Daily Tech Digest - October 22, 2023

The AI Evolution Will Happen Faster Than Computing Evolution

Compute will still evolve, but how fast is the question? The Internet led to the massively distributed data center approach, which we know as the cloud, a terrible term, but I digress. But today the power of computing can only increase so much. Moore’s Law looks increasingly impossible to keep pace with as we develop transistors the size of an atom. Infrastructure limitations are causing all sorts of headaches for software vendors who now face a litany of options for maximizing AI systems to be more efficient with precious compute resources. ... It’s all about the data and its compounding growth. Having transition data ready and analytic, too, with speed and efficiency, makes for the ability to scale AI systems. As we’ve seen, AI systems must be fast and SingleStore markets that capability with its in-memory and disk capabilities. There’s also the flexibility that customers demand — a hybrid approach that cuts across cloud services and on-premises. With SinglStore vector indexing and JSON handling, the capabilities opened further. 


Preparing for the Shift to Platform Engineering

To effectively support the transition, leaders must commit to a culture of platform engineering. Simply adopting technology isn’t enough. It needs to be backed by a thorough strategy that allows developers to truly benefit from the tools and structures of platform engineering. What does this look like? Success requires leaders and developers to encourage collaboration and break down silos between operations and development teams. It’s possible to build a bridge between developers and operations by committing to cloud migration, creating a centralized platform and investing in collaborative tools and the strategy to back it up. To engage in platform engineering requires dedication to a collaborative culture instigated from the top, empowered by overall strategic decisions and operations. This includes continued learning for developers to stay on top of new languages, trends, challenges and priorities, internally and externally. Teams are more successful when they utilize performance metrics to track workflows that help them conduct effective maintenance and improve on a consistent and ongoing basis.


Data Governance in action: the CDO, the CISO and the Perks of collaboration

Maintaining independent reporting structures for the CDO and CISO, separate from the Chief Information Officer (CIO), is crucial. That’s because when they report directly to the executive leadership or the CEO, they can provide independent updates on data governance and cybersecurity, ensuring clarity and objectivity in decision-making for critical data-related matters. Due to this arrangement, senior management will have a holistic view of risk management, compliance, and strategic decision-making, without any biases that may arise from reporting to the CIO. Biases, in this context, can manifest in several ways. For example, a CIO might prioritise IT initiatives that align with the department’s goals or budget constraints, potentially overlooking or downplaying certain data governance or security concerns. Hence, this hierarchical reporting structure, with the CIO in the middle, can unintentionally filter or influence the information that reaches senior management, which could impact their ability to make well-informed, impartial decisions.


North Korean hackers are targeting software developers and impersonating IT workers

Diamond Sleet was observed using two attack paths: the first consisted in the deployment of ForestTiger backdoor while the second deployed payloads for DLL search-order hijacking attacks. Onyx Sleet used a different attack path: After successfully exploiting the TeamCity vulnerability, the threat actor creates a user account (named krtbgt), runs system discovery commands and finally deploys a proxy tool named HazyLoad to establish persistent connection. “In past operations, Diamond Sleet and other North Korean threat actors have successfully carried out software supply chain attacks by infiltrating build environments,” Microsoft noted. North Korean state-sponsored hackers have been linked to a social engineering campaign targeting software developers through GitHub. By pretending to be a developer or a recruiter, the attacker managed to convince the victim to collaborate on a GitHub repository and ultimately download and execute malware on its device.


Five key questions about disaster recovery as a service

Almost any organisation can use DRaaS because it requires little in the way of hardware or up-front investment. However, its use is most common in organisations that want to minimise downtime, but cannot justify investment in redundant hardware, either on-premise or in a datacentre or colocation facility. This is likely to involve a trade-off between performance and recovery times, and cost. DRaaS that runs in the public cloud will be slower than dedicated systems, but it will still be faster to recover from than basic cloud-based backup or BaaS. Another application for DRaaS is where conventional DR systems are less practical. This includes branch and remote offices that may have lower bandwidth connections and little in the way of on-site IT support. There is also a trend towards use of DRaaS to provide resilience for cloud-based infrastructure. Such cloud-to-cloud disaster recovery can range from replicating entire cloud production environments or specific VMs to a secondary cloud location, to providing additional redundancy and continuity for SaaS applications and even Microsoft 365.


