Daily Tech Digest - January 10, 2023

Did AI blow up your cloud bill?

Despite its substantially lower operating costs and the potential value that AI and machine learning can bring to a business, the return falls short in many cases. 2022 was a year of huge cloud cost overruns. An enterprise’s misuse of cloud resources in general creates most cloud cost overruns. In some cases, this means choosing cloud AI/ML systems when more pragmatic alternatives could return more value. Many AI/ML systems are much more expensive to maintain. Specialized skills are needed to build and deploy these systems and then to operate them. “Cloud AI” just means that the processing and data storage are outside of the enterprise. Massive amounts of general purpose and purpose-built data are needed to drive AI engines, and that data must be stored, managed, and secured ongoing. You must also deal with data compliance. In many cases, the business has custom needs that require custom training data that isn’t part of the general-purpose transactional business database but is a one-off to support a specific need of the AI system. That means more storage, more labeling, more streaming, and more operational costs.


India’s Digital Personal Data Protection Bill: What works, what it lacks

“In areas such as itemized notice, a clarity is needed in its role in the consent,” said Vinayak Godse, CEO of the Data Security Council of India. In addition, the bill does not specificy when consent is needed from the user — for example, whether consent is required for collection of information for internal use, or only when data is being sold to third parties. “Industry is cautiously examining the idea of consent manager, a solution suggested in the draft,” Godse said. There is also confusion regarding the issue of deemed consent. The first clause in the bill regarding deemed consent says that it occurs “when a user voluntarily provides data and it is reasonably expected that she would provide such personal data.” ... The second clause pertaining to deemed consent, however, is much broader, stating that deemed consent would be considered “for the performance of any function under any law, or the provision of any service or benefit to the Data Principal, or the issuance of any certificate, license, or permit for any action or activity of the Data Principal, by the State or any instrumentality of the State.”


Outsourcing’s dark side: How to stop the surge of supply chain attacks

Alongside lags in investment, many organizations’ cybersecurity programs have fallen behind. Adequate action isn’t taken to secure remote access, which leads to far too many third parties accessing internal networks with zero oversight. A full 70% of organizations surveyed reported that a third-party breach came from granting too much access. But, half don’t monitor access at all — even for sensitive and confidential data — and only 36% document access by all parties. They simply take a “hope it doesn’t happen” approach, relying on contracts with vendors and suppliers to manage risk. In fact, most organizations say they trust third parties with their information based on business reputation alone. However, hope and blind trust are not strategies. Many bad actors play a long game. Just because vendors aren’t breaking your systems now doesn’t mean hackers aren’t involved in malicious activity undetected, gathering intel and studying workflows for a later time. Not all companies have ignored threats. The healthcare industry has become a leader in solving third-party security issues because of the need to comply with audits by regulatory bodies.


Three Essential Data Integrity Trends to Watch in 2023

As challenges with data quality increase, companies will start to become more agile in their approach to ensuring the health of their data. We are already seeing that many businesses are turning to data observability to proactively discover issues impacting the reliability of data – meaning bad data can be stopped in its tracks before it has a chance to negatively impact decision-making. The best data observability tools use advanced technology to apply machine learning intelligence, watching for patterns in enterprise data and alerting data stewards whenever anomalies crop up. It enables business users to proactively address potential problems as they happen, resulting in healthier data pipelines, more productive teams, and happier customers. Data governance has historically been viewed as a necessary tool to help drive regulatory compliance or policy management. But as organizations increasingly seek to drive advanced analytics initiatives, and get more sophisticated in how they derive business insights, the role of data governance has evolved significantly. 


HR trends in 2023 that will push the envelope even further

We see more and more businesses promoting from within and providing more internal employee training programs and opportunities. This is a result of an attempt to retain workers at a higher rate and is in part a response to a decreasing talent pool. According to a Springer report, nearly 50% of the world's workforce will require retraining or upskilling within the next five years. Modern job roles are increasingly replacing conventional job responsibilities. Organisations earlier used to place a lot of emphasis on degrees to evaluate candidates' qualifications. While academic credentials are still important, many recruiters have begun looking at particular skill sets instead. The key to technological progress is reskilling and upskilling workers in areas of need, including artificial intelligence (AI), machine learning (ML), DevOps, etc. Employers must identify the talents they require, communicate those needs, and create systems for attracting, retaining, and training new employees. In 2023, we foresee a few more trends that will demand our attention. 


5 GraphQL Trends to Watch in 2023

GraphQL helps expose fields in an easily consumable manner. But it’s also good for aggregating disparate microservices into a unified schema. As such, it is often used as a meta layer that combines multiple REST services, databases and even GraphQL schemas. For the time being, it appears that REST has staying power. And it’s unnecessary to migrate all REST services to GraphQL. Looking to the future, it is more likely to be adopted as a layer on top of existing REST APIs. Combining multiple backend services under the hood and exposing them in a unified schema creates a more usable, localized interface that frontend developers can work from. In the future, GraphQL might become a meta layer for more organizations, increasing the discovery of internal services and helping teams reuse internal microservices. ... However, there’s a downside to centralizing with a unified graph. Different internal teams or partners might only need access to a particular set of functions. Giving the entire schema to every person who walks through the door would be TMI, not to mention a potential security risk that breaks the rule of least privilege. So, the idea of a subgraph has gained traction. 


Data Science vs Software Engineering: Do You Know the Difference?

Data Science and Software engineering has too many qualities in common there is a hell lot of confusion regarding where one end and where the other starts invoking a typical data science Vs Software engineering haze. ... To understand what data science Vs software engineering is all about, to their nitty-gritty, one should get to know what they have in common. Going by the pace at which the software sector is growing, it is pretty much evident that there is an urgent need for the development of digital technology. SaaS, a sector that is playing a crucial role in delivering critical software services to companies, has become the quickest-growing sector. The growth of services like cloud computing technologies, open source, programming services, and systems services has aided to a great extent in the development of advanced technologies like machine learning, artificial intelligence, and computer vision which depend on data and data analytics. Notwithstanding the dependencies, data science and software programming share a few stark differences.


How Will Tech Jobs Change in 2023?

In 2023, people could actually start understanding what hybrid means, said Pilar Orti, director of Virtual not Distant, which offers training for managers of remote teams. “All it means is you are not all day in the office,” Orti told The New Stack. “Doesn’t tell you anything about the culture,” including if it embraces flexibility and autonomy or is still very office-based. Right now, Orti thinks most companies are throwing the word “hybrid” around to mean the separation of when you want to be social at the office, and when you want to really focus at home. Jānis Dirveiks, an Agile coach, has found flexiwork red flags in job descriptions where companies want to rank for terms like remote and hybrid, but don’t offer the culture to back it up. These tags only refer to physical location, Orti agreed. “What’s not quite there is the schedule flexibility. Most organizations are still hung up that certain things can only be done when you’re together, whether in the same space or online.” This uncertainty will only emphasize the tension and divide she witnesses in larger organizations between who can work from home and who cannot.


