Daily Tech Digest - January 09, 2023

Making Data Proactive to Manage Risk

Using advanced tools and technology, statistical sampling of data offers a better approach than archaic data indexing. Data sampling, via AI-based segmentation, meets the demands of regulators and other authorities. By statistically sampling data, it can be made more proactive to facilitate risk management with a methodical approach. AI-based segmentation or sampling collects representative data and allows for the development of models across a wide range of data classification use cases. Such sampling provides a way to statistically home in on the vulnerable areas within your data fabric and iteratively test for risk and compliance. It is efficient and effective means of reducing overall risk, in less time and at less cost. The Census Bureau uses sampling by using selective demographic records and drawing inferences on a population. Manufacturers have used statistical quality control to selectively sample widgets to determine, with confidence, that the quality of a population of manufactured parts met specification, without checking every single widget.


It’s official: Digital trust really matters to everyone online

Given that almost everyone surveyed indicated their appreciation of digital trust, it is not surprising that it is considered a priority. The typical respondent commenced work on digital trust two to three years ago, making 75% (or more) progress so far with expectations of reaching complete trust within the next one to two years. Arguably, however, digital trust is more of a journey than a destination, given the constantly shifting nature of the threat environment. The fear of customer attrition directly translates into a digital trust goal: customer loyalty. Other goals (which contribute to customer loyalty) include reducing security issues, meeting regulatory, legal and compliance obligations with reduced cost, and improving brand perception. Achieving digital trust improvements isn’t without its challenges. Topping the list of obstacles is managing digital certificates, rated as important by 100% of enterprises. Regulatory compliance and handling the scope of what they are protecting was a close second at 99%. Complexity rounds out the difficulties faced (securing dynamic, multi-vendor networks isn’t easy), while a lack of staff expertise is also cited.


Turning Points in AI and ML

When one couples the technology capabilities of AI/ML solutions with the practical ends they may evolve to serve, the potential examples multiply quickly. Think about the job of content moderator in a social media environment, which requires not only discrete judgment, but also attention to detail at tremendous speed and volume. Today, bots can screen text for certain terms and expressions. But tomorrow’s may be able to monitor sentiment, understand contexts outside the immediate content, or evaluate non-text expressions, like videos or photos. In a contact center environment, you can “trip up” a present-day bot by trying to stray from its trained area of knowledge. That’s because today’s conversational bots learn from other conversations. Tomorrow’s will learn from the world of unstructured inputs around them, as people do, so they’ll keep up with you no matter where you steer the conversation. Natural language understanding and large language models will translate that into unfettered interaction and follow up with required action that’s instantly and automatically informed by relevant data wherever it resides.


Developers Should Celebrate Software Development Being Hard

Software development is too hard for people to do who don’t enjoy software development. This is good news because it means anyone not committed will give up because they will find it too difficult to coast in. Developers are put under intense pressure to deliver quickly and to constantly learn new technology. Developers who don’t enjoy software development will give up because it's too hard. The difficulty of software development reduces the number of developers, despite it being a well-paid job with good career options. The number of good developers is small because it's easier to be a bad developer than a good developer. ... If you are a developer who enjoys software development, take a moment to thank the software gods. Low code software development will increase the number of developers, but it won’t increase the number of good developers because most people don’t understand how software development works. The harder development is, the fewer developers who can do it well. This makes those developers valuable.


3 Lessons Entrepreneurs Can Learn From The Rise and Fall of History's Biggest Companies

The second lesson is that entrepreneurs can still beat out larger companies even if they lack the same connections to power. History shows that "right" can often beat "might." ... Energetic commitment and talent will beat resource-rich rivals, as long as entrepreneurs pick their fights wisely. There are two reliable ways of spotting opportunities to do so. First, as companies get bigger, even well-managed ones must leave opportunities on the table — market segments or product opportunities too small or too different for them to do well in or focus on. These often provide windows of opportunity for small players. Today's small markets can become tomorrow's large markets. ... Finally, in assessing today's large companies, it's important to remember that their success usually came from a basic entrepreneurial achievement combined with an organizational mindset. As entrepreneurs grow their businesses, they should be mindful of the competencies they have developed and remain intent on building new ones over time. New competencies — fueled by innovation — will likely increase their trajectory in growth and value.


Is Your Wi-Fi Router in the Wrong Spot? Here's How to Tell

Routers send the signal out in all directions, so if it's left in the corner of your home, a significant percentage of your wireless coverage is being sent outside your home. That's why your best bet is to move the router to a central location to optimize the signal. Installing a router across the house from the modem may prove troublesome. It may require manually running an especially long CAT5 or CAT6 Ethernet cable under the floor or along the bottom of your walls, or enlisting the help of power line network adapters, which use your home's electrical wiring to pass an internet signal from point to point. But the improved wireless coverage will be worth it. ... Routers tend to spread their strongest signals downward, so it's best to mount the router as high as possible to maximize coverage. Try placing it high on a bookshelf or mounting it on the wall in an inconspicuous place. Search online, and you'll find lots of custom wall mounts built for specific routers, like this stick-up mount for the Eero Pro 6 mesh router. If you're struggling to find a good, elevated spot, something like that could be a great solution.
Avoid other electronics


Why data engineers are key to becoming a true digital leader

A common misconception among enterprise business leaders is that their data-driven ambitions will be realised by hiring data scientists. Data scientists are, of course, a crucial part of a data-driven business. Their ability to unearth interesting and unusual data patterns, and develop predictive and analytical models, helps to discover new solutions that can lead to positive outcomes such as cost-saving. However, data scientists are not purely driven by business goals. Instead, they are motivated by experimentation. If not managed appropriately, this can hinder data projects as data scientists search for solutions that the business may not want to implement. Data engineers, on the other hand, are responsible for translating data insights into technical and data requirements to directly meet business objectives. Unlike data scientists, data engineers are firmly focused on driving a business’s overall data strategy forward. This can include assisting with the performance of analytics projects, authorising data for different audiences, and ensuring data governance for regulation compliance.


UN to Hold Hearing on Proposed Cybercrime Treaty

The proposed treaty identifies cybercrime as any "criminal offenses committed intentionally and illegally" over IT devices. It further lists a variety of criminal activities that are deemed illegal. These include activities such as illegal access, network interference, tampering of hardware or software that results in the compromise of critical infrastructure or leak of confidential government data, among others. By identifying and clearly defining what constitutes various cybercrimes, the treaty seeks to provide a legal basis for states to prosecute potential offenders, which may range from sophisticated nation-state hackers to employees who illegally access sensitive government data. The draft proposal further spells out measures that states can adopt such as granting law enforcement agencies the right to collect data in real time, seize devices used for cybercrime activities, coordinate with intelligence agencies, as well as assist victims of various cybercrimes.


