Daily Tech Digest - September 26, 2022

What is the role of the data manager?

The data manager role is not just about being “good with data”. It involves a combination of technical and interpersonal skills, says Andy Bell, vice president global data product management at data integrity specialist Precisely. As well as technical skills, he says data managers need to have “a thorough understanding about the application of technology”. In addition, they need to understand “how data is moved, managed and processed across organisations, what capabilities it does and doesn’t provide, and how data science teams can use information in the best way possible”. At the same time, data managers must be good critical thinkers, according to Bell. “They need to keep up to date with wider technology industry trends, as well as how legislation and data privacy regulations impact tools – which may need to be adapted to ensure they are compliant.” Good communication skills are essential for data managers because the role requires explaining complex concepts in a simple way. “Increasingly, data managers are involved in influencing the company in how they should be using and managing data, which involves great communication skills as well as commercial awareness,” Bell adds.


3 ways to gauge your company’s preparedness to recover from data loss

Where you store your data backup is nearly as important as creating copies in the first place. Storing your data in the cloud does not mean it is secure. Cloud services follow the cloud shared responsibility model, where the service holds and maintains your data, but your IT staff is primarily responsible for protecting it. ... Just because your data is backed up does not mean it can be recovered — without a restoration strategy, you may still lose data. Companies need a step-by-step plan to salvage their data if it is compromised. If you decide to pay an attacker, you cannot count on a clean exchange. ... Write down your recovery plan step by step, including who is responsible for each task. Run through regular simulation tests with teams and stakeholders involved in the process to ensure it works. And much like a football coach reworks plays based on changing conditions, you must make adjustments as business and technological circumstances evolve. Set a schedule to periodically review and update the strategy.


Data Management in Complex Systems

Concerns such as data privacy and provenance are far more important, like being able to audit and analyze who accesses a particular data item and why it can be a hard requirement in many fields. The notion of one bucket in which all the information in the organization resides is no longer viable. Another important sea change was common architectural patterns. Instead of a single monolithic system to manage everything in the organization, we now break apart our systems into much smaller components. Those components have different needs and requirements, are released on different schedules, and use different technologies. The sheer overhead of trying to coordinate between all of those teams when you need to make a change is a big barrier when you want to make changes in your system. The cost of coordination across so many teams and components is simply too high. Instead of using a single shared database, the concept of independent application databases is commonly used. This is an important piece of a larger architectural concept.


Google wants to help Singapore firms tap data, AI responsibly

With organisations worldwide digitally transforming their business, including those in Singapore and Malaysia, the US cloud vendor is keen to figure out how its technology and infrastructure can facilitate their efforts. Data, specifically, will prove critical in enabling companies to tap new opportunities in a digital economy, said Google Cloud's Singapore and Malaysia country director, Sherie Ng, in an interview with ZDNET. She said businesses would need to figure out how to leverage data to better understand and serve customers as well as to reduce inefficiencies and improve work processes. The ability to generate insights from the right data also would be essential for companies to not only birth new businesses and products and services, but also identify ways to measure and reduce their energy consumption and costs, Ng said. This meant building digital infrastructures that were global in scale and able to support real-time access to data, she noted. She added that organisations in some markets such as Singapore now were looking to gain more value from their cloud adoption as they moved up the model.


Google Engineer Outlines What’s Next for Angular

“Now we enter into phase three, which is the fruits of our hard work,” Twersky said. “This phase has yet to happen, frankly. Version 15 is scheduled for November, so this is very speculative and early preview. But the idea here is […] everything that we unlocked.” Version 15 will see support for full standalones and support for that, she said. “We have something that will benefit everyone, which is zone JS-enabled async stack taking by default, but we’re just calling it better stack traces,” she said. This is through another collaboration with Chrome and will make it easier to pare down to what’s relevant even when using open source code a developer didn’t write and where errors occur. Version 15 also promises to make the router tree shakable, which basically removes unused code from the code base. In writing a standalone version of the router, the team was able to integrate a lot of things about the router module that are no longer needed, making it more tree shakable, she said. The new config API allows developers to tree shake major pieces of the router API, she said.


Which cloud is for you?

Google Cloud, Lakshmanan goes on, “is about ease of use—a few robust products that integrate robustly for the most popular needs across all scales.” This is great so long as you stick with Google’s opinionated approach. If not, be warned. “If you are building something offbeat, it will be frustrating,” says engineer Clint Byrum: “GCP is neat and orderly, pretty much one way to solve any problem, which means it is great for 90% of problems and pretty frustrating for the 10%.” For all these reasons and despite those issues, Lakshmanan concludes, “Software developers [and] data scientists love it.” ... Ant Stanley, who has used all three cloud providers in his consulting practice, finds much to like about each but hints that Azure is perhaps the one that adheres most doggedly to its Windows past. This can be a criticism, but it’s also a source of strength. Microsoft has spent decades making IT folks very happy. If Azure is a way of continuing that trend, it’s hard to suggest this is bad strategy or bad technology. Matt Gillard, who also consults using the different clouds, notes that Azure is very focused on enterprises and government, both of which run lots of Windows.


Data Management Models for the Cloud

When the organization knows what or who is driving cloud cost, it can collaborate with those consumers on usage, optimization, and governance policies that ensure business value is being derived from cloud workloads. Karl Martin, chief technology officer at integrate.ai, adds a key step is to understand and plan for the intended ways in which value is to be extracted from the data assets before implementing a new data management scheme. “Historically, investments into general-purpose data management tooling, such as data lakes, were made without a full understanding of how value was to be extracted,” he says. The strategy often assumed that it would be “figured out later”, which has produced disappointing results for organizations where there is a struggle to map a potential wealth of data assets to business problems. “In some cases, the data management systems do not contemplate the demands of modern machine learning systems that would be a center of creative experimentation for data scientists and owners of lines of business,” Martin explains.


Retaining IT talent: 5 tips for better training opportunities

While it’s good to foster growth opportunities, the real benefit comes when you enable employees to have ownership over these practices. Consider a community of practice (CoP); this is an excellent avenue for people to interact, learn, collaborate, and even devise organizational improvements. Traditionally, employees need executive sponsorship to form a CoP, but try to stay out of the process until the finish line. Empower staff to create CoP proposals independently and then sponsor when you can. Employees will likely create communities around various role-relevant topics like test automation, continuous delivery, and DevOps. However, even something as simple as a book club can be a great source of skill development. Allowing staff members to spearhead clubs, initiatives, or training opportunities relevant to them means that they’ll feel more ownership over the learning process – and that those lessons are more likely to stick. It’s counterproductive to give staff the option of creating a CoP without giving them the resources they need for the group to succeed.