Top 9 challenges IT leaders will face in 2023

Gil Westrich’s company, ClearML, is benefiting from increased adoption of artificial intelligence and machine learning (ML) technology. But the CTO and co-founder says that scaling to meet that demand presents its own challenges, which require self-reflection. “How do we grow our business responsibly?” he asks. “How do we get the talent we need? Given how competitive the technology and associated talent market is, companies have to clearly map out their plans for business growth, ensuring they are as comprehensive, considered, and responsible as possible. We want to make sure our roadmap is robust.” Tyler Derr, chief technology officer at Broadridge Financial Solutions, is also concerned about how to address challenges that come with growth. “Recent market volatility has added to the complexity of delivering high-quality products and services,” Derr says. “Organizations will need to consider when and how to invest in proprietary innovation or partner with industry-outsourced solutions balancing cost and speed to market, while bringing to life a robust digital roadmap with clear and actionable objectives and key results.”


Want to be a data leader? Here are 8 attributes you’ll need

Data is worth nothing if it’s not informing decision-making, which requires somebody to put it into a relevant context for the business. To identify context, data must be applied to the circumstances at any given point in time for all of those who need it. This involves embedding necessary tools and applications, such as business intelligence (BI), into the most popular applications used by all employees. That way, data finds them – not the other way around. “By doing this, employees can do their best work with optimal information anytime, anywhere and on any device,” says Brian Gentile, chairman of the board at cloud data vendor Matillion, “to help them make those all important business decisions that may impact on the organisation’s future.” Many data crunchers succumb to the pressure of hitting this month’s numbers, which ignores the bigger picture and can negatively impact the longer-term customer experience. A true data leader will show an institutional commitment to balancing quick, lightweight testing with longer-term longitudinal studies.



Quote for the day:

"People will not change their minds but they will make new decisions based upon new information." -- Orrin Woodward

Daily Tech Digest - January 09, 2023

Making Data Proactive to Manage Risk

Using advanced tools and technology, statistical sampling of data offers a better approach than archaic data indexing. Data sampling, via AI-based segmentation, meets the demands of regulators and other authorities. By statistically sampling data, it can be made more proactive to facilitate risk management with a methodical approach. AI-based segmentation or sampling collects representative data and allows for the development of models across a wide range of data classification use cases. Such sampling provides a way to statistically home in on the vulnerable areas within your data fabric and iteratively test for risk and compliance. It is efficient and effective means of reducing overall risk, in less time and at less cost. The Census Bureau uses sampling by using selective demographic records and drawing inferences on a population. Manufacturers have used statistical quality control to selectively sample widgets to determine, with confidence, that the quality of a population of manufactured parts met specification, without checking every single widget.


It’s official: Digital trust really matters to everyone online

Given that almost everyone surveyed indicated their appreciation of digital trust, it is not surprising that it is considered a priority. The typical respondent commenced work on digital trust two to three years ago, making 75% (or more) progress so far with expectations of reaching complete trust within the next one to two years. Arguably, however, digital trust is more of a journey than a destination, given the constantly shifting nature of the threat environment. The fear of customer attrition directly translates into a digital trust goal: customer loyalty. Other goals (which contribute to customer loyalty) include reducing security issues, meeting regulatory, legal and compliance obligations with reduced cost, and improving brand perception. Achieving digital trust improvements isn’t without its challenges. Topping the list of obstacles is managing digital certificates, rated as important by 100% of enterprises. Regulatory compliance and handling the scope of what they are protecting was a close second at 99%. Complexity rounds out the difficulties faced (securing dynamic, multi-vendor networks isn’t easy), while a lack of staff expertise is also cited.


Turning Points in AI and ML

When one couples the technology capabilities of AI/ML solutions with the practical ends they may evolve to serve, the potential examples multiply quickly. Think about the job of content moderator in a social media environment, which requires not only discrete judgment, but also attention to detail at tremendous speed and volume. Today, bots can screen text for certain terms and expressions. But tomorrow’s may be able to monitor sentiment, understand contexts outside the immediate content, or evaluate non-text expressions, like videos or photos. In a contact center environment, you can “trip up” a present-day bot by trying to stray from its trained area of knowledge. That’s because today’s conversational bots learn from other conversations. Tomorrow’s will learn from the world of unstructured inputs around them, as people do, so they’ll keep up with you no matter where you steer the conversation. Natural language understanding and large language models will translate that into unfettered interaction and follow up with required action that’s instantly and automatically informed by relevant data wherever it resides.


Developers Should Celebrate Software Development Being Hard

Software development is too hard for people to do who don’t enjoy software development. This is good news because it means anyone not committed will give up because they will find it too difficult to coast in. Developers are put under intense pressure to deliver quickly and to constantly learn new technology. Developers who don’t enjoy software development will give up because it's too hard. The difficulty of software development reduces the number of developers, despite it being a well-paid job with good career options. The number of good developers is small because it's easier to be a bad developer than a good developer. ... If you are a developer who enjoys software development, take a moment to thank the software gods. Low code software development will increase the number of developers, but it won’t increase the number of good developers because most people don’t understand how software development works. The harder development is, the fewer developers who can do it well. This makes those developers valuable.


3 Lessons Entrepreneurs Can Learn From The Rise and Fall of History's Biggest Companies

The second lesson is that entrepreneurs can still beat out larger companies even if they lack the same connections to power. History shows that "right" can often beat "might." ... Energetic commitment and talent will beat resource-rich rivals, as long as entrepreneurs pick their fights wisely. There are two reliable ways of spotting opportunities to do so. First, as companies get bigger, even well-managed ones must leave opportunities on the table — market segments or product opportunities too small or too different for them to do well in or focus on. These often provide windows of opportunity for small players. Today's small markets can become tomorrow's large markets. ... Finally, in assessing today's large companies, it's important to remember that their success usually came from a basic entrepreneurial achievement combined with an organizational mindset. As entrepreneurs grow their businesses, they should be mindful of the competencies they have developed and remain intent on building new ones over time. New competencies — fueled by innovation — will likely increase their trajectory in growth and value.


