2022

Your mechanical keyboard isn't just annoying, it's also a security risk

If this has set you on edge then I have both good and bad news for you. The good news is that while this is fairly creepy, it's unlikely that hackers will be able to break into your private space and place a microphone in close enough proximity to your keyboard without you noticing. The bad news is that there are plenty of other ways that your keyboard could be giving away your private information. Keystroke capturing dongles exist that can be plugged into a keyboard’s USB cable, and wireless keyboards can be exploited using hardware such as KeySweeper, a device that can record keyboards using the 2.4GHz frequency when placed in the same room. There are even complex systems that use lasers to detect vibrations or fluctuations in powerlines to record what's being written on a nearby keyboard. Still, if you're a fan of mechanical keyboards then don't let any of this deter you, especially if you use one at home rather than in a public office environment. It's highly unlikely that you need to take extreme measures in your own home and just about everything comes with a security risk these days.

Relational knowledge graphs will transform business

"There have been many generations of algorithms built that have all been created around the idea of a binary one," said Muglia. "They have two tables with the key to join the two together, and then you get a result set, and the query optimizer takes and optimizes the order of those joins — binary join, binary join, binary join!" The recursive problems such as Fred Jones's permissions, he said, "cannot be efficiently solved with those algorithms, period." The right structure for business relationships, as distinct from data relationships, said Muglia, is a knowledge graph. "What is a knowledge graph?" asked Muglia, rhetorically. He offered his own definition for what can be a sometimes mysterious concept. "A knowledge graph is a database that models business concepts, the relationships between them, and the associated business rules and constraints." Muglia, now a board member for startup Relational AI, told the audience that the future of business applications will be knowledge graphs built on top of data analytics, but with the twist that they will use the relational calculus going all the way back to relational database pioneer E.F. Codd.

We Need to Talk about the Software Engineer Grind Culture

SWE culture can be very toxic. Generally, I found that people who get rewarded within software engineering are those who sacrifice their personal time for their project/job. We reward people who code an entire project in 24 hours (I mean, just think about the popularity of hackathons). I remember watching a TikTok from a tech creator and he said that US software engineers are paid so much not because of what they do during work hours, but because of all of the extra work they do outside of it. Ask yourself: are you paid enough to sacrifice your life outside of work? So many of us are conditioned to this rat race. I realized that this grind has caused me to lose out on any hobbies outside of coding. There are so many software engineers who are also tech creators on the side. Whether they have a twitch channel dedicated to coding, making Youtube videos about coding, or a tech content creator on TikTok, it usually has something to do with this specialization in software engineering. The reason these channels are so successful is because we, as software engineers, have bought into this narrative.

Managing Tech Debt in a Microservice Architecture

This company has a lot of dedicated and smart engineers, which most probably explains how they were able to come up with what they call the technology capability plan. I find the TCP to be a truly innovative community approach to managing tech debt. I've not seen anything like it anywhere else. That's why I'm excited about it and want to share what we have learned with you. Here is the stated purpose of the TCP. It is used by and for engineering to signal intent to both engineering and product, by collecting, organizing, and communicating the ever-changing requirements in the technology landscape for the purposes of architecting for longevity and adaptivity. In the next four slides of this presentation, I will show you how to foster the engineering communities that create the TCP. You will learn how to motivate those communities to craft domain specific plans for paying down tech debt. We will cover the specific format and purpose of these plans. We will then focus on how to calculate the risk for each area of tech debt, and use that for setting plan priorities.

Shedding Light On Toil: Ways Engineers Can Reduce Toil

More proactive monitoring is another way to reduce toil, according to Englund and Davis. “Responding to a crash loop is responding too late,” added Davis. Instead, he advocated that SREs look toward leading indicators that suggest the potential for failure so that teams can make adjustments well before anything drastic occurs. If SLIs like error rate and latency are getting bad, you must take reactive measures to fix them, causing more toil. Instead, proactive monitoring is best to see the cresting wave before the flood. Leading indicators could arise from following things like data queue operations connected to servers or the saturation of a particular resource. “If you can figure out when you’re about to fail, you can be prepared to adapt,” said Davis. One major caveat of standardization is that you’re inevitably going to encounter edge cases that require flexibility. And when an outage or issue does arise, the remediation process is often very unique from case to case. As a result, not all investment into standardization pays out. Alternatively, teams that know how to improvise together are proven to be better equipped for unforeseen incidents