Data privacy audit checklist – how to compile one

When conducting a privacy audit, it’s important to identify the data you have, where it is stored and what you use it for. “Once you know what data you have, you need to establish where you got it from,” says Nigel Jones, co-founder, Privacy Compliance Hub. “Then you can work out what rights you have in relation to it; what you do with it; where you keep it; how long you keep it; and what happens when you no longer need it.” This basic inventory will form the basis of the rest of your audit as well as your Record of Processing Activities (ROPA), he says. But there is no point keeping data safe within your own organisation if you then share it with others who do not respect it, Jones points out. “Make sure you have a list of all organisations you share information with; have agreements in place with all of them; and be ready to demonstrate why you think they are safe to process data.” GDPR compliance requires that data is only used for the purpose it was collected for, so you’ll need to prove your business has committed to this principle, says Jamie Akhtar, CEO and co-founder of CyberSmart.


DevOps at Schneider: a Meaningful Journey of Engaging People into Change

Bottom line - telling your story, no matter how bad it may look or sound, but really pulling back the covers and putting the raw data out there can be uncomfortable, but is absolutely necessary to ignite your case for change. Spend time making your case for change less formal and more meaningful and something people can easily relate to. The best way to do this is by scrapping all those stiff templates, and crafting your case for change like you are writing a story and marketing it like you are making the sale of your life! Some fun ways to do this include using short motion graphic animations vs. boring emails or one-page PowerPoints, scheduling informal town hall meetings to collect feedback and get input on what you are trying to do (or sell), and anonymous surveys for those who are uncomfortable providing feedback in a more formal way. The options are endless, but think outside the box and make it fun. ... DevOps and Scope Creep are synonymous - Always come back to the "why" of your DevOps transformation and use your goals and objectives as your true north to validate your progress as you get started.



Quote for the day:

"No great manager or leader ever fell from heaven, its learned not inherited." -- Tom Northup

Daily Tech Digest - September 24, 2022

Tackling Developer Onboarding Complexity

A common thread in onboarding, and more broadly on reducing developer cognitive load, is the concept of “golden paths” or “paved paths.” Ultimately, the idea is to reduce complexity and get to the bare bones of what needs to be learned or done to increase developer velocity and safety. Mostly, once the cultural aspects of onboarding are covered, this comes back to the “golden path” platform created for developers, which includes the tools and processes that are proven to work but aren’t handcuffs. Once a developer knows how to walk, for example, platforms should be flexible enough to let them run. Humanitec’s CEO, Kaspar von Grünberg, said, “Perhaps more important than fancy golden paths is to agree on the lowest common tech denominator to empower developers to work faster. Why run ultra-complex things if there is an alternative? It is like taking a tractor to do your grocery shopping, which is not productive. If you scatter things all over the place, you are not getting the effects of scale, and the tools you bring in are not delivering ROI. This is why I advocate for the value of standardization. Standardization forms the lowest common tech denominators, clearing the way for individual freedom where needed.”


How devops in the cloud breaks down

First is the obvious issue: talent. To do devops in the cloud, you need devops engineers who understand how to build and use toolchains. More important, you need engineers who know how to build toolchains using cloud-based tools. Some (but not many) people out there have these skills. I see many companies fail to find them and even pull back devops to traditional platforms just so they can staff up. Sadly, that’s not a bad strategy right now. Second, the cloud rarely has all the tools you’ll need for most devops toolchains. Although we have a tremendous number of devops tools, either sold by the public cloud providers or by key partners that sell devops cloud services, about 10% to 20% of the tools you’ll need don’t exist on your public cloud platform. You will have to incorporate another provider’s platform, which then leads to multicloud complexity. Of course, the need for those absent tools depends on the type of application you’re building. This shortage is not as much of a problem as it once was because devops tool providers saw the cloud computing writing on the wall and quickly filled in the tool shortages. 


Tesla is set to introduce its prime 'Optimus' robot

"Autopilot/AI team is also working on Optimus and (actually smart) summon/autopark, which have end of month deadlines," Musk wrote while responding to a Tesla fan club account on Twitter. Musk's Texas-based company is reportedly considering ambitious plans to use thousands of humanoid robots within its factories before eventually extending to millions globally, per a job posting. According to Musk, who is now promoting a vision for the company that extends far beyond producing self-driving electric cars, the robot industry may eventually be worth more than Tesla's automobile income. A source familiar with the situation claimed that as Tesla holds more internal discussions on robotics, the buzz is growing within the organization. ... For Tesla to be successful, it will have to display robots performing various spontaneous acts. Such evidence might help Tesla stock, which is currently down 25 percent from its 2021 peak, according to Nancy Cooke, a professor of human systems engineering at Arizona State University.


Researchers Say It'll Be Impossible to Control a Super-Intelligent AI

Rules such as 'cause no harm to humans' can't be set if we don't understand the kind of scenarios that an AI is going to come up with, suggest the authors of the new paper. Once a computer system is working on a level above the scope of our programmers, we can no longer set limits. "A super-intelligence poses a fundamentally different problem than those typically studied under the banner of 'robot ethics'," wrote the researchers. "This is because a superintelligence is multi-faceted, and therefore potentially capable of mobilizing a diversity of resources in order to achieve objectives that are potentially incomprehensible to humans, let alone controllable." Part of the team's reasoning came from the halting problem put forward by Alan Turing in 1936. The problem centers on knowing whether or not a computer program will reach a conclusion and answer (so it halts), or simply loop forever trying to find one. As Turing proved through some smart math, while we can know that for some specific programs, it's logically impossible to find a way that will allow us to know that for every potential program that could ever be written.


The Mutating Cyber Threat

Although each best practice is important, having a programmatic approach is essential for success, Kaun said. “Too many organizations look at security as a list of individual tasks such as perimeter protection and patching, but in reality they all have to work together.” As best practices mature and become part of corporate culture, and as people become educated and equipped to apply those best practices, true change and improved security begins to evolve. “A common adage in security is ‘people, processes, and technology,’ Cusimano noted. “Two of those involve people because people have to adhere to the processes.” The human element is the ultimate toolset, including awareness, collaboration, support, and maintenance. “A proper security program is properly educated and equipped people applying best practice policy and procedures, aided by technology,” Kaun said. “While the right technology will accelerate the effort, if you do not have the global view, the appropriate people, and contextual data to act upon, you will struggle.” Establishing that culture is critical but won’t happen overnight, Cusimano said. He recalled the transition to a safety-first culture in many manufacturing plants.