Is Your Wi-Fi Router in the Wrong Spot? Here's How to Tell

Routers send the signal out in all directions, so if it's left in the corner of your home, a significant percentage of your wireless coverage is being sent outside your home. That's why your best bet is to move the router to a central location to optimize the signal. Installing a router across the house from the modem may prove troublesome. It may require manually running an especially long CAT5 or CAT6 Ethernet cable under the floor or along the bottom of your walls, or enlisting the help of power line network adapters, which use your home's electrical wiring to pass an internet signal from point to point. But the improved wireless coverage will be worth it. ... Routers tend to spread their strongest signals downward, so it's best to mount the router as high as possible to maximize coverage. Try placing it high on a bookshelf or mounting it on the wall in an inconspicuous place. Search online, and you'll find lots of custom wall mounts built for specific routers, like this stick-up mount for the Eero Pro 6 mesh router. If you're struggling to find a good, elevated spot, something like that could be a great solution.
Avoid other electronics


Why data engineers are key to becoming a true digital leader

A common misconception among enterprise business leaders is that their data-driven ambitions will be realised by hiring data scientists. Data scientists are, of course, a crucial part of a data-driven business. Their ability to unearth interesting and unusual data patterns, and develop predictive and analytical models, helps to discover new solutions that can lead to positive outcomes such as cost-saving. However, data scientists are not purely driven by business goals. Instead, they are motivated by experimentation. If not managed appropriately, this can hinder data projects as data scientists search for solutions that the business may not want to implement. Data engineers, on the other hand, are responsible for translating data insights into technical and data requirements to directly meet business objectives. Unlike data scientists, data engineers are firmly focused on driving a business’s overall data strategy forward. This can include assisting with the performance of analytics projects, authorising data for different audiences, and ensuring data governance for regulation compliance.


UN to Hold Hearing on Proposed Cybercrime Treaty

The proposed treaty identifies cybercrime as any "criminal offenses committed intentionally and illegally" over IT devices. It further lists a variety of criminal activities that are deemed illegal. These include activities such as illegal access, network interference, tampering of hardware or software that results in the compromise of critical infrastructure or leak of confidential government data, among others. By identifying and clearly defining what constitutes various cybercrimes, the treaty seeks to provide a legal basis for states to prosecute potential offenders, which may range from sophisticated nation-state hackers to employees who illegally access sensitive government data. The draft proposal further spells out measures that states can adopt such as granting law enforcement agencies the right to collect data in real time, seize devices used for cybercrime activities, coordinate with intelligence agencies, as well as assist victims of various cybercrimes.


We’re a Long Way From a Passwordless Reality

A passwordless future sounds fantastic, but passwords will remain a backup authentication method until passwordless technologies mature. Few websites are currently compatible with passwordless authentication. The majority of websites will need to continue to store passwords because decades will pass before every user has the hardware and software they need to use passwordless authentication. Even in the Windows-advertised world of passwordless setup passwords still matter, particularly as a backup method. The latest Windows release breaks the Windows Hello biometrics and PIN setup that users already count on for passwordless authentication. Last September, Microsoft said commercial users of Microsoft apps and services, such as Outlook, OneDrive, and Microsoft Family Safety, could remove the password from their Microsoft accounts entirely. But, Windows 11 release version 22H2 breaks the Windows Hello authentication technology. Windows users can experience Windows Hello sign-on failures with face recognition, fingerprints, and PINs. 


How to improve your incident response plan for 2023

Many organizations are confident in the existence of their incident response plan (IRP), but they are often not entirely sure what to do with it. A threat-specific IR playbook can offer easily accessible guidance during the chaos of incident response and is a vital element of an IR plan. When a cybersecurity incident happens, you’re scrambling to understand what’s being harmed or stolen, and not knowing where to begin can exacerbate the damage. Using your playbook as a set of IR standard operating procedures (SOPs) can define the roles and responsibilities of each IR team member as well as other key stakeholders within the company and keep everyone on the same page. For instance, the IR team will determine that passwords need to be changed during the containment of a ransomware incident, but to understand which passwords need to be changed or other required actions, they could consult the playbook for quicker resolution. These incidents call for “all hands on deck”, but for things to run smoothly, everyone must know their individual roles and the roles of others, including who the critical point of contact for each workstream is.



Quote for the day:

“A real entrepreneur is somebody who has no safety net underneath them.” -- Henry Kravis

Daily Tech Digest - January 08, 2023

The best robots and AI innovations at CES 2023

Advancements in autonomous driving haven't developed as quickly as some imagined they would. However, cars are incrementally becoming smarter and smarter, with autonomy seemingly just over the horizon. Case in point: Peugeot, Stellantis's French automobile brand, unveiled the Inception Concept car, an electric vehicle demonstrating what a car can be, once you do away with the steering wheel, get comfortable and let the vehicle get to know you a little. ... While autonomous cars are still in development, other market-ready autonomous mobility tools were on display on CES. The company Evar was at the conference with Parky, an autonomous EV recharging robot that brings a charging station to any parking spot. It's designed for building owners that want to make their parking spots more EV-friendly without adding electric capacity. ... The Withings U-Scan toilet bowl sensor attaches to the inside of your toilet's bowl. It includes a nutrition and metabolic urine tracker, checks pH, ketone, vitamin C levels, and more. A second tracker monitors women's luteinizing hormone for ovulation cycles. Each promise early detection of potential health issues.


Math Behind Software and Queueing Theory

Unsurprisingly, queueing theory is a branch of mathematics, focused on studying and describing queues (or, in more professional terms, lines). The whole theory is all about how lines are created, how they behave, and, most important, how and why they malfunction. It is one of these branches of mathematics which are useful in real life; e.g., it can be used in many branches of industry. ... Basically, we can treat most of the systems like a queue so users send requests, the request process, and the response return to the user, or when the system is too busy to process the request right away, the request waits until some arbitrary timeout is reached or it will be processed. The real problem is to correctly identify the class of the system we are working on. In most cases, it will be the variation of M/M/c or Mx/m/c. Unfortunately, it can result in our calculations not being very in line with real life. As long as we are taking care of long-term average system performance then M/M/c is an appropriate description and most of the inconsistencies should be kept in line with averaged results.


SpiderLightning: Making WebAssembly cloud applications portable

A key element of this extensibility is the WebAssembly Component Model. Defined by the WebAssembly working group as the Wasm equivalent of an OS process model, it’s the foundation for how WASI implements its interfaces. A key element of any low-level approach like this is an interface definition language, which provides a way to specify how interfaces interact with code. For Wasm, and especially for the Component Model, the standard IDL is wit, which gives us a concise and human-readable way of defining interfaces that are expanded into WebAssembly code. To use WASI to build distributed applications, we need a set of extensions that lets us abstract provider-specific services as interfaces. Instead of having to use separate APIs for S3 on AWS and Blob storage on Azure and the code to manage them, we could have a single storage component that would provide a common set of interfaces on all platforms, with the underlying WASI instance managing service-specific implementations.