Blue-Green Deployment: Achieving Seamless and Reliable Software Releases

In order to reduce risks and downtime when releasing new versions or updates of an application, blue-green deployment is a software deployment strategy. It entails running two parallel instances of the same production environment, with the “blue” environment serving as a representation of the current stable version and the “green” environment. With this configuration, switching between the two environments can be done without upsetting end users. without disrupting end-users. The fundamental idea behind blue-green deployment is to automatically route user traffic to the blue environment to protect the production system's stability and dependability. Developers and QA teams can validate the new version while the green environment is being set up and thoroughly tested before it is made available to end users. ... The advantages of blue-green deployment are numerous. By maintaining parallel environments, organizations can significantly reduce downtime during deployments. 


Shaping the Future of Hybrid Quantum Algorithms for Drug Discovery

One of the main challenges of drug discovery is simulating the interaction between molecules to, for instance, predict the potency of a drug. Accurately simulating the behavior of a single molecule is tricky since the number of possible interactions with other molecules skyrockets as you increase the overall number of molecules. Computer-aided drug discovery has been around for about 40 years. However, due to limited computational powers, the first software packages had to simplify the physics and depended a lot on experimental validation—which is, to this day, a lot of trial and error. As the computational power of computers increases, and as physics models become more and more complex, we’ll be able to run more accurate simulations that not only spare us a lot of experimental testing but also allow us to develop entirely new drugs. Simplistic models haven’t previously tapped a vast chunk of the chemical search space. Quantum computing is still very early, and quantum computers have yet to demonstrate a practical advantage over supercomputers. 


A technology lawyer suggests how artificial intelligence can benefit every Indian tangibly

As impressive as AI has been so far, we are, at the time of this writing, on the brink of yet another transformation that promises to be even more dramatic. Over the past year or so, remarkable improvements in the capabilities of large language models (LLMs) have hinted at a new form of emergent ‘intelligence’ that can be deployed across a range of applications whose full scale and scope will only become evident over time. So powerful is the potential of this new technology that some of the brightest minds on the planet have called for a pause in its development out of the fear that it will lead to a SkyNet future and the genuine threat of unleashing malicious artificial general intelligence. LLMs are computer algorithms designed to generate coherent and intelligent responses to queries in a humanlike conversational manner. They are built on artificial neural networks that have typically been trained on massive data sets that allow them to learn language structure. LLMs can learn without being explicitly programmed. 


Team Topologies: A Game Changer For Your Data Governance Organization

Managing data is not only a technological task, but also an organizational one. It requires successful coordination and collaboration between different teams and stakeholders. Here, priorities, goals, and perspectives often differ, making it difficult to establish effective work processes and communication structures. Another key aspect is the clear definition of roles – such as the role of a data architect or the role of a master data manager – and their responsibilities in the context of the data organization. Without clear structures, misunderstandings and conflicts can arise, negatively impacting data management efficiency and business processes. Given these challenges, implementing effective data management and data governance practices sometimes seems daunting. However, it is a critical factor in the success of data-driven organizations, and strategies exist to overcome these challenges. One promising strategy is to apply innovative collaboration models and team structures.


Soft Skills Play Significant Role in Success of IT Professionals

A person with strong problem-solving skills typically demonstrates the ability to analyze complex issues systematically, break them down, and identify effective solutions, according to Haggarty. "They showcase critical thinking, resourcefulness, and a willingness to explore alternative approaches," she noted. "Effective problem-solvers are also skilled in evaluating potential consequences and making informed decisions." In addition, their capacity to collaborate with diverse teams also contributes to successful problem-solving in dynamic work environments. In the tech industry, networking facilitates idea exchange and exposure to diverse perspectives. Haggarty said networking is highly ranked due to its potential to foster collaboration, knowledge sharing, and professional growth. "Establishing strong professional relationships can lead to opportunities for collaboration, career advancement, and staying informed about industry trends," she said. "It can also aid with problem-solving by connecting individuals with complementary skills to address multifaceted challenges."