MIT and Databricks Report Finds Data Management Key to Scaling AI

“Data issues are more likely than not to be the reason if companies fail to achieve their AI goals, according to more than two-thirds of the technology executives we surveyed,” says Francesca Fanshawe, editorial director for MIT Technology Review and editor of the report. “Improving processing speeds, governance, and quality of data, as well as its sufficiency for models, are the main data imperatives to ensure AI can be scaled.” Data security is also a priority with leaders revealing they plan to increase spending on security improvement by an average of 101% over the next three years. The leader group also plans to invest 85% more in the same period on data governance, 69% more on new data and AI platforms, and 63% more on existing platforms. The report lists a few attributes of successful data and AI technology foundations, including a democratization of data to involve a greater number of data literate employees who can configure and improve AI algorithms. Openness is another attribute, with open standards and data formats allowing organizations to source data, insights, and tools externally to facilitate collaboration


Responsible AI, Blockchain in Safe and Ethical AI

Artificial Intelligence (AI) is a broad field that includes machine learning and cognitive computing where computers are programmed to mimic cognitive functions such as learning and problem solving many times faster and more accurately than a human. AI or its subset Computational intelligence, when combined with blockchain systems, can create more robust cryptographic functionality and ciphers thereby making it more difficult for cyber hackers to compromise systems. When blockchain participants have increased control over their data, they have the potential to decide with which parties and for what purposes their data are shared. To collect participant data for use in an AI dataset, participant permissions will need to be obtained.  ... The decentralized characteristics of smart blockchains can effectively help smart grids realize the transformation from centralization to distribution. The decentralization of smart blockchain breaks information barriers and realizes secure data sharing among multiple participants.


Worried about quiet quitting? These Dos and Don'ts could stop it becoming a problem

To understand the risk of quiet quitting in current employees, keep in touch with former employees and find out what made them leave the company. Their insight can help you improve culture for current employees and reduce further resignations. Deal suggests conducting thorough exit interviews with employees who leave the company and reaching out six months later to assess their experience at their new job if they have one. This six-month communication opportunity can be the route back to the former workplace for some employees. If an employee expresses dissatisfaction at their new job and an interest in returning to your company, see what you can do for them. Employees who left your company on good terms, and later want to return to their old jobs, are called boomerang employees, and they can be very beneficial to your company. ... But beware: some employees may hesitate to ask for their old jobs back. They might fear a response from former colleagues who were unhappy at their departure, or they might be concerned about an employee they didn't like who is still in the business. But if you're lucky, this is an opportunity to have excellent talent return to your company.


DevOps Is Dead. Embrace Platform Engineering

Developers don’t want to do operations anymore, and that’s a bad sign for DevOps, at least according to this article by Scott Carey and this Twitter thread by Sid Palas. ... When developers in teams don’t agree on the extent to which they should, or can, do operations tasks, forcing everyone to do DevOps in a one-size-fits-all way has disastrous consequences. The primary consequence is the increasing cognitive load put on developers. This has forced many teams to reconsider how they balance the freedom that comes from developer self-service with mitigating cognitive load through abstraction. Both are necessary: Self-service capabilities are essential to moving quickly and efficiently. ... Platform engineering uses a product approach to enable the right amount of developer self-service and find the right level of abstraction for individual organizations and teams. Successful platform teams combine user research, regular feedback and marketing best practices to understand their developers, create a platform that solves common problems and get internal buy-in from key stakeholders.


SEO poisoning campaign directs search engine visitors from multiple industries to JS malware

Deepwatch came across the campaign while investigating an incident at a customer where one of the employees searched for “transition services agreement” on Google and ended up on a website that presented them with what appeared to be a forum thread where one of the users shared a link to a zip archive. The zip archive contained a file called "Accounting for transition services agreement" with a .js (JavaScript) extension that was a variant of Gootloader, a malware downloader known in the past to deliver a remote access Trojan called Gootkit but also various other malware payloads. Transition services agreements (TSAs) are commonly used during mergers and acquisitions to facilitate the transition of a part of an organization following a sale. Since they are frequently used, many resources are likely available for them. The fact that the user saw and clicked on this link suggests it was displayed high in ranking. When looking at the site hosting the malware delivery page, the researchers realized it was a sports streaming distribution site that based on its content was likely legitimate. 



Quote for the day:

"Open Leadership: the act of engaging others to influence and execute a coordinated and harmonious conclusion." -- Dan Pontefract

Daily Tech Digest - September 22, 2022

MFA Fatigue: Hackers’ new favorite tactic in high-profile breaches

When an organization's multi-factor authentication is configured to use 'push' notifications, the employee sees a prompt on their mobile device when someone tries to log in with their credentials. These MFA push notifications ask the user to verify the login attempt and will show where the login is being attempted. An MFA Fatigue attack is when a threat actor runs a script that attempts to log in with stolen credentials over and over, causing what feels like an endless stream of MFA push requests to be sent to the account's owner's mobile device. The goal is to keep this up, day and night, to break down the target's cybersecurity posture and inflict a sense of "fatigue" regarding these MFA prompts. ... Ultimately, the targets get so overwhelmed that they accidentally click on the 'Approve' button or simply accept the MFA request to stop the deluge of notifications they were receiving on their phone. This type of social engineer technique has proven to be very successful by the Lapsus$ and Yanluowang threat actors when breaching large and well-known organizations, such as Microsoft, Cisco, and now Uber.


Forget digital transformation: data transformation is what you need

One of the most critical aspects of digital transformation is understanding how your organisation leverages data. Once you know how your organisation uses data, you can work on optimising data usage and applying analytics and insights to drive better business outcomes. If you don’t have a data strategy in place, your organisation will likely struggle with leveraging data for digital transformation efforts. Without a data strategy, it isn’t easy to know where your data is coming from, what type of data you have, and what you plan to do with it. Having a data strategy in place will help you determine where your data is coming from, what type of data you have, and what you plan to do with it, thus allowing you to create a plan for leveraging data for digital transformation efforts. If you want to leverage data for your digital transformation efforts, you should do a few things. First, you need to understand your data. This means assessing your data sources and determining what type of data you currently access. You also need to decide which data sources you need and where you can find them.