Attackers create 130K fake accounts to abuse limited-time cloud computing resources

Researchers refer to the abuse of free offers as freejacking, and the creation of accounts that incur charges and then are never paid as "play and run." The latter is more difficult to pull off because most service providers require the user to register a valid credit card or payment method before giving them access to paid-for computing resources. However, even if usage is tracked and charged on a per-minute basis, the bill is usually issued after a longer period. This gives attackers a time window to abuse such services. ... "The infrastructure architecture employed by the actors uses CI/CD techniques, in which each individual software component of an operation is placed within a container," the researchers said. "This container operates within a modular architecture within the larger mining operation. CI/CD architectures provide highly modular operational environments, allowing some components of an operation to fail, be updated, or even be terminated and replaced, without affecting the larger environment." Not all the containers are used for cryptomining. 


How to Get the Best Cyber-Insurance Deal

The first step in obtaining affordable cyber insurance is finding a broker who is well-versed in coverage terms and has access to several different insurance markets, says Mark Dobrow, a vice president in the insurance brokerage division of Segal, a human resources and employee benefits consulting firm. “Market knowledge and experience is limited due to the relative newness of the product as compared to the long history of standard property coverages,” he explains. “The right broker can tailor the coverage to your needs and should know which markets are best for a particular situation.” ... The biggest mistake cyber-insurance applicants make, Aiello says, is paying poor attention to detail. “Businesses must ensure technology is being deployed in line with the insurance firm's conditions, otherwise insurers can attempt to get out of paying a claim if the technology was not ‘properly implemented’,” he warns. Unfortunately, the language used in cyber-insurance policies isn't always consistent between providers. 


Southwest Airlines: ‘Shameful’ Technical Debt Bites Back

It’s been an open secret within Southwest for some time … that the company desperately needed to modernize its scheduling systems. … This problem — relying on older or deficient software that needs updating — is known as incurring technical debt [and it] appears to be a key factor in why Southwest Airlines couldn’t return to business as usual the way other airlines did after last [month’s] major winter storm. When hiccups or weather events happen, the employees have to go through a burdensome, arduous process … because Southwest hadn’t sufficiently modernized its crew-scheduling systems. For example, if … their flight was canceled … employees have had to manually call in to let the company know where they are [sometimes] being left on hold on the phone for … hours just to let the company know their whereabouts. … Online forums are full of employee accounts of such misery. … This can easily cascade to a systemwide halt. … Such breakdowns resulting from technical debt are often triggered by external events, like weather. … So why didn’t Southwest simply update its software and systems?


Top 3 trends experts predict to hit software development in 2023

While hackers are typically associated with cyberattacks, many of them also have a “broad, practical skillset” that can make them useful for parts of software development. That’s according to Alex Rice, the co-founder and CTO of HackerOne, which connects businesses with penetration testers and cybersecurity researchers. Rice believes that both hackers and external code reviewers will become a more integrated part of the software development processes in 2023, as more organisations adopt security reviews into their development process. “As the value of DevSecOps (development, security and operations) increases, we’ll see the line between hackers and developers blurring as hackers with development expertise become a core element of the software development processes,” Rice said. “There’s a lot of value hackers can bring when it comes to catching security risks earlier rather than later.” Earlier this year, Irish start-up Noloco raised $1.4m in seed funding for its platform, which lets companies build internal tools, portals and apps without writing a line of code.


Blind Eagle APT Hunts Banking Victims in Colombia, Ecuador

Based on Trend Micro's report, the APT is traditionally known to leverage publicly available remote access tools and Trojans such as njRAT, imminent monitor, ProyectoRAT, Warzone RAT, Async RAT, Lime RAT, Remcos RAT and BitRAT. Over time, the APT switches from one RAT to another. Continuing that trend, Blind Eagle is now using a modified version of the QuasarRAT, Check Point researchers say. The attack begins with phishing emails containing a booby-trapped link that deploys a Trojan named Quasar RAT. The APT used a geo-filter server in one campaign that redirects requests made from outside of Ecuador and Colombia to the website of the Ecuadorian Internal Revenue Service, suggesting the APT's targeting focus. The campaign not only drops a RAT but also employs a more complex infection chain. It abuses the legitimate mshta.exe binary to execute VBScript embedded in an HTML file to ultimately download two Python scripts, which adds a new stage in the infection chain. The first of the two, ByAV2.py, is an in-memory loader that runs a Meterpreter payload in DLL format.


What is Cython? Python at the speed of C

Enter Cython. The Cython language is a superset of Python that compiles to C. This yields performance boosts that can range from a few percent to several orders of magnitude, depending on the task at hand. For work bound by Python’s native object types, the speedups won’t be large. But for numerical operations, or any operations not involving Python’s own internals, the gains can be massive. ... Note that Cython’s approach is incremental. That means a developer can begin with an existing Python application, and speed it up by making spot changes to the code, rather than rewriting the whole application. This approach dovetails with the nature of software performance issues generally. In most programs, the vast majority of CPU-intensive code is concentrated in a few hot spots—a version of the Pareto principle, also known as the “80/20” rule. Thus, most of the code in a Python application doesn’t need to be performance-optimized, just a few critical pieces. You can incrementally translate those hot spots into Cython to get the performance gains you need where it matters most. 


5 ways to improve security automation

One essential part of security automation that you'll likely want to tackle before anything else is monitoring. If you don't know where your issues are, you won't catch critical exposures in your environment and won't know what to prioritize for automation. The bottom line is to automate monitoring your environment, if you do nothing else. Even if you don't have the time or budget to automate remediation, you can at least target areas for manual fixes. There are many fantastic articles and products around this space (including How we designed observability for a hybrid cloud platform), from basic infrastructure monitoring to code scanning to network vulnerability scanning and more. Another thing to keep in mind is transition planning. You won't get all of this done at once, nor should you. As you figure out what areas to target first and focus your automation efforts accordingly, you will undoubtedly face challenges rolling out your new standards and processes to your environment. If you didn't set standards before, you'll be met with resistance from teams with their own priorities and commitments to the business that don't understand why you're trying to change things on them.