We’re a Long Way From a Passwordless Reality

A passwordless future sounds fantastic, but passwords will remain a backup authentication method until passwordless technologies mature. Few websites are currently compatible with passwordless authentication. The majority of websites will need to continue to store passwords because decades will pass before every user has the hardware and software they need to use passwordless authentication. Even in the Windows-advertised world of passwordless setup passwords still matter, particularly as a backup method. The latest Windows release breaks the Windows Hello biometrics and PIN setup that users already count on for passwordless authentication. Last September, Microsoft said commercial users of Microsoft apps and services, such as Outlook, OneDrive, and Microsoft Family Safety, could remove the password from their Microsoft accounts entirely. But, Windows 11 release version 22H2 breaks the Windows Hello authentication technology. Windows users can experience Windows Hello sign-on failures with face recognition, fingerprints, and PINs. 


How to improve your incident response plan for 2023

Many organizations are confident in the existence of their incident response plan (IRP), but they are often not entirely sure what to do with it. A threat-specific IR playbook can offer easily accessible guidance during the chaos of incident response and is a vital element of an IR plan. When a cybersecurity incident happens, you’re scrambling to understand what’s being harmed or stolen, and not knowing where to begin can exacerbate the damage. Using your playbook as a set of IR standard operating procedures (SOPs) can define the roles and responsibilities of each IR team member as well as other key stakeholders within the company and keep everyone on the same page. For instance, the IR team will determine that passwords need to be changed during the containment of a ransomware incident, but to understand which passwords need to be changed or other required actions, they could consult the playbook for quicker resolution. These incidents call for “all hands on deck”, but for things to run smoothly, everyone must know their individual roles and the roles of others, including who the critical point of contact for each workstream is.



Quote for the day:

“A real entrepreneur is somebody who has no safety net underneath them.” -- Henry Kravis

Daily Tech Digest - January 08, 2023

The best robots and AI innovations at CES 2023

Advancements in autonomous driving haven't developed as quickly as some imagined they would. However, cars are incrementally becoming smarter and smarter, with autonomy seemingly just over the horizon. Case in point: Peugeot, Stellantis's French automobile brand, unveiled the Inception Concept car, an electric vehicle demonstrating what a car can be, once you do away with the steering wheel, get comfortable and let the vehicle get to know you a little. ... While autonomous cars are still in development, other market-ready autonomous mobility tools were on display on CES. The company Evar was at the conference with Parky, an autonomous EV recharging robot that brings a charging station to any parking spot. It's designed for building owners that want to make their parking spots more EV-friendly without adding electric capacity. ... The Withings U-Scan toilet bowl sensor attaches to the inside of your toilet's bowl. It includes a nutrition and metabolic urine tracker, checks pH, ketone, vitamin C levels, and more. A second tracker monitors women's luteinizing hormone for ovulation cycles. Each promise early detection of potential health issues.


Math Behind Software and Queueing Theory

Unsurprisingly, queueing theory is a branch of mathematics, focused on studying and describing queues (or, in more professional terms, lines). The whole theory is all about how lines are created, how they behave, and, most important, how and why they malfunction. It is one of these branches of mathematics which are useful in real life; e.g., it can be used in many branches of industry. ... Basically, we can treat most of the systems like a queue so users send requests, the request process, and the response return to the user, or when the system is too busy to process the request right away, the request waits until some arbitrary timeout is reached or it will be processed. The real problem is to correctly identify the class of the system we are working on. In most cases, it will be the variation of M/M/c or Mx/m/c. Unfortunately, it can result in our calculations not being very in line with real life. As long as we are taking care of long-term average system performance then M/M/c is an appropriate description and most of the inconsistencies should be kept in line with averaged results.


SpiderLightning: Making WebAssembly cloud applications portable

A key element of this extensibility is the WebAssembly Component Model. Defined by the WebAssembly working group as the Wasm equivalent of an OS process model, it’s the foundation for how WASI implements its interfaces. A key element of any low-level approach like this is an interface definition language, which provides a way to specify how interfaces interact with code. For Wasm, and especially for the Component Model, the standard IDL is wit, which gives us a concise and human-readable way of defining interfaces that are expanded into WebAssembly code. To use WASI to build distributed applications, we need a set of extensions that lets us abstract provider-specific services as interfaces. Instead of having to use separate APIs for S3 on AWS and Blob storage on Azure and the code to manage them, we could have a single storage component that would provide a common set of interfaces on all platforms, with the underlying WASI instance managing service-specific implementations.


Attackers create 130K fake accounts to abuse limited-time cloud computing resources

Researchers refer to the abuse of free offers as freejacking, and the creation of accounts that incur charges and then are never paid as "play and run." The latter is more difficult to pull off because most service providers require the user to register a valid credit card or payment method before giving them access to paid-for computing resources. However, even if usage is tracked and charged on a per-minute basis, the bill is usually issued after a longer period. This gives attackers a time window to abuse such services. ... "The infrastructure architecture employed by the actors uses CI/CD techniques, in which each individual software component of an operation is placed within a container," the researchers said. "This container operates within a modular architecture within the larger mining operation. CI/CD architectures provide highly modular operational environments, allowing some components of an operation to fail, be updated, or even be terminated and replaced, without affecting the larger environment." Not all the containers are used for cryptomining. 


How to Get the Best Cyber-Insurance Deal

The first step in obtaining affordable cyber insurance is finding a broker who is well-versed in coverage terms and has access to several different insurance markets, says Mark Dobrow, a vice president in the insurance brokerage division of Segal, a human resources and employee benefits consulting firm. “Market knowledge and experience is limited due to the relative newness of the product as compared to the long history of standard property coverages,” he explains. “The right broker can tailor the coverage to your needs and should know which markets are best for a particular situation.” ... The biggest mistake cyber-insurance applicants make, Aiello says, is paying poor attention to detail. “Businesses must ensure technology is being deployed in line with the insurance firm's conditions, otherwise insurers can attempt to get out of paying a claim if the technology was not ‘properly implemented’,” he warns. Unfortunately, the language used in cyber-insurance policies isn't always consistent between providers. 