The human touch

Combining human and machine capabilities can create a sharper focus to how we view the world around us. So how do you square the two? How do you choose between humans, who excel at their understanding of context and nuance but cannot make consistent decisions, and automated processes, which are far better at being objective but don’t understand the decisions they’re making? The answer comes in recognizing that, while humans and machines are flawed, they are flawed in different ways. When it comes to combining them, you could start, naively, by thinking about the technology first, and expect human operators to fill in the gaps of what the system can’t yet do. Or (better) you can do things the other way around. The contrast between the technology-first and human-first approaches is well illustrated by the development of driverless cars in the last few years. Humans aren’t very good at paying attention for long periods of time, and driverless cars with human monitors have struggled to live up to their early promise. Meanwhile, collision avoidance systems – which largely use much of the same technology – are a good example of building a system around the human


There’s one thing that makes employees want to return to the office, says a new Microsoft report

Microsoft’s study found that 84% of people would be motivated to come into work more frequently by the promise of being able to enhance connections with coworkers. But most bosses are trying to use corporate policies to force them back, rather than using those human connections as leverage. “It turns out that in person connections with the person that [you] work with are the biggest draw,” says Spataro. “They’re bigger than tacos. The idea that I can actually connect with my coworker really, really matters.” Workers are demanding flexibility, which is how the hybrid work week has come into vogue. But Spataro says he thinks, ultimately, the workplace will be looking like the office we know from the pre-pandemic days, but with a lot more flexibility. ... Workers are demanding flexibility, which is how the hybrid work week has come into vogue. But Spataro says he thinks, ultimately, the workplace will be looking like the office we know from the pre-pandemic days, but with a lot more flexibility.


Planning the journey from SD-WAN to SASE

Today, organizations are working toward creating a more robust framework of integrated security and networking technologies referred to as Secure Access Service Edge (SASE). This is essentially a combination of SD-WAN and other networking technologies and security services, with the latter now referred to as security service edge (SSE). SSE encompasses a number of security functions to provide the requisite levels of secure connectivity with functionality such as zero-trust network access (ZTNA), data loss prevention (DLP), cloud access security brokers and more. Moving forward, network and security vendors are working to deliver tighter integration with third parties or provide a fully integrated product with both SD-WAN and SSE. Because of SD-WAN's rapid adoption to support direct internet access, organizations can leverage existing products to serve as a foundation for their SASE implementations. This would be true for both do-it-yourself as well as managed services implementations. If you are still in the planning stages for an integrated SASE deployment, you aren't alone. 


What could be the cause of growing API security incidents?

Critical infrastructure sectors such as manufacturing and energy & utilities, which typically rely on legacy systems, ranked unfavourably when measured on a number of metrics. They ranked worst on the percentage of API security incidents in the last 12 months, with 79% of manufacturing and 78% of energy & utilities respondents saying they had experienced incidents, of which they were aware. Energy & utilities companies were also the least likely to have a full inventory of APIs and know which return sensitive data, with just 19% confident about this issue. Manufacturing organizations found it most difficult to scale API security solutions, with just 30% saying they found it easy. Furthermore, real-time testing was at its lowest in energy & utilities (7%), whilst manufacturing, and energy & utilities were most likely to conduct API security testing less frequently than once per month, with 20% and 21% doing this, respectively. The relative lack of testing in these critical infrastructure sectors correlates with the number of API security incidents they have suffered in the last 12 months. 


Threat Actor Abuses LinkedIn's Smart Links Feature to Harvest Credit Cards

The campaign is not the first time that threat actors have abused LinkedIn's Smart Links feature — or Slinks, as some call it — in a phishing operation. But it marks one of the rare instances where emails containing doctored LinkedIn Slinks have ended up in user inboxes, says Brad Haas, senior intelligence analyst at Cofense. The phishing protection services vendor is currently tracking the ongoing Slovakian campaign and this week issued a report on its analysis of the threat so far. LinkedIn's Smart Links is a marketing feature that lets users who are subscribed to its Premium service direct others to content the sender want them to see. The feature allows users to use a single LinkedIn URL to point users to multiple marketing collateral — such as documents, Excel files, PDFs, images, and webpages. Recipients receive a LinkedIn link that, when clicked, redirects them to the content behind it. LinkedIn Slinks allows users to get relatively detailed information on who might viewed the content, how they might have interacted with it, and other details.


Clive Humby – data can predict nearly everything about running a business

You really need to think about three things: first, you need to think about what do I really need? In the grocery world, the past four weeks’ transactions compared to the year-on-year sales are much more insightful than having everything because you want to know what’s changed. How do sales compare from this Easter to last Easter, this Christmas to last Christmas? Understanding relative movement in data. The second thing is to reduces the level of granularity in your data into what I call “baskets of interest”. I am much more interested in the mix of groceries you buy than individual items. And the third thing, while you might have a warehouse of data with everything in probably every decision you make will need of less than half a per cent for the data. Not trying to analyse all of your data, all the time. If you are looking for trends you don’t need to look at all of the data, just look at 10 per cent of the data. People tend to over-engineer because the technology companies have told them to.


Data science engineer: A day in the life

Between communication, data engineering, meaningful result reporting, and more, data scientists have many goals. At Xactly, my daily goal is to illustrate to the rest of the organization and our customers the value of our data. Strategy and evangelization are a huge priority. It’s important to illustrate how data science is useful in other departments like engineering, marketing, customer experience, and sales. In the space of a day, this can be messy, requiring us to dig into the details of how data was created. From this, we hope to create new predictors that could be incorporated into our models. My team focuses on solving various technical problems across the organization daily. Over time, each day’s work contributes to achieving bigger goals. I see it as solving one or two subproblems per day, which over time, feeds into solving a larger problem that serves a bigger purpose. As we finish projects, we build on that success by developing new models and making new insights. For example, a recently deployed model achieved sales forecasting accuracy of nearly 100 percent. 


Universities Urged to Defend Sensitive Research From Hackers

Lawmakers should set a minimum standard around what constitutes acceptable security for any research institutions that are either federally funded or receive federal subsidies, Evanina told the committee. Much of government doesn't have a real understanding of the academic culture and has therefore taken a "search and replace" approach to regulation, in which nonprofit universities and for-profit businesses are expected to follow the same rules, Gamache said. Poorly designed federal mandates attempting to fix cybersecurity in higher education could actually cause harm, he warned. But over the past five years, Gamache says, a number of federal agencies have really tried to understand what the academic community is all about. The FBI has led the way in this effort by going all-in on initiatives such as the Academic Security and Counter Exploitation Program, and the Department of Commerce has also become more engaged, according to Gamache.



Quote for the day:

"The art of communication is the language of leadership." -- James Humes

Daily Tech Digest - September 21, 2022

IT Talent Crunch Shifts Tech Investment Strategies

Prasad Ramakrishnan, CIO at Freshworks, points out that low- and no-code tools enable businesses to do more with less, and the easy-to-use, configuration-based user experience of these tools means anyone can use them. He adds tech stacks have become bloated and complex, with features end users typically don't care about. “In an attempt to check every box, technology went from being purpose-built, to tailored to no one,” he says. “The pandemic has made this trend more pronounced.” Ramakrishnan conducts an “app rationalization” exercise regularly with his team, evaluating software applications in terms of integrations needed, their security, whether they are being used (to retire if needed) and how much they are being used (to reduce licenses if needed). “Constantly audit your tech stack,” he advises. “We also involve the end user to make sure everyone is part of the process, akin to a democratized process.” From his perspective, leaders need to create space for end-user feedback -- without it, companies could be taking away valuable tools that employees use and leave them with bloated applications they never use.