Quote for the day:

"Leaders are more powerful role models when they learn than when they teach." -- Rosabeth Moss Kantor

Daily Tech Digest - January 07, 2023

A Perfect Storm: 7 Reasons Global Attacks Will Soar in 2023

The Cybersecurity Venture report correctly identified the talent crunch as a reason for concern. But the problem has even deeper roots. The worldwide economic outlook continues to face stiff headwinds. Inflation, the energy crisis and supply chain issues are affecting every industry. Inflation will increase the overall cost of cyber crime as preventive and remediation costs rise. While inflation is not directly related to the number of incidents, it does impact company budget decisions. In response, some of the biggest tech brands are reducing headcounts and implementing hiring freezes. Meanwhile, security teams have been stretched thin for years. If security budgets don’t rise with inflation, security leaders will have even less buying power to implement strong security and capable teams. ... While the big, high-profile breaches fill headlines, many intruders prefer to target smaller organizations. Between 2020-2021, cyberattacks on small companies surged by more than 150%, according to RiskRecon, a Mastercard company that evaluates companies’ security risk.


How CIOs can be pillars of stability in an uncertain world

One of the guiding principles for those who would master uncertainty is to recognize that there has always been something irresistible about advice in mathematical form. Over-reliance on metrics has given rise to the term “McNamara fallacy” referring to the tragic missteps associated with the misaligned quantifications used during the Vietnam War. Instead of flailing around trying to enumerate everything that could happen, executives need to place intense scrutiny on a subset of critical uncertainties. In other words, neglect the right uncertainties. ... Finding workers might be an uncertain undertaking but retaining key performers is not. Leaders have it in their power to know what their high performers are thinking. For these key employees it is possible to paint reasonably clear pictures of what happens next. Mike McSally, a human capital advisor with 20-plus years of experience in executive recruiting, does not believe recruiting has to be a problem. Reducing talent uncertainty is a simple matter of managing personal networks.


14 Cybersecurity Best Practices to Instill In Your End-Users

Employees should have no choice but to comply with the password policy rules of your organization. With Specops Password Policy, for instance, organizations can enforce length and complexity requirements to ensure that their password is as strong as possible while blocking over 3 billion known breached passwords. ... To further secure end-user accounts, the implementation of multifactor authentication (MFA) should be mandatory for end-users logging into work apps, or making a change like resetting their passwords. When it comes to the MFA process, the more ways you can verify your identity when logging in, the harder it is for someone to steal your information. ... Another best practice pertaining to account information is to encourage employees to lock their screens when they’re not around. Leaving screens unlocked increases the risk of someone viewing or accessing sensitive data. ... To start, all new purchases should come directly through the IT department. IT is responsible for not only setting up the employee on the company’s network, but also for making sure the computer is properly equipped with security and OS or system support. 


Transformational Inertia: Why So Few Digital Transformation Projects Succeed

Key to success is a company’s ability to embrace change and for the staff at all levels to reframe the transformation as something they are an owner of and a strategic investor in, rather than it being something that is happening to them. This often requires a major change in company mentality and behavior. Altering the attitudes towards transformation in this manner can help the staff to challenge assumptions and redefine problems in an attempt to identify alternative strategies and solutions that are very likely not apparent to the leadership of the transformation. Adopting the idea that everyone is leading the transformation, and has the opportunity to be an active contributor to it, is the objective. This requires promoting psychological safety and open communication as a cornerstone of company culture. Close collaboration and constant, effective communication with all parties can ensure the success of any given initiative, most significantly, digital transformation. This communication ensures that respect is granted to all members of the company and that they are supported throughout the transformation process.


Why remote and hybrid work could fuel cyber attacks in 2023

Attackers will lean more on their powers of persuasion than on their malware kits as they step up social engineering attacks in the cloud … a single fake social media profile, leveraged in the right way, can allow a threat actor to impersonate a trusted vendor,” said Morey Haber, chief security officer at Boston-based security firm Cybereason. “The threat actor will persuade victim after victim to divulge secrets or act in other ways contrary to their interest or that of their employer. The Lapsus$ [ransomware] group used social media to become an employee and then spoof access by calling a support helpdesk.” In March, the UK police arrested seven people, including a teenage boy, following a series of online attacks by the Lapsus$ hacking group that hit major technology companies, including Okta and Microsoft. Lapsus$ has publicly taunted its victims, leaking their source codes and internal documents. It has reportedly gone as far as to join the Zoom calls of companies they’ve breached, during which they have taunted employees and consultants trying to manage the hack. The group has claimed to breach companies such as Samsung, Vodafone and Ubisoft.


Life as a CISO: Challenges, certifications, and more

We all struggle with information overload. It’s hard to organize and prioritize the firehose of information—not only external information from intelligence feeds and news sources, but also internal problems, concerns, or tasks. Humans are not able to multitask well. Structuring how you process information, prioritize things, and stay on top of key elements is critical for your success. One of my mentors said, “look back from quarter to quarter at what you’ve done successfully and do more of those things. Be sure to cover yourself in the areas that will really affect your business. Those other things that won’t keep you up at night? Leave them behind or at least wait until they bubble up to the front.” ... In engineering, there are “first principles,” meaning you can deconstruct any problem if you understand the basic building blocks. The same concept applies to cyber security. Working with big frameworks, such as the National Institute of Standards and Technology (NIST) or the International Organization for Standardization (ISO) standards, helps you organize and effectively prioritize what you’re doing.


From Ferrari to Ford, Cybersecurity Bugs Plague Automotive Safety

Even though security vulnerabilities have been an issue in the industry for some time (going back to Charlie Miller and Chris Valasek's infamous 2015 Jeep hack detailed at Black Hat USA), automakers have been slow to recognize the potential severity of the developments, says Gartner automotive industry analyst Pedro Pacheco. He explains that as automakers transition into becoming software developers, they are struggling to address all points of that development cycle — including security. "One very simple notion is if you're not good in software, you're probably not going to be very good in making that software safe," he says. "That is guaranteed." From his perspective, automakers are also too complacent when it comes to addressing and patching security vulnerabilities right away. "Automakers look at this in a more reactive way than a proactive way, basically saying we'll address the small number of customers affected and solve the issue and then everything goes back to normal," he says. "That's the way of thinking for many carmakers."


Laid Off by Big Tech? Cybersecurity is a Smart Career Move

For IT professionals recently laid off from big tech jobs, the move to cybersecurity can feel like a strange shift. Consider a software engineer or application developer out of a job and looking for new opportunities. They may bypass infosec openings simply because they’re not sure security would be a good fit. They’re not wrong. While cybersecurity is on the same spectrum as other IT opportunities, it comes with a different approach. Conflict rather than consistency is at the heart of these protective positions. Despite its significant departure from other roles, it offers a unique opportunity for growth. Put simply? Having an adversary fuels innovation. Instead of working on projects with a consistent path between point A and point B, cybersecurity staff must be ready to respond at a moment’s notice. Even as they’re busy implementing strategies and solutions to detect attackers earlier and mitigate malware impacts, they’re also the first line of defense against attacks in progress. ... As one digital door closes, however, another opens. And strangely enough, it’s one that sees technology experts finding ways to keep network doors shut tight against potential attackers.