Southwest Airlines: ‘Shameful’ Technical Debt Bites Back

It’s been an open secret within Southwest for some time … that the company desperately needed to modernize its scheduling systems. … This problem — relying on older or deficient software that needs updating — is known as incurring technical debt [and it] appears to be a key factor in why Southwest Airlines couldn’t return to business as usual the way other airlines did after last [month’s] major winter storm. When hiccups or weather events happen, the employees have to go through a burdensome, arduous process … because Southwest hadn’t sufficiently modernized its crew-scheduling systems. For example, if … their flight was canceled … employees have had to manually call in to let the company know where they are [sometimes] being left on hold on the phone for … hours just to let the company know their whereabouts. … Online forums are full of employee accounts of such misery. … This can easily cascade to a systemwide halt. … Such breakdowns resulting from technical debt are often triggered by external events, like weather. … So why didn’t Southwest simply update its software and systems?


Top 3 trends experts predict to hit software development in 2023

While hackers are typically associated with cyberattacks, many of them also have a “broad, practical skillset” that can make them useful for parts of software development. That’s according to Alex Rice, the co-founder and CTO of HackerOne, which connects businesses with penetration testers and cybersecurity researchers. Rice believes that both hackers and external code reviewers will become a more integrated part of the software development processes in 2023, as more organisations adopt security reviews into their development process. “As the value of DevSecOps (development, security and operations) increases, we’ll see the line between hackers and developers blurring as hackers with development expertise become a core element of the software development processes,” Rice said. “There’s a lot of value hackers can bring when it comes to catching security risks earlier rather than later.” Earlier this year, Irish start-up Noloco raised $1.4m in seed funding for its platform, which lets companies build internal tools, portals and apps without writing a line of code.


Blind Eagle APT Hunts Banking Victims in Colombia, Ecuador

Based on Trend Micro's report, the APT is traditionally known to leverage publicly available remote access tools and Trojans such as njRAT, imminent monitor, ProyectoRAT, Warzone RAT, Async RAT, Lime RAT, Remcos RAT and BitRAT. Over time, the APT switches from one RAT to another. Continuing that trend, Blind Eagle is now using a modified version of the QuasarRAT, Check Point researchers say. The attack begins with phishing emails containing a booby-trapped link that deploys a Trojan named Quasar RAT. The APT used a geo-filter server in one campaign that redirects requests made from outside of Ecuador and Colombia to the website of the Ecuadorian Internal Revenue Service, suggesting the APT's targeting focus. The campaign not only drops a RAT but also employs a more complex infection chain. It abuses the legitimate mshta.exe binary to execute VBScript embedded in an HTML file to ultimately download two Python scripts, which adds a new stage in the infection chain. The first of the two, ByAV2.py, is an in-memory loader that runs a Meterpreter payload in DLL format.


What is Cython? Python at the speed of C

Enter Cython. The Cython language is a superset of Python that compiles to C. This yields performance boosts that can range from a few percent to several orders of magnitude, depending on the task at hand. For work bound by Python’s native object types, the speedups won’t be large. But for numerical operations, or any operations not involving Python’s own internals, the gains can be massive. ... Note that Cython’s approach is incremental. That means a developer can begin with an existing Python application, and speed it up by making spot changes to the code, rather than rewriting the whole application. This approach dovetails with the nature of software performance issues generally. In most programs, the vast majority of CPU-intensive code is concentrated in a few hot spots—a version of the Pareto principle, also known as the “80/20” rule. Thus, most of the code in a Python application doesn’t need to be performance-optimized, just a few critical pieces. You can incrementally translate those hot spots into Cython to get the performance gains you need where it matters most. 


5 ways to improve security automation

One essential part of security automation that you'll likely want to tackle before anything else is monitoring. If you don't know where your issues are, you won't catch critical exposures in your environment and won't know what to prioritize for automation. The bottom line is to automate monitoring your environment, if you do nothing else. Even if you don't have the time or budget to automate remediation, you can at least target areas for manual fixes. There are many fantastic articles and products around this space (including How we designed observability for a hybrid cloud platform), from basic infrastructure monitoring to code scanning to network vulnerability scanning and more. Another thing to keep in mind is transition planning. You won't get all of this done at once, nor should you. As you figure out what areas to target first and focus your automation efforts accordingly, you will undoubtedly face challenges rolling out your new standards and processes to your environment. If you didn't set standards before, you'll be met with resistance from teams with their own priorities and commitments to the business that don't understand why you're trying to change things on them.



Quote for the day:

"Leaders are more powerful role models when they learn than when they teach." -- Rosabeth Moss Kantor

Daily Tech Digest - January 07, 2023

A Perfect Storm: 7 Reasons Global Attacks Will Soar in 2023

The Cybersecurity Venture report correctly identified the talent crunch as a reason for concern. But the problem has even deeper roots. The worldwide economic outlook continues to face stiff headwinds. Inflation, the energy crisis and supply chain issues are affecting every industry. Inflation will increase the overall cost of cyber crime as preventive and remediation costs rise. While inflation is not directly related to the number of incidents, it does impact company budget decisions. In response, some of the biggest tech brands are reducing headcounts and implementing hiring freezes. Meanwhile, security teams have been stretched thin for years. If security budgets don’t rise with inflation, security leaders will have even less buying power to implement strong security and capable teams. ... While the big, high-profile breaches fill headlines, many intruders prefer to target smaller organizations. Between 2020-2021, cyberattacks on small companies surged by more than 150%, according to RiskRecon, a Mastercard company that evaluates companies’ security risk.


How CIOs can be pillars of stability in an uncertain world

One of the guiding principles for those who would master uncertainty is to recognize that there has always been something irresistible about advice in mathematical form. Over-reliance on metrics has given rise to the term “McNamara fallacy” referring to the tragic missteps associated with the misaligned quantifications used during the Vietnam War. Instead of flailing around trying to enumerate everything that could happen, executives need to place intense scrutiny on a subset of critical uncertainties. In other words, neglect the right uncertainties. ... Finding workers might be an uncertain undertaking but retaining key performers is not. Leaders have it in their power to know what their high performers are thinking. For these key employees it is possible to paint reasonably clear pictures of what happens next. Mike McSally, a human capital advisor with 20-plus years of experience in executive recruiting, does not believe recruiting has to be a problem. Reducing talent uncertainty is a simple matter of managing personal networks.


14 Cybersecurity Best Practices to Instill In Your End-Users

Employees should have no choice but to comply with the password policy rules of your organization. With Specops Password Policy, for instance, organizations can enforce length and complexity requirements to ensure that their password is as strong as possible while blocking over 3 billion known breached passwords. ... To further secure end-user accounts, the implementation of multifactor authentication (MFA) should be mandatory for end-users logging into work apps, or making a change like resetting their passwords. When it comes to the MFA process, the more ways you can verify your identity when logging in, the harder it is for someone to steal your information. ... Another best practice pertaining to account information is to encourage employees to lock their screens when they’re not around. Leaving screens unlocked increases the risk of someone viewing or accessing sensitive data. ... To start, all new purchases should come directly through the IT department. IT is responsible for not only setting up the employee on the company’s network, but also for making sure the computer is properly equipped with security and OS or system support. 