Why Investors & Founders Need To Embed Corporate Governance

There have been numerous tweets and posts about governance, the blame game, and other topics. Governance, in my opinion, begins with the founders and senior management. The investors/board have no way of knowing about fraud or any of the aforementioned issues because they are not involved in the day-to-day operations. However, once discovered, the board of directors and investors are responsible for resolution. Consider the case of a company in the news: many prominent Sillicon Valley and New York-based investors participated despite the fact that one of the cofounders was convicted of identity theft. If they believe in second chances, why not make this cofounder a full-fledged director of the company? There is also the role of regulatory bodies such as the RBI, given that some of these startups (particularly fintech) are governed by them because they have a stake in a bank. Laws and regulations that encourage collaboration to ensure there is no “conflict” or, for example, our regulations make it impossible for investors to liquidate and take their money back.


Introduction to SOLID Principles of Software Architecture

Per the Single Responsibility Principle, every class should not have more than one responsibility, (i.e., it should have one and only one purpose). If you have multiple responsibilities, the functionality of the class should be split into multiple classes, with each of them handling a specific responsibility. ... When classes are open for extension but closed for modification, developers can extend the functionality of a class without having to modify the existing code in that class. In other words, programmers should make sure their code can handle new requirements without compromising on the existing functionality. Bertrand Meyer is credited with introducing this principle in his book entitled “Object-Oriented Software Construction.” According to Meyer, “a software entity should be open for extension but closed for modification.” The idea behind this principle is that it allows developers to extend software functionality while preserving the existing functionality. In practical terms, this means that new functionality should be added by extending the code of an existing class rather than by modifying the code of that class.


The Uber Hack’s Devastation Is Just Starting to Reveal Itself

“It’s disheartening, and Uber is definitely not the only company that this approach would work against,” says offensive security engineer Cedric Owens of the phishing and social engineering tactics the hacker claimed to use to breach the company. “The techniques mentioned in this hack so far are pretty similar to what a lot of red teamers, myself included, have used in the past. So, unfortunately, these types of breaches no longer surprise me.” The attacker, who could not be reached by WIRED for comment, claims that they first gained access to company systems by targeting an individual employee and repeatedly sending them multifactor authentication login notifications. After more than an hour, the attacker claims, they contacted the same target on WhatsApp pretending to be an Uber IT person and saying that the MFA notifications would stop once the target approved the login. Such attacks, sometimes known as “MFA fatigue” or “exhaustion” attacks, take advantage of authentication systems in which account owners simply have to approve a login through a push notification on their device rather than through other means, such as providing a randomly generated code. 


Does your password policy align with NIST recommendations?

“NIST outlines several simple steps to strengthen passwords against modern password-based attacks. Organizations that ignore NIST’s recommendations are leaving an essential authentication security layer vulnerable,” notes Josh Horwitz, chief operating officer at Enzoic. ... As hacking threats increase and many IT teams are understaffed, upgrading your password policy may seem like a nice-to-have. However, password hardening is easy to do, leverages the existing investment in passwords and, unlike most security policies, actually makes things easier for users and administrators. The right solution reduces user frustration around frequent required resets and complex rules. Technology can also lower administrative burden and spend by using automation to reduce password reset calls and boost cybersecurity. Adopting modern technology such as Enzoic for Active Directory can help you avoid security breaches, prevent ransomware attacks and avoid account takeovers. “Organizations need a way to identify when passwords become compromised,” says Horwitz, adding, “Otherwise, their users and administrators can’t follow or enforce the NIST requirement to not reuse compromised passwords.”


Cybersecurity as an employee benefit

Many business leaders and human resources professionals believe that cybersecurity is the responsibility of their information technology staff and managed services provider. However, ensuring that employees and their families have appropriate cybersecurity protection is an employee benefit that benefits employers as well. Mistakes, lack of awareness and general vulnerability of employees remains the most significant cyber security risk for most employers. Simply training employees about cyber threats typically fails to reduce that risk sufficiently. To have a truly cyber-mature workforce, employers need to engage employees in cybersecurity. Teaching employees about the threats to themselves and their families, and making personal protection services available to them, is a much better method to engage employees in cybersecurity. Cybersecurity training is not most people’s idea of a good time. However, employees sit up and take notice when trainers talk to them about the prevalence and severity of the cyber threats to themselves personally, including their identities, credit files, financial accounts, personal devices and home networks.


Meta, TikTok, YouTube and Twitter dodge questions on social media and national security

Whistleblowers and industry have repeatedly raised alarms about inadequate content moderation in other languages, an issue that gets inadequate attention due to a bias toward English language concerns, both at the companies themselves and at U.S.-focused media outlets. In a different hearing yesterday, Twitter’s former security lead turned whistleblower Peiter “Mudge” Zatko noted that half of the content flagged for review on the platform is in a language the company doesn’t support. Facebook whistleblower Frances Haugen has also repeatedly called attention to the same issue, observing that the company devotes 87% of its misinformation spending to English language moderation even though only 9% of the platform’s users speak English. In another eyebrow-raising exchange, Twitter’s Jay Sullivan declined to specifically deny accusations that the company “willfully misrepresented” information given to the FTC. “I can tell you, Twitter disputes the allegations,” Sullivan said, referring to testimony from the Twitter whistleblower on Tuesday.


5 steps to designing an embedded software architecture, Step 1

First, they are not very portable. For example, what happens if a microcontroller suddenly becomes unavailable? (Chip shortage, anyone?). If the code is tightly coupled, attempting to move the application code to run on a new microcontroller becomes a herculean effort. Application code is tightly coupled to low-level hardware calls on the microcontroller! I know a lot of companies who have suffered through this recently. If they didn’t update their architecture, they had to go back through all their code and change every line that interacted with the hardware. The companies that updated their architecture broke their architecture coupling through abstractions and dependency injection. Second, unit testing the application in a development environment rather than on the target hardware is nearly impossible. If the application code makes direct calls to the hardware, a lot of work will go into the test harness to successfully run that test, or the testing will need to be done on the hardware. Testing on hardware is slow and is often a manual rather than an automated process. 