What it takes to succeed as a CIO today

You’ve got to have leaders who can articulate the digital vision, be that ‘tech whisperer’ to explain to senior executives your journey into the future, and then you need to be able to properly manage the change management initiative — or all your great strategies won’t deliver their promised value. Another big skill set that’s absolutely required is financial and business acumen, because you need to be able to explain to people the value that will be created. Yes, you need to know technology, but, boy, you need to be a leader that can get things done quickly in a commercially sound manner, creating a lot of value and articulating not only the business model but the overall strategy for the organization. That means you also need to understand all the global forces, and you need to understand the pulse and the heartbeat of the organization from a cultural perspective. ... In addition to financial acumen, what many CIOs need if they aspire to be a CEO is desire for the role, and a kind of toughness, because being a CEO can be a lonely job. You’ve got to make some really tough choices. It’s less a collaborative team sport than the CIO position. 


From School Dropout to CEO: Advice for Creative Entrepreneurs

Entrepreneurship is not for the faint of heart: New problems, scary unknowns and intriguing (but distracting) opportunities will challenge you every day. And you'll second-guess yourself every step of the way while others rely on you to make decisions. People will rely on you to make the right decisions — and they expect you to do it with a degree of confidence, whether you have any or not! Movies love to depict entrepreneurs with automatic access to lavish parties, luxury cars and a golden ticket to Silicon Valley. In this case, life doesn't imitate art. Entrepreneurship includes many struggles. And if you're lucky, and your company begins to grow, your struggles grow as well. In fact, you can compare entrepreneurship to parenting. Some of the most difficult, challenging and stressful moments in life involve raising a child. The bigger the child, the bigger the mess, right? It often feels like an uphill battle trying to keep the house clean. But parenting is also magic. It includes some of the most moving and memorable moments of your life. Parents and entrepreneurs often find themselves in high-pressure situations, managing unique personalities and getting zero credit.



Quote for the day:

"Leadership is the creation of an environment in which others are able to self-actualize in the process of completing the job." -- John Mellecker

Daily Tech Digest - January 06, 2023

2023 could be the year of public cloud repatriation

High cloud bills are rarely the fault of the cloud providers. They are often self-inflicted by enterprises that don’t refactor applications and data to optimize their cost-efficiencies on the new cloud platforms. Yes, the applications work as well as they did on the original platform, but you’ll pay for the inefficiencies you chose not to deal with during the migration. The cloud bills are higher than expected because lifted-and-shifted applications can’t take advantage of native capabilities such as auto-scaling, security, and storage management that allow workloads to function efficiently. It’s easy to point out the folly of not refactoring data and applications for cloud platforms during migration. The reality is that refactoring is time-consuming and expensive, and the pandemic put many enterprises under tight deadlines to migrate to the cloud. For enterprises that did not optimize systems for migration, it doesn’t make much economic sense to refactor those workloads now. Repatriation is often a more cost-effective option for these enterprises, even considering the hassle and expense of operating your own systems in your own data center.


How Cyber Pathways Can Help Your Career

The Cyber Pathways Framework will introduce chartered standards that align with 16 cybersecurity specialties. These job roles that have, until now, been loosely defined will be given specific descriptions and linked to existing qualifications and certifications to see the establishment for the first time of minimum requirements, as called for by the DCMS in its Understanding the cyber security recruitment pool report. On the plus side, this will set a bar to achieve certain roles, helping to standardize role requirements. This could prove helpful in the current climate where the demand for talent is leading to job creep, with job descriptions containing myriad skillsets. And it could prove fundamental in stopping the current job hopping that we’re seeing. But it will also see roles become more rigid, and given that the sector has always grown organically, there will need to be some provision made for the evolution of new roles as and when needed, such as ones involving AI and DevSecOps. Another key pathway proposal is the creation of a register for cybersecurity practitioners, similar to that seen in the medical, legal and accountancy professions, for senior positions.
 

The Cloud Computing Boom: A Test for Database Companies

The threat of the cloud also resonated with Shoolman, who said that “the cloud is all over”. For instance, a lot of Oracle’s business has been taken by cloud service providers. ... More importantly, he says, there is a change in the top five: what was dominated by the likes of IBM, SAP, and Oracle is now highly dominated by AWS, Azure, GCP, etc. The rest 20%, he says, is occupied by ISVs like Redis, MongoDB, and others. All of the big-tech cloud providers have come up with data services similar to those provided by these independent vendors to cater to their business needs. But, recognising that despite being their competition, ISVs have to depend on cloud platforms too to host their services, MongoDB said, “We are in a love-hate relationship with our cloud partners”. When Shoolman was asked if he sees more hyperscalers like AWS, Azure, and GCP coming up in future to meet organisation demands for massive scaling in computing, he said that we are indeed seeing a trend of developing more and more data centres since organisations intend to bring data much closer to the user.


Ukraine War and Upcoming SEC Rules Push Boards to Sharpen Cyber Oversight

The war, along with the hybrid work models that have been put in place at many companies as a result of the pandemic, prompted corporate directors to carefully consider how their companies might be exposed to cyber risks, said Andrea Bonime-Blanc, chief executive of GEC Risk Advisory LLC, a New York-based firm that advises boards and executives about cybersecurity and risk management. Board awareness of cybersecurity “was already increasing glacially, but I think the Ukraine war has sharpened the minds,” Ms. Bonime-Blanc said. Some boards now rate cyber threats on a par with trade wars and supply-chain problems among risks that could have major impact on companies, said Michael Hilb ... A communication gap between boards and security chiefs means neither side is as effective as needed to govern cybersecurity, said Yael Nagler, chief executive of Yass Partners, a consulting firm focused on aligning security leadership. Directors sometimes fail to understand core threats, Ms. Nagler said. “They’re not shy people but when it comes to cyber, they feel like they’re asking dumb questions,” she said.