Transformational Inertia: Why So Few Digital Transformation Projects Succeed

Key to success is a company’s ability to embrace change and for the staff at all levels to reframe the transformation as something they are an owner of and a strategic investor in, rather than it being something that is happening to them. This often requires a major change in company mentality and behavior. Altering the attitudes towards transformation in this manner can help the staff to challenge assumptions and redefine problems in an attempt to identify alternative strategies and solutions that are very likely not apparent to the leadership of the transformation. Adopting the idea that everyone is leading the transformation, and has the opportunity to be an active contributor to it, is the objective. This requires promoting psychological safety and open communication as a cornerstone of company culture. Close collaboration and constant, effective communication with all parties can ensure the success of any given initiative, most significantly, digital transformation. This communication ensures that respect is granted to all members of the company and that they are supported throughout the transformation process.


Why remote and hybrid work could fuel cyber attacks in 2023

Attackers will lean more on their powers of persuasion than on their malware kits as they step up social engineering attacks in the cloud … a single fake social media profile, leveraged in the right way, can allow a threat actor to impersonate a trusted vendor,” said Morey Haber, chief security officer at Boston-based security firm Cybereason. “The threat actor will persuade victim after victim to divulge secrets or act in other ways contrary to their interest or that of their employer. The Lapsus$ [ransomware] group used social media to become an employee and then spoof access by calling a support helpdesk.” In March, the UK police arrested seven people, including a teenage boy, following a series of online attacks by the Lapsus$ hacking group that hit major technology companies, including Okta and Microsoft. Lapsus$ has publicly taunted its victims, leaking their source codes and internal documents. It has reportedly gone as far as to join the Zoom calls of companies they’ve breached, during which they have taunted employees and consultants trying to manage the hack. The group has claimed to breach companies such as Samsung, Vodafone and Ubisoft.


Life as a CISO: Challenges, certifications, and more

We all struggle with information overload. It’s hard to organize and prioritize the firehose of information—not only external information from intelligence feeds and news sources, but also internal problems, concerns, or tasks. Humans are not able to multitask well. Structuring how you process information, prioritize things, and stay on top of key elements is critical for your success. One of my mentors said, “look back from quarter to quarter at what you’ve done successfully and do more of those things. Be sure to cover yourself in the areas that will really affect your business. Those other things that won’t keep you up at night? Leave them behind or at least wait until they bubble up to the front.” ... In engineering, there are “first principles,” meaning you can deconstruct any problem if you understand the basic building blocks. The same concept applies to cyber security. Working with big frameworks, such as the National Institute of Standards and Technology (NIST) or the International Organization for Standardization (ISO) standards, helps you organize and effectively prioritize what you’re doing.


From Ferrari to Ford, Cybersecurity Bugs Plague Automotive Safety

Even though security vulnerabilities have been an issue in the industry for some time (going back to Charlie Miller and Chris Valasek's infamous 2015 Jeep hack detailed at Black Hat USA), automakers have been slow to recognize the potential severity of the developments, says Gartner automotive industry analyst Pedro Pacheco. He explains that as automakers transition into becoming software developers, they are struggling to address all points of that development cycle — including security. "One very simple notion is if you're not good in software, you're probably not going to be very good in making that software safe," he says. "That is guaranteed." From his perspective, automakers are also too complacent when it comes to addressing and patching security vulnerabilities right away. "Automakers look at this in a more reactive way than a proactive way, basically saying we'll address the small number of customers affected and solve the issue and then everything goes back to normal," he says. "That's the way of thinking for many carmakers."


Laid Off by Big Tech? Cybersecurity is a Smart Career Move

For IT professionals recently laid off from big tech jobs, the move to cybersecurity can feel like a strange shift. Consider a software engineer or application developer out of a job and looking for new opportunities. They may bypass infosec openings simply because they’re not sure security would be a good fit. They’re not wrong. While cybersecurity is on the same spectrum as other IT opportunities, it comes with a different approach. Conflict rather than consistency is at the heart of these protective positions. Despite its significant departure from other roles, it offers a unique opportunity for growth. Put simply? Having an adversary fuels innovation. Instead of working on projects with a consistent path between point A and point B, cybersecurity staff must be ready to respond at a moment’s notice. Even as they’re busy implementing strategies and solutions to detect attackers earlier and mitigate malware impacts, they’re also the first line of defense against attacks in progress. ... As one digital door closes, however, another opens. And strangely enough, it’s one that sees technology experts finding ways to keep network doors shut tight against potential attackers.


What it takes to succeed as a CIO today

You’ve got to have leaders who can articulate the digital vision, be that ‘tech whisperer’ to explain to senior executives your journey into the future, and then you need to be able to properly manage the change management initiative — or all your great strategies won’t deliver their promised value. Another big skill set that’s absolutely required is financial and business acumen, because you need to be able to explain to people the value that will be created. Yes, you need to know technology, but, boy, you need to be a leader that can get things done quickly in a commercially sound manner, creating a lot of value and articulating not only the business model but the overall strategy for the organization. That means you also need to understand all the global forces, and you need to understand the pulse and the heartbeat of the organization from a cultural perspective. ... In addition to financial acumen, what many CIOs need if they aspire to be a CEO is desire for the role, and a kind of toughness, because being a CEO can be a lonely job. You’ve got to make some really tough choices. It’s less a collaborative team sport than the CIO position. 


From School Dropout to CEO: Advice for Creative Entrepreneurs

Entrepreneurship is not for the faint of heart: New problems, scary unknowns and intriguing (but distracting) opportunities will challenge you every day. And you'll second-guess yourself every step of the way while others rely on you to make decisions. People will rely on you to make the right decisions — and they expect you to do it with a degree of confidence, whether you have any or not! Movies love to depict entrepreneurs with automatic access to lavish parties, luxury cars and a golden ticket to Silicon Valley. In this case, life doesn't imitate art. Entrepreneurship includes many struggles. And if you're lucky, and your company begins to grow, your struggles grow as well. In fact, you can compare entrepreneurship to parenting. Some of the most difficult, challenging and stressful moments in life involve raising a child. The bigger the child, the bigger the mess, right? It often feels like an uphill battle trying to keep the house clean. But parenting is also magic. It includes some of the most moving and memorable moments of your life. Parents and entrepreneurs often find themselves in high-pressure situations, managing unique personalities and getting zero credit.