The promise of sustainable AI may not outweigh the organizational challenges

Without help from technology, outlining sustainability goals would be a limiting and difficult exercise. Enterprises today struggle with quantifying the risk of climate change, especially when it comes to digital transformation. In fact, only 43% of global executives say they are aware of their organization’s IT footprint. Data analytics and AI offer a solution to this challenge, as they provide meaningful insights across industries to understand where those gaps exist and thus can help companies incorporate more sustainable practices. Research shows that 89% of organizations recycle less than 10% of their IT hardware. However, if a company is to truly reap all the environmental benefits of sustainable AI, IT must play a crucial role in using this technology as the organization’s biggest helper, not its adversary. There are four broad areas that offset the sustainability impact of AI machinery and technology: reporting, cloud, circular economy, and coding. Accurate metrics and reporting will keep the AI systems intact and constantly improving, while cloud promotes sustainability because users only pay for the infrastructure per use, eliminating the need to run data centers at full threshold.


Measuring performance in agile

It’s really easy to destroy the culture of an agile team with metrics. We need to be sure that what we measure encourages the right behaviour. Using a team’s velocity as a performance measurement comes with a strong warning label: “Scrum’s team-level velocity measure is not all that meaningful outside of the context of a particular team. Managers should never attempt to compare velocities of different teams or aggregate estimates across teams. Unfortunately, we have seen team velocity used as a measure to compare productivity between teams, a task for which it is neither designed nor suited. Such an approach may lead teams to “game” the metric, and even to stop collaborating effectively with each other. In any case, it doesn’t matter how many stories we complete if we don’t achieve the business outcomes we set out to achieve in the form of program-level target conditions” We’ve all heard about working smarter, not harder, yet by focusing on story points as a measurement, we find that although in the short term we will succeed at getting people to complete more story points by simply working harder, this approach will not necessarily achieve the outcomes that we want.



Quote for the day:

"Nobody in your organization will be able to sustain a level of motivation higher than you have as their leader." -- Danny Cox

Daily Tech Digest - September 19, 2022

10 mistakes rookie CIOs make — and how to avoid them

Most CIOs have likely heard that “culture eats strategy for breakfast,” the famous quote from management guru Peter Drucker. But rookie CIOs don’t often take that message to heart, according to both researchers and experienced CIOs. “One of the rookie mistakes is not truly understanding your business, culture, and organizational fabric,” says Richard A. Hook, executive vice president and CIO of Penske Automotive Group and CIO of Penske. “Everyone is focused on their 100-day plan, but the reality is the pace of that plan and composite will vary between organizations. Get to know your peers, their teams, your team, and the overall organization before taking a too-aggressive approach. In the end, organizations win with the best people, be sure you know your teams and deeply understand the business before acting too harshly.” Jackson agrees, saying new executives should assess their department’s culture and the organization’s overall culture early on. This, he explains, lets leaders know how to adjust and change so they can be most effective moving forward.


EU Cyber Resilience Act sets global standard for connected products

The EC said the new rules would rebalance security responsibility towards manufacturers who will be made to ensure they conform to the new requirements, ultimately benefiting end-users across the EU by enhancing transparency, promoting trust, and ensuring better protection of basic rights to privacy. The EC acknowledged the act is likely to become an international point of reference beyond the EU’s internal market, and Keiron Holyome, BlackBerry vice-president for the UK and Ireland, Eastern Europe, Middle East and Africa agreed with this view. “Today, as the EU launches its Cyber Resilience Act to protect European consumers and businesses from the risks caused by insecure digital products, the UK must sit up and take notice. This act should not be viewed as a European requirement, but in fact a new global standard,” said Holyome. “The EU’s new act further highlights that British organisations must take action, particularly when it comes to the use of potentially insecure smart devices for home working. ... Although smart devices may seem innocent, bad actors can easily access home networks with connections to company devices – or company data on consumer devices – and steal intellectual property worth millions.


Hybrid workers don't want to return to the office. But soon, they might have to

No doubt many leaders will be paying attention to how major tech companies are reacting to the situation. Apple, for instance, has laid off a number of recruiters and plans to curb hiring next year to help it weather an uncertain economic climate. Meta, Microsoft and Google have also announced plans to slow hiring, and all four tech giants have made moves to get their workers into the office on a more regular basis in recent months. Asking employees to return to the office as a reaction to financial uncertainty feels more like a return to what feels familiar than a practicable way of overcoming the challenges ahead. While doing so might help leaders regain a sense of control and run the business as a much tighter ship, it's not necessarily going to help improve productivity or engagement. ONS data suggests that 78% of employees who work from home in some capacity report a better work-life balance, and taking this away will not win employers any favours. Workers might also choose to return to the office if working from home gets significantly more expensive.


When openness doesn’t matter

“Open is better…unless it isn’t,” notes software exec James Urquhart, who has done his share of work with open source companies. The key to figuring out the “isn’t” in a particular case is to look at the practical effects of a given strategy. Lightbend and Akka founder Jonas Bonér stressed that the company’s decision to change the Akka license was because the current model simply wasn’t sustainable. He says, “With Akka now considered critical infrastructure for many large organizations, the Apache 2.0 model becomes increasingly risky when a small company solely carries the maintenance effort.” To prod these large organizations to pay for their use of Akka, the company turned to the BSL 1.1 as “a form of productive and sustainable open source” that is “easy to understand, provides clear rules, and is enforceable.” Not everyone will like it. Some of the more vocal members of the open source Illuminati have castigated Lightbend for this decision. But rather than criticize, why not simply observe? If it’s truly a bad strategy, it will fail, and both Lightbend and other companies will learn from that failure, and there will be less re-licensing with licenses that are perceived to be less open.


Hacker Accessed LastPass Internal System for 4 Days

The breach investigation was carried out in partnership with cybersecurity firm Mandiant and uncovered that the threat actor's activity was limited to a four-day period until the incident was contained. Further investigation from LastPass and Mandiant determined that the threat actors gained access to the development environment using a developer's compromised endpoint. "While the method used for the initial endpoint compromise is inconclusive, the threat actor utilized their persistent access to impersonate the developer once the developer had successfully authenticated using multifactor authentication," Toubba says. Toubba acknowledges that the threat actor was able to access the development environment but failed to access any customer data or encrypted password vaults. Toubba also says that the LastPass development environment is physically separated from other environments, including the production area, and has no customer data or encrypted vaults. The notification also says that the company does not have access to the master passwords used by the customers, and without having the master password, no one can decrypt vault data as part of the company's "zero-knowledge security model."