Pro Coders Key to Stopping Citizen Developer Security Breach

Another Forrester prediction that may directly impact developers is their forecast that enterprise business leaders, not IT, will direct more than 40% of the API strategies. That goes against conventional wisdom that IT drives the API strategy, Gardner noted. “APIs have transcended from being just pure application or infrastructure APIs. There [are] now business APIs, there [are] ones that take advantage of data and take advantage of transactions, and essentially, enable the data economy,” he said “It’s not an IT conversation anymore. IT will make sure it stays secured and locked down and make sure that it’s tightly woven with everything else, but the business leader decides which ones are the most beneficial.” API strategy is even becoming a board-level topic, as board members and C-level leaders have grasped that APIs can be a central part of the business strategy, he said. That makes sense because the greatest value of APIs comes when organizations use them to create new products, business models, and channels, according to 


Today’s Software Developers Will Stop Coding Soon

Coding will never account for 100% of your time. Even junior ICs will have meetings to attend and non-coding tasks to complete. As you progress the IC ranks to senior and beyond, the non-coding work will grow. Apart from attending meetings, I’ve highlighted below a few prominent responsibilities that fall under this work. ... Begin doing this at any time, and never stop. No one is “not experienced enough” — even new hires can begin by filling in any conceptual gaps or “gotchas” they encountered while onboarding. ... Software engineering teams will always face skills gaps. You will lack some cross-functional support like a project or program manager, product designer, etc. As such, you may need to develop the skills of an adjacent role, like project management, to set deadlines and perform other duties associated with overseeing a project’s completion. ... As you gain experience no your team, you’ll be asked to onboard new hires including mentoring junior devs. Being a mentor will improve your communication skills and bolster your promotion packet.


Can the world’s de facto tech regulator really rein in AI?

The AI Act may also run into enforcement challenges. The regulation will apply mainly to companies or other entities developing and designing AI systems — not to public authorities or other institutions that use them. For example, a facial recognition system could have vastly different implications depending on whether it’s used in a consumer context (i.e., to recognize your face on Instagram) or at a border crossing to scan people’s faces as they enter a country. “We are arguing that a lot of the potential risks or adverse impacts of AI systems depend on the context of use,” said Karolina Iwanska, a digital civic space advisor at the European Center for Not-for-Profit Law in the Hague. “That level of risk seems different in both of these circumstances, but the AI Act primarily targets the developers of AI systems and doesn’t pay enough attention to how the systems are actually going to be used,” she told me. Although there has been plenty of discussion of how the draft regulation will — or will not — protect people’s rights, this is only part of the picture. 


Why Do Ransomware Victims Pay for Data Deletion Guarantees?

Many ransomware-wielding attackers are expert at preying on their victims' compulsion to clean up the mess. Hence victims often face a menu of options: Pay a ransom for a decryptor, and you'll be able to unlock forcibly encrypted data. Pay more, and your name gets deleted from the list of victims on a ransomware group's data-leak site. Pay even more and you get a promise that whatever data they've stolen - or already leaked - will be immediately deleted. Of course, many victims will feel the impulse to do something, anything, for the illusion that they can belatedly protect stolen data and salvage their reputation. That impulse is understandable. But it's not only too late, but also being used against them by extortionists. Psychologically speaking, criminals don't hesitate to find the levers that will compel a victim to act - as in, give them money. Most ransomware groups' promises are bunk, and most of all anything they guarantee that a victim cannot verify. Unfortunately, seeing victims pay for data-deletion promises isn't new. 


4 career paths for software developers on the move

One of the paths is architecture. “These roles are highly technical and are focused on designing, building, and integrating the foundational components of applications or systems,” Blackwell says. “This would include roles like technical/application architect, solution architect, or enterprise architect.” ... The move into devops is another common path for software developers. These positions are also highly technical, says Blackwell, and are focused on optimizing the tools, processes, and systems to build, test, release, and manage high-quality software in complex or high-availability environments. Devops roles include release manager, engineer, and architect. ... A third path is leadership. “Roles in this area require both good people skills and good technical skills,” Blackwell says. “And each, in their own way, is responsible for ensuring that teams have what they need to succeed, whether technical, process, tools, or skills.” Roles on the leadership path include scrum master, technical project manager, product manager, technical lead, and development manager.


A Skeptic’s Guide to Software Architecture Decisions

The power of positive thinking is real, and yet, when taken too far, it can result in an inability, or even unwillingness, to see outcomes that don’t conform to rosy expectations. More than once, we’ve encountered managers who, when confronted with data that showed a favorite feature of an important stakeholder had no value to customers, ordered the development team to suppress that information so the stakeholder would not "look bad." Even when executives are not telling teams to do things the team suspects are wrong, pressure to show positive results can discourage teams from asking questions that might indicate they are not on the right track. Or the teams may experience confirmation bias and ignore data that does not reinforce the decision they "know" to be correct, dismissing data as "noise." Such might be the case when a team is trying to understand why a much-requested feature has not been embraced by customers, even weeks after its release. The team may believe the feature is hard to find, perhaps requiring a UI redesign. 



Quote for the day:

"Effective team leaders realize they neither know all the answers, nor can they succeed without the other members of the team." -- Katzenbach & Smith

Daily Tech Digest - January 05, 2023

Singh calls herself a business information security partner, but the title most commonly employed for this role is business information security officer (BISO). People in these roles are responsible for one or more areas of the business and they usually report to the CISO or CTO, based on job descriptions found online and those laid out by multiple sources interviewed for this article. The people holding these roles also come from diverse educational and experiential backgrounds, at the core of which are strong familiarity with compliance regulations, solid cybersecurity foundations, and business acumen. ... Renee Guttmann, who’s been CISO to several Fortune 50 companies, says that the most important thing she looks for in a BISO is a thorough understanding of the business unit they support, which includes identifying the company’s “crown jewels”: what the most important assets are, where they are, and the targeted attacks to which they are potentially vulnerable. The BISO should be able to identify the risks and work with others, such as architecture and infrastructure managers, to prioritize risks.


DevOps: 3 steps to plan and execute a successful project

The preliminary stages of a DevOps project are crucial. Without clear direction and a shared understanding across the team, the initiative is doomed to failure. The team and the client must therefore be willing to dedicate the time necessary to understand each other’s goals and ensure their visions align. This can be done through meetings and workshops, where participants identify objectives and team members establish a clear goal for how the final product should look. When executed correctly, the DevOps team will exit the project’s first phase with a well-defined brief and a clear understanding of the client’s goals. If this step is rushed, engineers will be hindered by a lack of direction, increasing the likelihood that the finished product will not meet the client’s requirements. ... Phase two is when the development of the app begins. This is usually facilitated by using a cloud-based solution, where the team begins preparing the environment’s aesthetic, working out the components it should contain, and understanding how they should be configured to maximize efficiency.