Are your SLOs realistic? How to analyze your risks like an SRE

You can reduce the impact on your users by reducing the percentage of infrastructure or users affected or the requests (e.g., throttling part of the requests vs. all of them). In order to reduce the blast radius of outages, avoid global changes and adopt advanced deployments strategies that allow you to gradually deploy changes. Consider progressive and canary rollouts over the course of hours, days, or weeks, which allow you to reduce the risk and to identify an issue before all your users are affected. Further, having robust Continuous Integration and Continuous Delivery (CI/CD) pipelines allows you to deploy and roll back with confidence and reduce customer impact. Creating an integrated process of code review and testing will help you find the issues early on before users are affected. Improving the time to detect means that you catch outages faster. As a reminder, having an estimated TTD expresses how long until a human being is informed of the problem.

5 Ways to Drive Mature SRE Practices

Project failure — and the way it’s regarded within the organization — is often as important as success. To create maximum value, SREs must be free to experiment and work on strategic projects that push the boundaries, understanding they will fail as often as they succeed. However, according to the “State of SRE Report,” only a quarter of organizations accept the “fail fast, fail often” mantra. To mature their practice, enterprises must free SREs from the traditional cost constraints placed upon IT and encourage them to challenge accepted norms. They should be setting new benchmarks for innovative design and engineering practices, not be bogged down in the minutiae of development cycles. Running hackathons and bonus schemes focused on reliability improvements is a great way to uplevel SREs and encourage an organizational culture of learning and experimentation, where failure is valued as much as success. Measurement is critical to developing any IT program, and SRE is no exception. To truly understand where performance gaps are and optimize critical user journeys, SREs need to go beyond performance monitoring data.

The Future of Data Management: It’s Already Here

Data fabric can automatically detect data abnormalities and take appropriate steps to correct them, reducing losses and improving regulatory compliance. A data fabric enables organizations to define governance norms and controls, improve risk management, and improve monitoring—something that is increasing in importance given legal standards for data governance and risk management have become more demanding and compliance/governance vital. It also enhances cost savings through the avoidance of potential regulatory penalties. A data fabric represents a fundamentally different way of connecting data. Those who have adopted one now understand that they can do many things differently, providing an excellent route for enterprises to reconsider a host of issues. Because data fabrics span the entire range of data work, they address the needs of all constituents: developers, business analysts, data scientists, and IT team members collectively. As a result, POCs will continue to grow across departments and divisions.

Why Data Catalogs Are the Standard for Data Intelligence

Gartner positions a data catalog as the foundation “to access and represent all metadata types in a connected knowledge graph.” To illustrate, I’ll share a personal experience about why I think a data catalog is crucial to data intelligence. Some years ago, when I worked at a large global technology company, my manager said, “I want you to figure out what metrics we should measure and tell us if our product is making our customers successful. We don’t have the data or analysis today.” I was surprised. How could that be? How can a successful enterprise not have the data model in place to measure a market-leading product? Have they based their decisions on gut instinct? As part of my work, I had to create some hypotheses, gather data, analyze it, and create a recommendation. To start, I had to find an expert who had a significant amount of tribal knowledge and could explain what data existed, where it was located, what it meant, how I should use it, and what pitfalls I might encounter when using it. Next, I had to get the data from the data warehouse and write a lot of SQL queries, all while finding the data science people to get their help.

An enterprise architecture approach to ESG

Often, and especially when looked at through a holistic enterprise architecture approach, achieving or reporting on certain ESG goals (or seizing on innovative new opportunities that ESG brings about) will not be possible through isolated tech changes, but in fact, require a more holistic digital transformation. An EA-supported ESG assessment will give an accurate view of the costs and benefits of an organisation's overall IT portfolio. Architecture lenses will then help to make the decisions necessary for ESG-related digital investment and/or transformation. For example, the high energy footprint of business IT systems is becoming an increasing focus of ESG concern.6,7 As a consequence, organisations are feeling significant pressure to move to ‘clean-IT,' optimising the trade-off between energy consumption and computational performance, and incorporating algorithmic and computational efficiencies in IT solutions and designs. Meeting ESG future states will likely require digitalisation and emerging technologies such as IoT, digital twins, big data, and AI.