Double-transmon coupler will realize faster, more accurate superconducting quantum computers

Toshiba has recently devised a double-transmon coupler that can completely turn on and off the coupling between qubits with significantly different frequencies. Completely turning on enables high-speed quantum computations with strong coupling, while completely turning off eliminates residual coupling, which improves quantum computation speeds and accuracy. Simulations with the new technology have shown it realizes two-qubit gates, basic operations in quantum computation, with an accuracy of 99.99% and a processing time of only 24 ns. Toshiba's double-transmon coupler can be applied to fixed-frequency transmon qubits, realizing high stability and ease of design. It is the first to realize coupling between fixed-frequency transmon qubits with significantly different frequencies that can be completely switched on and off, and to deliver a high-speed, accurate two-qubit gate. The technology is expected to advance the realization of higher-performance quantum computers that will contribute in such areas as the achievement of carbon neutrality and the development of new drugs.


Automation Gains a Foothold, But How to Scale It Is the Challenge

“Going forward, automation should be the focus at each business group and department – it must be a mandatory part of business planning,” he explains. Each C-level executive should provide a plan of how much automation each quarter/year they plan to implement to reduce the number of resources their division needs. They should also come up with tangible KPIs that will impact cost reduction and generate savings for sustained growth. Butterfield says this focus must come from the board as a priority item, enabled through technology and implemented by all. “AI and automation are as much a capability as a technology – therefore, even if someone is taking responsibility, the organization will only be successful if everyone is aligned,” he says. Freund says that while automation involves a broad set of stakeholders across both business and IT, it’s not always easy to get them all on the same page. Depending on the organization, a technical leader like an enterprise architect might spearhead the automation process by kicking off a proof of concept (PoC), organizing a team to execute it, and presenting the results to business stakeholders.


Computational Aesthetics in Robotics Design and Automation

Robotic informatics studies how robots interact with their surroundings and how this affects the aesthetics of their design. It considers such questions as how to create visually appealing robots and how to ensure that they behave in an aesthetically pleasing way. Though research is still ongoing in this area, there are already some promising results. For example, a study shows that people respond more favorably to visually engaging robots with well-designed features. That may help increase efficiency and productivity in the industry while creating a more positive image for robotics technology. One of the main ways computational aesthetics impacts robotics programming is by providing new methods for designing and improving robots. Such new methods are artificial intelligence (AI), machine learning (ML), and deep learning (DL). All these methods involve teaching computers to do things that were once impossible for them. ML, in particular, is a form of AI that allows computers to learn from experience and improve their performance over time based on this experience. DL is similar to ML.


6 tips for successfully leading software developers

Developers’ will to create is strong, but it can be hard to perceive as creativity is often obscured by the technological nature of development. Developers communicate with a strange patois of acronyms that hide the artistic spirit behind it. Learning to perceive and nurture that spirit is a special kind of leadership that developers will appreciate. Just the awareness of the creative life of developers is important. Not only will it help to understand where they are coming from, but it will lead to policies and decisions that support that creativity and out of that will come real bottom-line benefit. The space and time to innovate will lead to better software that handles the vicissitudes of business. You need the human creativity of your developers captured in the half-machine/half-thought medium of code to be agile. Perhaps the most important feature for the leader to bear in mind here is in realizing the attachment that developers have to their work. Affection might be a better word than attachment. Building a thing that feels beautiful and worthy in itself has its own momentum. 


Are we experiencing cloudflation?

Many critics cite the lack of a sound cloud finops program to monitor, track, and govern costs. The rudimentary problem right now is that companies have little or no insight into any cloud costs before they get the bill. In other words, if having a finops program scores a 9 out of 10 in terms of cloud cost management maturity, these companies are still at a 1 or 2. This state exists because most enterprises did not see cloud coming—or coming as rapidly as it did due to the pandemic. As a result, they did not allocate budget and resources to manage cloud costs: the hard costs such as cloud computing bills for services, as well as soft costs such as the many expensive humans now needed to keep cloud-based systems running. Here’s the good news: Implementing even a rudimentary finops strategy with cloud cost monitoring and controls will quickly pay for itself. Moreover, it will do so without diminishing cloud services. It accomplishes noninvasive cost savings partly by implementing basic housekeeping tasks, such as shutting down unused instances where the meter is still running or optimizing the use of cloud resources that lack current cost management, with options to automate as deeply as desired or required.



Quote for the day:

"Hold yourself responsible for a higher standard than anybody expects of you. Never excuse yourself." -- Henry Ward Beecher

Daily Tech Digest - September 18, 2022

5 ways to secure devops

Devops workflows are designed for speed and rapidly iterating with the latest requirements and performance improvements. Gate reviews are static. The tools devops teams rely on for security testing can lead to roadblocks, given their gate-driven design. Devops is a continuous process in high-performance IT teams, while stage gates slow the pace of development. Devops leaders often don’t have the time to train their developers to integrate security from the initial phases of a project. The challenge is how few developers are trained on secure coding techniques. Forrester’s latest report on improving code security from devops teams looked at the top 50 undergraduate computer science programs in the US, as ranked by US News and World Report for 2022, and found that none require secure coding or a secure application design class. CIOs and their teams are stretched thin with the many digital transformation initiatives, support for virtual teams and ongoing infrastructure support projects they have going on concurrently. CIOs and CISOs also face the challenges of keeping their organizations in regulatory compliance with more complex audit and reporting requirements. 


Designing APIs for humans: Error messages

The status code of the response should already tell you if an error happened or not, the message needs to elaborate so you can actually fix the problem. It might be tempting to have deliberately obtuse messages as a way of obscuring any details of your inner systems from the end user; however, remember who your audience is. APIs are for developers and they will want to know exactly what went wrong. It’s up to these developers to display an error message, if any, to the end user. Getting an “An error occurred” message can be acceptable if you’re the end user yourself since you’re not the one expected to debug the problem (although it’s still frustrating). As a developer there’s nothing more frustrating than something breaking and the API not having the common decency to tell you what broke. ... Letting you know what the error was is the bare minimum, but what a developer really wants to know is how to fix it. A “helpful” API wants to work with the developer by removing any barriers or obstacles to solving the problem. The message “Customer not found” gives us some clues as to what went wrong, but as API designers we know that we could be giving so much more information here.


Arm Neoverse roadmap targets enterprise infrastructure, cloud

"Compute workloads are on a relentless march higher, and becoming more complex," said Chris Bergey, senior vice president and general manager of Arm's infrastructure line of business, at a press briefing. "Machine learning and AI are taking over the future, and so infrastructure will look nothing like the past." Over the next year, Arm will work closely with its cloud and software partners to optimize cloud-native software infrastructure, frameworks and workloads. These partnerships include contributions to projects including Kubernetes and Istio, along with several CI/CD tools used for creating cloud-native software for the Arm architecture. Arm will also work to improve machine learning frameworks such as TensorFlow and a number of workloads such as big data, analytics and media processing. The company is moving into more traditional enterprise spaces now, Bergey said, noting the work it has done with VMware on its Project Monterey and providing support for Red Hat's OpenShift and SAP's HANA. "These cloud providers all use GPUs to underpin their cloud workloads, and the majority of them are using Arm," Bergey said.