Quote for the day:

"Leadership is the creation of an environment in which others are able to self-actualize in the process of completing the job." -- John Mellecker

Daily Tech Digest - January 06, 2023

2023 could be the year of public cloud repatriation

High cloud bills are rarely the fault of the cloud providers. They are often self-inflicted by enterprises that don’t refactor applications and data to optimize their cost-efficiencies on the new cloud platforms. Yes, the applications work as well as they did on the original platform, but you’ll pay for the inefficiencies you chose not to deal with during the migration. The cloud bills are higher than expected because lifted-and-shifted applications can’t take advantage of native capabilities such as auto-scaling, security, and storage management that allow workloads to function efficiently. It’s easy to point out the folly of not refactoring data and applications for cloud platforms during migration. The reality is that refactoring is time-consuming and expensive, and the pandemic put many enterprises under tight deadlines to migrate to the cloud. For enterprises that did not optimize systems for migration, it doesn’t make much economic sense to refactor those workloads now. Repatriation is often a more cost-effective option for these enterprises, even considering the hassle and expense of operating your own systems in your own data center.


How Cyber Pathways Can Help Your Career

The Cyber Pathways Framework will introduce chartered standards that align with 16 cybersecurity specialties. These job roles that have, until now, been loosely defined will be given specific descriptions and linked to existing qualifications and certifications to see the establishment for the first time of minimum requirements, as called for by the DCMS in its Understanding the cyber security recruitment pool report. On the plus side, this will set a bar to achieve certain roles, helping to standardize role requirements. This could prove helpful in the current climate where the demand for talent is leading to job creep, with job descriptions containing myriad skillsets. And it could prove fundamental in stopping the current job hopping that we’re seeing. But it will also see roles become more rigid, and given that the sector has always grown organically, there will need to be some provision made for the evolution of new roles as and when needed, such as ones involving AI and DevSecOps. Another key pathway proposal is the creation of a register for cybersecurity practitioners, similar to that seen in the medical, legal and accountancy professions, for senior positions.
 

The Cloud Computing Boom: A Test for Database Companies

The threat of the cloud also resonated with Shoolman, who said that “the cloud is all over”. For instance, a lot of Oracle’s business has been taken by cloud service providers. ... More importantly, he says, there is a change in the top five: what was dominated by the likes of IBM, SAP, and Oracle is now highly dominated by AWS, Azure, GCP, etc. The rest 20%, he says, is occupied by ISVs like Redis, MongoDB, and others. All of the big-tech cloud providers have come up with data services similar to those provided by these independent vendors to cater to their business needs. But, recognising that despite being their competition, ISVs have to depend on cloud platforms too to host their services, MongoDB said, “We are in a love-hate relationship with our cloud partners”. When Shoolman was asked if he sees more hyperscalers like AWS, Azure, and GCP coming up in future to meet organisation demands for massive scaling in computing, he said that we are indeed seeing a trend of developing more and more data centres since organisations intend to bring data much closer to the user.


Ukraine War and Upcoming SEC Rules Push Boards to Sharpen Cyber Oversight

The war, along with the hybrid work models that have been put in place at many companies as a result of the pandemic, prompted corporate directors to carefully consider how their companies might be exposed to cyber risks, said Andrea Bonime-Blanc, chief executive of GEC Risk Advisory LLC, a New York-based firm that advises boards and executives about cybersecurity and risk management. Board awareness of cybersecurity “was already increasing glacially, but I think the Ukraine war has sharpened the minds,” Ms. Bonime-Blanc said. Some boards now rate cyber threats on a par with trade wars and supply-chain problems among risks that could have major impact on companies, said Michael Hilb ... A communication gap between boards and security chiefs means neither side is as effective as needed to govern cybersecurity, said Yael Nagler, chief executive of Yass Partners, a consulting firm focused on aligning security leadership. Directors sometimes fail to understand core threats, Ms. Nagler said. “They’re not shy people but when it comes to cyber, they feel like they’re asking dumb questions,” she said.


Pro Coders Key to Stopping Citizen Developer Security Breach

Another Forrester prediction that may directly impact developers is their forecast that enterprise business leaders, not IT, will direct more than 40% of the API strategies. That goes against conventional wisdom that IT drives the API strategy, Gardner noted. “APIs have transcended from being just pure application or infrastructure APIs. There [are] now business APIs, there [are] ones that take advantage of data and take advantage of transactions, and essentially, enable the data economy,” he said “It’s not an IT conversation anymore. IT will make sure it stays secured and locked down and make sure that it’s tightly woven with everything else, but the business leader decides which ones are the most beneficial.” API strategy is even becoming a board-level topic, as board members and C-level leaders have grasped that APIs can be a central part of the business strategy, he said. That makes sense because the greatest value of APIs comes when organizations use them to create new products, business models, and channels, according to 


Today’s Software Developers Will Stop Coding Soon

Coding will never account for 100% of your time. Even junior ICs will have meetings to attend and non-coding tasks to complete. As you progress the IC ranks to senior and beyond, the non-coding work will grow. Apart from attending meetings, I’ve highlighted below a few prominent responsibilities that fall under this work. ... Begin doing this at any time, and never stop. No one is “not experienced enough” — even new hires can begin by filling in any conceptual gaps or “gotchas” they encountered while onboarding. ... Software engineering teams will always face skills gaps. You will lack some cross-functional support like a project or program manager, product designer, etc. As such, you may need to develop the skills of an adjacent role, like project management, to set deadlines and perform other duties associated with overseeing a project’s completion. ... As you gain experience no your team, you’ll be asked to onboard new hires including mentoring junior devs. Being a mentor will improve your communication skills and bolster your promotion packet.


Can the world’s de facto tech regulator really rein in AI?

The AI Act may also run into enforcement challenges. The regulation will apply mainly to companies or other entities developing and designing AI systems — not to public authorities or other institutions that use them. For example, a facial recognition system could have vastly different implications depending on whether it’s used in a consumer context (i.e., to recognize your face on Instagram) or at a border crossing to scan people’s faces as they enter a country. “We are arguing that a lot of the potential risks or adverse impacts of AI systems depend on the context of use,” said Karolina Iwanska, a digital civic space advisor at the European Center for Not-for-Profit Law in the Hague. “That level of risk seems different in both of these circumstances, but the AI Act primarily targets the developers of AI systems and doesn’t pay enough attention to how the systems are actually going to be used,” she told me. Although there has been plenty of discussion of how the draft regulation will — or will not — protect people’s rights, this is only part of the picture. 


Why Do Ransomware Victims Pay for Data Deletion Guarantees?