Quote for the day:

"At the heart of great leadership is a curious mind, heart, and spirit." -- Chip Conley

Daily Tech Digest - May 07, 2022

The term 'digital transformation' needs a makeover: What would you rename it?

“New Ways of Working (NWoW) is our term. Of course, New Ways of Working requires quite a few catalysts in the form of culture and technology. "Culture: Retool your leadership in new ways of leading before you demand your organization be agile. Agile teams are empowered, cross-functional, and have the ability to move quickly and test and learn. The role of the leader is not to tell teams what to do but to create a fertile environment to innovate. The role of the leader is to create the outcomes and eliminate barriers. Train your leaders in these new ways of leading before you send your teams off to be agile. "Technology: Focus on agile infrastructure and data before you demand an agile work environment. Creating agile teams that are cross-functional and empowered is a good step. But this only works if you have embarked on your technical transformation and created the highways to safely and continuously deploy software. The combination of culture, technology, and agility is creating NWoW." -John Marcante, Retired CIO, Vanguard

How Weak Analogies About Software Can Lead Us Astray

Software development/design teams are simultaneously understanding problems while solving them. The team makes dozens of choices every day, ideally informed by business objectives and user testing and applied architecture and data cleanliness. ... Likewise, UX design frameworks are usually interpreted by team-level designers to fit the problem at hand. We’re constantly trading off consistent look and feel across the application suite against what will help users at this step. So in the software business, we’re usually solving and designing and implementing and fixing all at the same time. The hard part isn’t the typing, it’s the thinking. ... So hiring junior developers or offshoring to lower the average engineering rate misses what’s most important. Crafting better software should get us more customers and make us more money. Small teams of empowered developers/designers/product managers with deep understanding of real customer problems will out-earn large teams doing contextless color-by-number implementation of specs. The intrinsic quality of the work matters, which is lost in a command-and-control organization.

The key skills needed to build diversity, equality, inclusion and belonging in the workplace

It’s up to executives to treat DEIB as a central business function, instituting and scaling their efforts. Degreed CEO Dan Levin, for example, describes it as a strategic imperative to integrate DEIB into all aspects of how we operate as a business, including at board level. ... Managers need to take big picture initiatives from the C-suite and use them to allocate work and opportunities in new ways. Those adept at these skills help their staff resolve conflicts and open their minds to new ideas. ... Two skills are especially important for both senior leaders and managers, study authors Stacia Garr and Priyanka Mehrotra write in the report. Respondents at higher-ranked companies for DEIB were more likely to say that people in both positions should excel at challenging the status quo and persuasion. I’ve seen leaders and managers faced with the task of convincing those under them to reconsider how their behaviors or words might make someone else feel excluded. Those who excel at these types of challenges have the skills to do so.

How Big Companies Kill Ideas - And How To Fight Back

Google said all the right things. Then over time — after like the first six months — it became like the Tinder Swindler. I was like, “What happened? Where is all this great stuff you said we were going to have?” It went out the window. Over time we were just one toy in the toy box. When you are bought for $3.2 billion, you would think people would actually respect and invest in the team as a new area of Google’s business. That is not how it worked. Apple is a whole different story, at least when Steve [Jobs] was there. It was respected when you did stuff. People took note and tried to make successes. It was my mistake. I did not realize that Google had gone through many of those billion-dollar acquisitions and just let them flail. They just said, “Oh, that was a fun ride. Moving on.” There was no existential crisis because you always had the ad money tree from search. Then it was just a matter of cutting their losses, as opposed to seeing that these are real people with families, trying to do right on the mission to build this thing. They just saw it more as dollars, at least from the finance side.

Maintaining a Security Mindset for the Cloud Is Crucial

When you look at networking and security, that really hasn’t kept up with the pace of the application transitions to the cloud. And if you look at what happens today, is many of these networks — and network and security elements in those networks — they are do-it-yourself. And the idea that the organizations are migrating, [that] we would be migrating from this do-it-yourself approach to as-a-service approach really allows the organizations to unleash the agility and the simplification that their organizations and enterprises are looking for. Now we have a lot of examples. Even in very recent times where these do-it-yourself approaches have failed to address the needs of the organizations, and one of the most prominent examples in the recent past is a variety of ransomware attacks. We all know that these ransomware attacks have been in the headlines in the recent news. Think about the reasons for these ransomware attacks. There could be many reasons. But one reason that I can think about is that the organizations that are hit by these ransomware attacks, and again, it’s not always black and white