How quantum physicists are looking for life on exoplanets

So, some of the biggest things in the universe are certainly quantum mechanical, including supermassive blackholes which can lose energy through a quantum phenomenon known as Hawking radiation. The second point is one often thinks quantum deals with very low temperatures. Again, to take our sun as an example—it's very hot, but that's quantum mechanical. Low temperature doesn't serve as a requirement for quantum. This example of a star and the quantumness of the fusion process and the high temperatures associated with that—I just want to broaden the view of what quantum mechanics is and how ubiquitous it is. ... It's quite amazing that we can determine what is in these planets' atmospheres—planets that would be impossible for humans to ever visit. That, and we can look for signatures of life, like, are there molecules that we associate with life floating around in these planets, at least if it's Earth-like life; then we might be able to determine with some probability that some planet way out there that no human could ever visit, harbors life. Or maybe we could discover other candidate forms of life.


How Is Platform Engineering Different from DevOps and SRE?

Over time, thought leaders came up with different metrics for organizations to gauge the success of their DevOps setup. The DevOps bible, “Accelerate,” established lead time, deployment frequency, change failure rate and mean time to recovery (MTTR) as standard metrics. Reports like the State of DevOps from Puppet and Humanitec’s DevOps benchmarking study used these metrics to compare top-performing organizations to low-performing organizations and deduce which practices contribute most to their degree of success. DevOps unlocked new levels of productivity and efficiency for some software engineering teams. But for many organizations, DevOps adoption fell short of their lofty expectations. Manuel Pais and Matthew Skelton documented these anti-patterns in their book “DevOps Topologies.” In one scenario, an organization tries to implement true DevOps and removes dedicated operations roles. Developers are now responsible for infrastructure, managing environments, monitoring, etc., in addition to their previous workload. Often senior developers bear the brunt of this shift, either by doing the work themselves or by assisting their junior colleagues.


The Cyber Security Head Game

Just as the predators of the fish below are never going to go away (which is why this fish camoflages itself and sports huge fake eyes to scare predators), cyber predators also will never go away. And the best of these cyber predators will continue to penetrate even the strongest defenses, because the exponential increase in IT system complexity, which makes it increasingly difficult to even understand the full extent of what you're defending, favors cyber attackers over cyber defenders. So we need to assume that some hackers will inevitably get inside our networks and thus we must adopt strategies of deception, similar to those employed successfully by our fish here, to lessen the harm from competent hackers, who manage to get up close and personal. We also need to create doubt in hackers’ minds, about the benefits of attacking us in the first place, in the same way that the poisonous Cane toad avoids attacks from predators who know the toad’s skin has lethal poison glands, and milk snakes, who have no poison, but discourage would-be predators by mimicking the coloration of coral snakes, who definitely do have deadly venom.


US Cyber-Defense Agency Urges Companies to Automate Threat Testing

Automated threat testing is still not very widespread, according to the official, who added that organizations sometimes don’t really follow through after deploying expensive tools on their network and instead just assume they’re doing the job. Automating security controls will make it easier to stop attackers from relying on established tactics. The top threat actors are still going back and leveraging vulnerabilities that are up to 10 years and older, warned the CISA official. CISA is making the recommendation in collaboration with the Center for Threat-Informed Defense, a 29-member nonprofit formed in 2019 that draws on MITRE’s framework. Iman Ghanizada, global head of autonomic security operations at Google Cloud, a research sponsor of the Center, said automated testing is important for creating continuous feedback loops that can steadily improve protection. “Whether you are a large company or a startup, you have to have visibility, analytics, response and continuous feedback,” he said.


Smart Cities: Mobility ecosystems for a more sustainable future

Although every city is different, leading cities are becoming smarter through their participation in large, complex, digitally enabled ecosystems. The question for many urban leaders, however, is how to engage with them effectively. Our experience in working with large transportation and communications clients yields a multilayered model and approach to guide the design and management of urban mobility systems. Given the interconnected nature of the building blocks of mobility, each layer—demand, supply, and foundational—is critical. Cities must understand and manage all the interactions and interdependencies. For example, demand for different forms of transportation is enabled via available modes of transit and supporting infrastructure. None of these would be possible without regulations, financing, insurance, and innovation. ... To achieve its vision of becoming a 45-minute city, Singapore is focusing on building its infrastructure (e.g., it is building intermodal mobility hubs to allow commuters to move seamlessly from one mode of transportation to another). The city is developing a robust innovation ecosystem, collaborating with many private-sector players. 


How to Draw and Retain Top Talent in Cyber Security

Before you introduce policies to increase diversity, you need to know who is currently applying. Gather data on applicants to establish if you need to take proactive steps to attract specific groups – you can’t make rational business decisions without data. Analyze job descriptions to eliminate bias so you aren’t deterring anyone. Review the language -- are you unconsciously drafting job advertisements and application forms with a white male in mind? Consider a post-application survey so you can establish what is appealing to recruits and what might cause them to drop out. You’ll be surprised how many people want to share their feedback because a negative job application process can deter an applicant for good, and you could be missing out on the best talent through ignorance. We implemented an Applicant Tracking System to understand the sources our candidates are coming from, see how diverse the candidate pool is (or not), and improve the candidate experience by being able to track how their process progresses and ends. ... Once you’ve got these cyber professionals on board, you need to keep them. 


Why shift left is burdening your dev teams

Security and compliance challenges are a significant barrier to most organizations’ innovation strategies, according to CloudBees. The survey also reveals agreement among C-suite executives that a shift left security strategy is a burden on dev teams. 76% of C-suite executives say that compliance challenges and security challenges (75%) limit their company’s ability to innovate. This is due, in part, to the significant time spent on compliance audits, risks, and defects. At the same time, C-suite executives overwhelmingly favor a shift left approach, a strategy of moving software testing and evaluation to earlier in the development lifecycle, placing the burden of compliance on development teams. In fact, 83% of C-suite executives say the approach is important for them as an organization, and 77% say they are currently implementing a shift left security and compliance approach. This is despite 58% of C-suite executives reporting that shift left is a burden on their developers. “These survey findings underscore the urgent need to transform the software security and compliance landscape. 



Quote for the day:

"Courage is the ability to execute tasks and assignments without fear or intimidation." -- Jaachynma N.E. Agu