Many ransomware-wielding attackers are expert at preying on their victims' compulsion to clean up the mess. Hence victims often face a menu of options: Pay a ransom for a decryptor, and you'll be able to unlock forcibly encrypted data. Pay more, and your name gets deleted from the list of victims on a ransomware group's data-leak site. Pay even more and you get a promise that whatever data they've stolen - or already leaked - will be immediately deleted. Of course, many victims will feel the impulse to do something, anything, for the illusion that they can belatedly protect stolen data and salvage their reputation. That impulse is understandable. But it's not only too late, but also being used against them by extortionists. Psychologically speaking, criminals don't hesitate to find the levers that will compel a victim to act - as in, give them money. Most ransomware groups' promises are bunk, and most of all anything they guarantee that a victim cannot verify. Unfortunately, seeing victims pay for data-deletion promises isn't new. 


4 career paths for software developers on the move

One of the paths is architecture. “These roles are highly technical and are focused on designing, building, and integrating the foundational components of applications or systems,” Blackwell says. “This would include roles like technical/application architect, solution architect, or enterprise architect.” ... The move into devops is another common path for software developers. These positions are also highly technical, says Blackwell, and are focused on optimizing the tools, processes, and systems to build, test, release, and manage high-quality software in complex or high-availability environments. Devops roles include release manager, engineer, and architect. ... A third path is leadership. “Roles in this area require both good people skills and good technical skills,” Blackwell says. “And each, in their own way, is responsible for ensuring that teams have what they need to succeed, whether technical, process, tools, or skills.” Roles on the leadership path include scrum master, technical project manager, product manager, technical lead, and development manager.


A Skeptic’s Guide to Software Architecture Decisions

The power of positive thinking is real, and yet, when taken too far, it can result in an inability, or even unwillingness, to see outcomes that don’t conform to rosy expectations. More than once, we’ve encountered managers who, when confronted with data that showed a favorite feature of an important stakeholder had no value to customers, ordered the development team to suppress that information so the stakeholder would not "look bad." Even when executives are not telling teams to do things the team suspects are wrong, pressure to show positive results can discourage teams from asking questions that might indicate they are not on the right track. Or the teams may experience confirmation bias and ignore data that does not reinforce the decision they "know" to be correct, dismissing data as "noise." Such might be the case when a team is trying to understand why a much-requested feature has not been embraced by customers, even weeks after its release. The team may believe the feature is hard to find, perhaps requiring a UI redesign. 



Quote for the day:

"Effective team leaders realize they neither know all the answers, nor can they succeed without the other members of the team." -- Katzenbach & Smith

Daily Tech Digest - January 05, 2023

Singh calls herself a business information security partner, but the title most commonly employed for this role is business information security officer (BISO). People in these roles are responsible for one or more areas of the business and they usually report to the CISO or CTO, based on job descriptions found online and those laid out by multiple sources interviewed for this article. The people holding these roles also come from diverse educational and experiential backgrounds, at the core of which are strong familiarity with compliance regulations, solid cybersecurity foundations, and business acumen. ... Renee Guttmann, who’s been CISO to several Fortune 50 companies, says that the most important thing she looks for in a BISO is a thorough understanding of the business unit they support, which includes identifying the company’s “crown jewels”: what the most important assets are, where they are, and the targeted attacks to which they are potentially vulnerable. The BISO should be able to identify the risks and work with others, such as architecture and infrastructure managers, to prioritize risks.


DevOps: 3 steps to plan and execute a successful project

The preliminary stages of a DevOps project are crucial. Without clear direction and a shared understanding across the team, the initiative is doomed to failure. The team and the client must therefore be willing to dedicate the time necessary to understand each other’s goals and ensure their visions align. This can be done through meetings and workshops, where participants identify objectives and team members establish a clear goal for how the final product should look. When executed correctly, the DevOps team will exit the project’s first phase with a well-defined brief and a clear understanding of the client’s goals. If this step is rushed, engineers will be hindered by a lack of direction, increasing the likelihood that the finished product will not meet the client’s requirements. ... Phase two is when the development of the app begins. This is usually facilitated by using a cloud-based solution, where the team begins preparing the environment’s aesthetic, working out the components it should contain, and understanding how they should be configured to maximize efficiency.


5 Key Kubernetes Trends to Follow in 2023

Multi-cluster Kubernetes is important because it makes it feasible to separate workloads using not just namespaces, but entirely distinct clusters. Doing so provides more security and performance protections than you can get using namespaces, which offer only virtualized segmentation between workloads. As a result, multi-cluster Kubernetes makes Kubernetes more valuable for use cases that involve very stringent security requirements, or where it's critical to avoid the "noisy neighbor" problems that can happen when multiple workloads share the same hosting infrastructure. ... No one has ever accused Kubernetes of being an easy platform to use. On the contrary, you'll find plenty of warnings on the internet that Kubernetes is "hard," or even "damn complicated." But you could have said the same thing about Linux in the 1990s, or the Amazon cloud in the mid-2000s, when those platforms were new. Like other major technologies that preceded it, Kubernetes is still growing up, and there remains plenty of room to improve it by improving the platform's usability.


Moving Beyond Security Awareness to Security Education

“Unlike awareness, application security education is based on central principles or ‘big ideas’. If key security concepts are part of a continuous and programmatic education initiative, development teams can learn to apply knowledge, skills, and experience to novel situations and better secure applications,” said Baker. When application security principles are understood, developers can then not only identify when code isn’t quite right or spot something that creates risk, but also effectively design against it. “Awareness doesn’t go far enough for security-critical roles such as software developers, product and UX managers, quality assurance and scrum masters who are all responsible for delivering safe applications,” said Baker. “What’s needed is deeper education, and there are several ways that this can be incorporated into the awareness training mix.” First and foremost, Baker stated, the concept of continuous and programmatic security education—and why it matters for security-critical roles—requires buy-in from everyone within the organization. 


Blow for Meta: must stop serving personalised ads until it's GDPR compliant

According to nyob, ten confidential meetings took place between Meta and the DPC during the course of the proceedings, over which time the DPC came down on the side of the company and its bypassing of the standard GDPR rules for consent. Schrems has launched multiple successful legal campaigns against technology companies and their misuse of personal data. He said: "This case is about a simple legal question. Meta claims that the 'bypass' happened with the blessing of the DPC. For years the DPC has dragged out the procedure and insisted that Meta may bypass the GDPR, but was now overruled by the other EU authorities. It is overall the fourth time in a row the Irish DPC got overruled." Schrems claimed the DPC had refused to release the details of the decision to nyob and accused the regulator of playing "a very diabolic public relations game". He added: "By not allowing noyb or the public to read the decision, it tries to shape the narrative of the decision jointly with Meta. It seems the cooperation between Meta and the Irish regulator is well and alive - despite being overruled by the EDPB"


What is data ingestion?