The design of a data governance system

A data governance system should restore control of data to the consumers and businesses generating it, according to this BIS Paper. Technological developments over the last two decades have led to an explosion in the availability of data and their processing. Consumers often do not know the benefits of the data they generate, and find it difficult to assert their rights regarding the collection, processing and sharing of their data. We propose a data governance system that restores control to the parties generating the data, by requiring consent prior to their use by service providers. The system should be open, with consent that is revocable, granular, auditable, and with notice in a secure environment. Conditions also include purpose and use limitation, data minimisation, and retention restriction. Trust in the system and widespread adoption are enhanced by mandating specialised data fiduciaries. The experience with India's Data Empowerment Protection Architecture (DEPA) suggests that such a system can operate at scale with low transaction costs.

Embracing culture change on the path to digital transformation

We did realize that if we didn't get the culture embedded that we would not be successful. So building that capability and building the culture was number one on the list. It was five years ago. It feels like a very long time ago to me. But we started that process and through the cloud guild we trained 7,000 people in cloud and 2,700 of those today are industry certified and working in our teams. So we've made really good progress. We've actually moved a lot of the original teams that were a bit hesitant, a bit concerned about having to move to this whole new way of working. And remember that our original teams didn't have a lot of tech skills, so to tell them that they were going to have to take on all of this technical accountability, an operational task that had previously been handed to our outsourcers, was daunting. And the only way we were going to overcome that was to build confidence. And we built confidence through education, through a lot of cultural work, a lot of explaining the strategy, a lot of explaining to people what good looked like in 2020, and how we were going to get to that place.

6 blockchain use cases for cybersecurity

Blockchain technology digitizes and distributes record-keeping across a network, so transaction verification processes no longer rely on a single central institution. Blockchains are always distributed but vary widely in permissions, sizes, roles, transparency, types of participants and how transactions are processed. A decentralized structure offers inherent security benefits because it eliminates the single point of failure. Blockchains are also composed of several built-in security qualities, such as cryptography, public and private keys, software-mediated consensus, contracts and identity controls. These built-in qualities offer data protection and integrity by verifying access, authenticating transaction records, proving traceability and maintaining privacy. These configurations enhance blockchain's position in the confidentiality, integrity and availability triad by offering improved resilience, transparency and encryption. Blockchains, however, are designed and built by people, which means they're subject to human error, bias or exposure based on use case, subversion and malicious attacks.

Secrets to building a healthy CISO-vendor partnership

Any partnership is a two-way street, so as well as knowing what they are looking for themselves, it’s also important for CISOs to understand what a security vendor needs from them in return. “To build a strong relationship and deliver the best experience possible, we need our customers to be open and honest with us,” Rech says. “This honesty should extend to being clear on which other vendors are in the mix as they’re increasingly relying on flexible, cloud-native, open solutions.” The reality is that no one vendor can guarantee protection against every threat, Rech adds, but vendors are uniquely positioned to adapt to a business’s needs when they have full clarity of what those needs are. For example, constantly sharing information on threat groups, attack techniques or sector-specific threat trends can be overwhelming for some CISOs. “When we know more about their business and their priorities, we can direct the most relevant, need-to-know information to them.” Hellickson thinks vendors also benefit from reasonable, respectful feedback during a sales process that can become somewhat frustrating for CISOs.

Top 10 business needs driving IT spending today

“Cybersecurity [spend] has always been growing, but it has transformed from perimeter security that we’ve been used to for 40 years to more and more securing cloud and remote work and remote employees,” says John Lovelock, research vice president and distinguished analyst at Garner. “Companies that used to be able to put the virtual brick walls around the building and say they’re secure on the inside now have too many openings — to the cloud, partners, customers, employees — for that strategy to be viable.” ... Other big business needs driving IT spending increases — such as boosting efficiency, customer experience, employee productivity, and profitability — also say something about where organizations are in 2022, experts say. “You have an enhanced discipline about cost management now and being smart about where you spend your tech dollars,” Priest says, adding that “it’s one of the best places to invest, especially in inflationary periods.” He says organizations are looking to automate, streamline operations, and reduce costs to help deal with an unsettled labor market, worker shortages, inflation, and geopolitical uncertainty.

Quote for the day:

"When we lead from the heart, we don't need to work on being authentic we just are!" -- Gordon Tredgold