5 Key Kubernetes Trends to Follow in 2023

Multi-cluster Kubernetes is important because it makes it feasible to separate workloads using not just namespaces, but entirely distinct clusters. Doing so provides more security and performance protections than you can get using namespaces, which offer only virtualized segmentation between workloads. As a result, multi-cluster Kubernetes makes Kubernetes more valuable for use cases that involve very stringent security requirements, or where it's critical to avoid the "noisy neighbor" problems that can happen when multiple workloads share the same hosting infrastructure. ... No one has ever accused Kubernetes of being an easy platform to use. On the contrary, you'll find plenty of warnings on the internet that Kubernetes is "hard," or even "damn complicated." But you could have said the same thing about Linux in the 1990s, or the Amazon cloud in the mid-2000s, when those platforms were new. Like other major technologies that preceded it, Kubernetes is still growing up, and there remains plenty of room to improve it by improving the platform's usability.


Moving Beyond Security Awareness to Security Education

“Unlike awareness, application security education is based on central principles or ‘big ideas’. If key security concepts are part of a continuous and programmatic education initiative, development teams can learn to apply knowledge, skills, and experience to novel situations and better secure applications,” said Baker. When application security principles are understood, developers can then not only identify when code isn’t quite right or spot something that creates risk, but also effectively design against it. “Awareness doesn’t go far enough for security-critical roles such as software developers, product and UX managers, quality assurance and scrum masters who are all responsible for delivering safe applications,” said Baker. “What’s needed is deeper education, and there are several ways that this can be incorporated into the awareness training mix.” First and foremost, Baker stated, the concept of continuous and programmatic security education—and why it matters for security-critical roles—requires buy-in from everyone within the organization. 


Blow for Meta: must stop serving personalised ads until it's GDPR compliant

According to nyob, ten confidential meetings took place between Meta and the DPC during the course of the proceedings, over which time the DPC came down on the side of the company and its bypassing of the standard GDPR rules for consent. Schrems has launched multiple successful legal campaigns against technology companies and their misuse of personal data. He said: "This case is about a simple legal question. Meta claims that the 'bypass' happened with the blessing of the DPC. For years the DPC has dragged out the procedure and insisted that Meta may bypass the GDPR, but was now overruled by the other EU authorities. It is overall the fourth time in a row the Irish DPC got overruled." Schrems claimed the DPC had refused to release the details of the decision to nyob and accused the regulator of playing "a very diabolic public relations game". He added: "By not allowing noyb or the public to read the decision, it tries to shape the narrative of the decision jointly with Meta. It seems the cooperation between Meta and the Irish regulator is well and alive - despite being overruled by the EDPB"


What is data ingestion?

At its simplest, data ingestion is the process of shifting or replicating data from a source and moving it to a new destination. Some of the sources from which data is moved or replicated are databases, files or even IoT data streams. The data moved and/or replicated during data ingestion is then stored at a destination that can be on-premises. ... Data ingestion uses software automation to move large amounts of data efficiently, as the operation requires little manual effort from IT. Data ingestion is a mass means of data capture from virtually any source. It can deal with the extremely large volumes of data that are entering corporate networks on a daily basis. Data ingestion is a “mover” technology that can be combined with data editing and formatting technologies such as ETL. By itself, data ingestion only ingests data; it does not transform it. For many organizations, data ingestion is a critical tool that helps them manage the front end of their data and data just entering their enterprise. A data ingestion tool enables companies to immediately move their data into a central data repository without the risk of leaving any valuable data “out there” in sources that may later no longer be accessible.


The Most Futuristic Tech at CES 2023

TCL's RayNeo X2 AR glasses are available for demo at CES 2023, and CNET's Scott Stein was able to use them to translate a conversation with a Chinese speaker in real time. The frames on the RayNeo X2 AR glasses are slightly bulkier than regular eyeglass frames, but prescription inserts eliminate the need to wear other glasses underneath, and the expected introduction of Qualcomm's AR1 chipset should reduce the size further. The RayNeo X2 AR glasses will be released to the developer community at the end of the first quarter of 2023, with a commercial launch set for later in the year. ... One of the more unusual prototypes shown at CES 2023 is a wearable neckband from a Japanese startup company called Loovic. The device hangs around your neck, sort of like studio headphones when not in use, and provides audio and tactile directions to help you navigate without looking at your phone. The device was inspired by Loovic CEO Toru Tamanka's son, who suffers from a cognitive impairment that makes following directions difficult. It will work for anyone who wants to receive navigation while keeping their head up. 


Kubernetes must stay pure, upstream open-source

Vendors may modify code for their custom distributions or the supporting applications you need to make Kubernetes run in production. While a modified version of Kubernetes will work with a particular vendor’s application stack and management tools, these proprietary modifications lock you into customized component builds preventing you from integrating with other upstream open-source projects without lock-in. And if their stack comprises multiple products, it’s very hard to achieve interoperability, which can cause lots of downstream issues as you scale. ... It’s incredibly difficult to merge back a fork that has diverged drastically over the years from the upstream. This is called technical debt – the cost of maintaining source code caused by deviation from the main branch where joint development happens. The more changes to forked code, the more money and time it costs to rebase the fork to the upstream project.


Managing Remote Workforces: IT Leaders Look to Expanded Suite of Tools

Ramin Ettehad, co-founder of Oomnitza, says organizations must connect their key systems and orchestrate rules, policies, and workflows across the technology and employee lifecycle, not with tickets and manual workloads, but rather with conditional rule-based automation of all tasks across teams and systems. He notes an example of a key business process that is challenged in a remote working world is employee onboarding and offboarding. “Companies want to make a positive first impression by offering new employees a consumer-esque onboarding experience,” he says. “This effort will maximize employee experience and time to productivity.” From the perspective of Dan Wilson, vice president analyst in the Gartner IT practice, some key tech tools for remote workforce management include remote Control for IT support to remotely see and interact with computers, as well as Unified Endpoint Management (UEM). “UEM lets IT departments discover, manage, configure devices, and deploy software and operating system updates without having to connect to the corporate network or VPN,” he explains.


Social Engineering Attacks: Preparing for What’s Coming in 2023

Impersonation and comment spam have exploded over the past year and will likely be some of the most prominent forms of phishing in 2023. This type of social engineering attack exploits the trust and recognition associated with influencers. Attackers create an account on a social media site that looks nearly identical to an influencer’s. The posts are often giveaway announcements, declaring that fans just need to “click this link” or “DM this account on Telegram” to collect their winnings. Instead, people are tricked into giving away money and are ghosted by the fake account. Impersonation and comment spam have become so serious on YouTube that prominent creators have asked the platform to address the issue. The scam results in monetary theft and hurts the reputation of the creators being impersonated. ... One peculiar new form of social engineering on the rise is reputation ransomware. This scare tactic exploits the headline nature of data breach announcements. The cybercriminal will demand ransom from the victim organization, threatening to “leak” news of a fictional data breach if they do not pay.



Quote for the day:

"Without continual growth and progress, such words as improvement, achievement, and success have no meaning.” -- Benjamin Franklin