At its simplest, data ingestion is the process of shifting or replicating data from a source and moving it to a new destination. Some of the sources from which data is moved or replicated are databases, files or even IoT data streams. The data moved and/or replicated during data ingestion is then stored at a destination that can be on-premises. ... Data ingestion uses software automation to move large amounts of data efficiently, as the operation requires little manual effort from IT. Data ingestion is a mass means of data capture from virtually any source. It can deal with the extremely large volumes of data that are entering corporate networks on a daily basis. Data ingestion is a “mover” technology that can be combined with data editing and formatting technologies such as ETL. By itself, data ingestion only ingests data; it does not transform it. For many organizations, data ingestion is a critical tool that helps them manage the front end of their data and data just entering their enterprise. A data ingestion tool enables companies to immediately move their data into a central data repository without the risk of leaving any valuable data “out there” in sources that may later no longer be accessible.


The Most Futuristic Tech at CES 2023

TCL's RayNeo X2 AR glasses are available for demo at CES 2023, and CNET's Scott Stein was able to use them to translate a conversation with a Chinese speaker in real time. The frames on the RayNeo X2 AR glasses are slightly bulkier than regular eyeglass frames, but prescription inserts eliminate the need to wear other glasses underneath, and the expected introduction of Qualcomm's AR1 chipset should reduce the size further. The RayNeo X2 AR glasses will be released to the developer community at the end of the first quarter of 2023, with a commercial launch set for later in the year. ... One of the more unusual prototypes shown at CES 2023 is a wearable neckband from a Japanese startup company called Loovic. The device hangs around your neck, sort of like studio headphones when not in use, and provides audio and tactile directions to help you navigate without looking at your phone. The device was inspired by Loovic CEO Toru Tamanka's son, who suffers from a cognitive impairment that makes following directions difficult. It will work for anyone who wants to receive navigation while keeping their head up. 


Kubernetes must stay pure, upstream open-source

Vendors may modify code for their custom distributions or the supporting applications you need to make Kubernetes run in production. While a modified version of Kubernetes will work with a particular vendor’s application stack and management tools, these proprietary modifications lock you into customized component builds preventing you from integrating with other upstream open-source projects without lock-in. And if their stack comprises multiple products, it’s very hard to achieve interoperability, which can cause lots of downstream issues as you scale. ... It’s incredibly difficult to merge back a fork that has diverged drastically over the years from the upstream. This is called technical debt – the cost of maintaining source code caused by deviation from the main branch where joint development happens. The more changes to forked code, the more money and time it costs to rebase the fork to the upstream project.


Managing Remote Workforces: IT Leaders Look to Expanded Suite of Tools

Ramin Ettehad, co-founder of Oomnitza, says organizations must connect their key systems and orchestrate rules, policies, and workflows across the technology and employee lifecycle, not with tickets and manual workloads, but rather with conditional rule-based automation of all tasks across teams and systems. He notes an example of a key business process that is challenged in a remote working world is employee onboarding and offboarding. “Companies want to make a positive first impression by offering new employees a consumer-esque onboarding experience,” he says. “This effort will maximize employee experience and time to productivity.” From the perspective of Dan Wilson, vice president analyst in the Gartner IT practice, some key tech tools for remote workforce management include remote Control for IT support to remotely see and interact with computers, as well as Unified Endpoint Management (UEM). “UEM lets IT departments discover, manage, configure devices, and deploy software and operating system updates without having to connect to the corporate network or VPN,” he explains.


Social Engineering Attacks: Preparing for What’s Coming in 2023

Impersonation and comment spam have exploded over the past year and will likely be some of the most prominent forms of phishing in 2023. This type of social engineering attack exploits the trust and recognition associated with influencers. Attackers create an account on a social media site that looks nearly identical to an influencer’s. The posts are often giveaway announcements, declaring that fans just need to “click this link” or “DM this account on Telegram” to collect their winnings. Instead, people are tricked into giving away money and are ghosted by the fake account. Impersonation and comment spam have become so serious on YouTube that prominent creators have asked the platform to address the issue. The scam results in monetary theft and hurts the reputation of the creators being impersonated. ... One peculiar new form of social engineering on the rise is reputation ransomware. This scare tactic exploits the headline nature of data breach announcements. The cybercriminal will demand ransom from the victim organization, threatening to “leak” news of a fictional data breach if they do not pay.



Quote for the day:

"Without continual growth and progress, such words as improvement, achievement, and success have no meaning.” -- Benjamin Franklin

Daily Tech Digest - January 04, 2023

AI is coming to the network

The dynamics of AI-infusing a network organization will, as with many other forms of automation, center on four modes of interaction: offloading, reskilling, deskilling, and displacing. AI offloading means putting AI tools at the command of trained and experienced networking professionals to help them do their work. The idea is to make network pros more effective by allowing them to offload tasks that are repetitive, complex, time sensitive, or require extremely high levels of focused attention, but that are not creative. This is supposed to free these scarce and precious resources to do other, higher-level work instead, while paying minimal and supervisory attention to what the AI is doing. (Human attention is the most precious resource in any IT shop.) The network team doesn’t shrink, and its portfolio of services can even grow without the team also having to grow to make that possible. Reskilling allows network staff to be trained to move into other parts of IT or into entirely different kinds of jobs. It also encompasses the idea of using AI to help train new network staff up to proficiency.


Distributed SQL: An Alternative to Database Sharding

Distributed SQL is the new way to scale relational databases with a sharding-like strategy that's fully automated and transparent to applications. Distributed SQL databases are designed from the ground up to scale almost linearly. ... In simple terms, a distributed SQL database is a relational database with transparent sharding that looks like a single logical database to applications. Distributed SQL databases are implemented as a shared-nothing architecture and a storage engine that scales both reads and writes while maintaining true ACID compliance and high availability. Distributed SQL databases have the scalability features of NoSQL databases—which gained popularity in the 2000s—but don’t sacrifice consistency. They keep the benefits of relational databases and add cloud compatibility with multi-region resilience. A different but related term is NewSQL (coined by Matthew Aslett in 2011). This term also describes scalable and performant relational databases. However, NewSQL databases don’t necessarily include horizontal scalability.


How layoffs can affect diversity in tech—and what to do about it

Although layoffs have dominated the conversation during the latter part of the year, evidence shows that the Great Resignation isn’t over yet. Online job site Hired found that attracting, hiring, and retaining top talent has proven to be difficult, citing employee burnout as a key challenge, placing the blame on rapid changes in the employment environment and angst over mass layoffs and hiring freezes. For companies yet to announce job cuts, Laman said that before any decision is made, organizations need to be sure they factor DE&I into decisions around layoffs. ... However, Williams argued that there's a lot of evidence to suggest that we pattern match when we try to spot potential, meaning that one of the really big risks from all these layoffs is that if you disproportionately have just one type of person represented at a leadership level making the decisions about who stays and who goes, they're not going to have understood or realize the potential of some people who look very different or are very different from them. Carver agrees, noting that being a good manager and being a good technologist are not one and the same, meaning people are often promoted despite lacking some necessary management skills.


How Global Turmoil and Inflation Will Impact Cybersecurity and Data Management in 2023

Rising geopolitical tensions between China, Russia, and NATO allies are responsible for increased cybersecurity threats. This will lead to companies tightening security measures in 2023. With healthcare, financial, defense, and public utility sectors facing new threats from politically motivated bad actors, the organizations with cloud-based IT operations should consider employing “data geofencing” through contractual agreements with their cloud providers -- many of which store data in global data centers -- to ensure data is kept within designated regions due to national security concerns and local legal requirements. Organizations in highly regulated industries must be on high alert to protect data and websites against DDoS attacks and phishing expeditions. Data management and cybersecurity professionals should work together to devise and execute new strategies that “meet the moment” and mitigate the potential for critical customer and corporate data eventually winding up on the Dark Web. One way data teams can support company security policies is by “flipping the script” on data asset management. 


Cyberattackers Torch Python Machine Learning Project

In the latest attack on PyTorch, the attacker used the name of a software package that PyTorch developers would load from the project's private repository, and because the malicious package existed in the PyPI repository, it gained precedence. The PyTorch Foundation removed the dependency in its nightly builds and replaced the PyPI project with a benign package, the advisory stated. ... Fortunately, because the torchtritan dependency was only imported into the nightly builds of the program, the impact of the attack did not propagate to typical users, Paul Ducklin, a principal research scientist at cybersecurity firm Sophos, said in a blog post. "We're guessing that the majority of PyTorch users won't have been affected by this, either because they don't use nightly builds, or weren't working over the vacation period, or both," he wrote. "But if you are a PyTorch enthusiast who does tinker with nightly builds, and if you've been working over the holidays, then even if you can't find any clear evidence that you were compromised, you might nevertheless want to consider generating new SSH key pairs as a precaution, and updating the public keys that you've uploaded to the various servers that you access via SSH."


Why it might be time to consider using FIDO-based authentication devices

Every business needs a secure way to collect, manage, and authenticate passwords. Unfortunately, no method is foolproof. Storing passwords in the browser and sending one-time access codes by SMS or authenticator apps can be bypassed by phishing. Password management products are more secure, but they have vulnerabilities as shown by the recent LastPass breach that exposed an encrypted backup of a database of saved passwords. For organizations with high security requirements, that leaves hardware-based login options such as FIDO devices. The FIDO (Fast Identity Online) standard is maintained by the FIDO Alliance and aims to reduce reliance on passwords for security. It does so by complementing or replacing them with strong authentication based on public-key cryptography. FIDO includes specs that take advantage of biometric and other hardware-based security measures, either from specialized hardware security gadgets or the biometric features built into most new smartphones and some PCs. That makes FIDO and other physical key or token methods more phishing resistant and harder for attackers to bypass. 


Why organizations tend to fall short on secure data management

Developing a more comprehensive structure for data classification by determining a piece of data’s value, its risk profile, or its level of sensitivity can improve understanding of the data retention period, thus informing data policy to help mitigate risk and reducing the attack surface for a potential breach. That means determining from the outset that data needs to get sanitized after a set time and through a set policy, rather than waiting until the asset it sits on is disposed. Equally, by thinking about the information lifecycle from the get-go, enterprises can make quick decisions on whether they should even have that data, and if not, they should erase it immediately with a certificate proving that the erasure has been successful. If data has only been held as part of a project, then when that project finishes the team should remove it from the infrastructure under that organization’s command. Classifying data appropriately can provide actionable insight to restructure policies and help employees better understand the information lifecycle management process.


7 downsides of open source culture

The word community gets thrown around a lot in open source circles, but that doesn’t mean open source culture is some sort of Shangri-La. Open source developers can be an edgy group: brusque, distracted, opinionated, and even downright mean. It is also well known that open source has a diversity problem, and certain prominent figures have been accused of racism and sexism. Structural inequality may be less visible when individuals contribute to open source projects with relative anonymity, communicating only through emails or bulletin boards. But sometimes that anonymity begets feelings of disconnection, which can make the collaborative process less enjoyable, and less inclusive, than it's cracked up to be. Many enterprise companies release open source versions of their product as a “community edition.” It's a great marketing tool and also a good way to collect ideas and sometimes code for improving the product. Building a real community around that project, though, takes time and resources. If a user and potential contributor posts a question to an online community bulletin board, they expect an answer. 


Is Silicon Valley's Unique Aura Fading Away?

The Silicon Valley mindset is about using technology to push for what’s possible, not what’s probable, says Shannon Goggin, co-founder and CEO of San Francisco-based benefits data platform provider Noyo. “It’s about taking big swings, building the future, and creating breakthroughs.” Yet after decades of tech dominance, doubts about Silicon Valley's long-term industry supremacy are beginning to appear. ... With a rise in remote work, the value that Silicon Valley employees once placed on a vibrant office life with trendy workspaces, elaborate on-site meals, and transportation, has faded, Jain observes. “People are now looking for solid employers who offer opportunities for collaboration and the ability to make a difference,” he says. “Silicon Valley tech firms are starting to take notice.” Thanks to emerging distributed company models, the Silicon Valley mindset will continue spreading to other areas, Goggin says. “The startup ecosystem is incredibly supportive, and I will be proud to see the next generation of companies create even more opportunity for people who haven’t historically had the chance to participate in the startup and tech ecosystem,” she says.


9 steps to protecting backup servers from ransomware

The backup server should not be connected to lightweight directory access protocol (LDAP) or any other centralized authentication system. These are often compromised by ransomware and can easily be used to gain usernames and passwords to the backup server itself or to its backup application. Many security professionals believe that no administrator accounts should be put in LDAP, so a separate password-management system may already be in place. A commercial password manager that allows sharing of passwords only among people who require access could fit the bill. MFA can increase security of backup servers, but use some other method than SMS or email, both of which are frequently targeted and circumvented. Consider a third-party authentication application such as Google Authenticator or Authy or one of the many commercial products. Backups systems should be configured so nearly no one has to login directly to an administrator or root account. For example, if a user account is set up on Windows as an administrator account, that user should not have to log into it in order to administer the backup system. 



Quote for the day:

"A tough hide with a tender heart is a goal that all leaders must have." -- Wayde Goodall