Quote for the day:

''If my mind can conceive it, my heart can believe it, I know I can achieve it.'' -- Jesse Jackson

Daily Tech Digest - October 20, 2023

Can anyone buy a quantum computer?

One of the primary reasons quantum computers are not readily available to the general public is their extraordinary technical requirements. These machines require an extremely controlled environment with temperatures close to absolute zero to prevent interference from external factors. Additionally, the delicate nature of qubits makes them susceptible to errors caused by even the slightest disturbances, necessitating advanced error correction techniques. Moreover, the cost of building and operating quantum computers is exorbitant. The infrastructure required to house and maintain these machines, along with the specialized equipment and expertise needed to handle them, makes them financially unattainable for most individuals or even small businesses. However, despite the current limitations, efforts are being made to democratize access to quantum computing. Some companies are exploring cloud-based quantum computing services, allowing users to access quantum computers remotely through the internet. This approach eliminates the need for users to have their own quantum hardware, making the technology more accessible to a wider audience.


The real impact of the cybersecurity poverty line on small organizations

The ‘cybersecurity poverty line’ is real! That said, I don’t believe people, processes, or technology are limiting factors because significant risk reduction is simple (technology), easy (people/process), and cheap. Bluntly, many organizations aren’t ‘brushing their teeth’ in cybersecurity. China isn’t targeting 99.9% of organizations, and ransomware isn’t advanced – things like ‘100% of people use strong MFA’ is the most cost-effective thing most organizations can do to reduce their cyber risk dramatically. ... Appreciate that Maslow’s hierarchy of needs applied to cybersecurity dictates that revenue trumps security. We have a responsibility to steward finite resources, and the fact is that most organizations can be adequately secured with a very modest budget. The limiting factor is knowledge/leadership – what to do, when, and why. ... ‘Everyone knows’ that when you are a CISO, you first do a risk assessment against a framework. This takes X months, costs Y dollars, and involves many discussions with the IT and security folks. I’d rather take a few days to talk to the various executives to understand the business and see where I can massively reduce risk while enabling the business.


Lost and Stolen Devices: A Gateway to Data Breaches and Leaks

When a computer is lost or stolen, the data it contains becomes vulnerable to unauthorized access. Despite substantial investments in endpoint security controls, devices are often not as secure as organizations would hope. This vulnerability has led to numerous high-profile data breaches over the years. ... When a computer falls into the wrong hands, unauthorized access to sensitive data becomes a real threat. Even if the device is password-protected, threat actors can employ various techniques to bypass security measures and gain access to files, emails, and other confidential information. ... Without encryption, thieves can easily access and misuse sensitive data, putting both individuals and organizations at risk. Having encryption enabled is often a legally required control, and not being able to prove its efficacy can expose an organization to liability. ... In some cases, lost or stolen computers are used as a means to gain physical access to corporate networks. If an employee’s laptop is stolen, and it contains access credentials or VPN configurations, the thief may use this information to infiltrate the organization’s network. 


Cracking the Code: Secure Software Architecture in a Generative AI World

Code vulnerabilities serve as entry points for attackers. Given the complexity of GAI models, these vulnerabilities can be nuanced. We are in the early days of using code generation to inject vulnerabilities. Now is the time to take action by keeping humans in the loop with static code analysis and code reviews. Static Code Analysis:- Conducting static code analysis(SCA) can help identify vulnerabilities in the code without running the program. This is crucial as running a program with vulnerabilities could compromise the entire system. SCA also enables compliance monitoring to standards such as Federal Information Processing Standards FIPS) and other NIST guidelines. Code Reviews:- Peer-reviewed coding practices allow for a second set of eyes to catch potential vulnerabilities, reducing the likelihood of a security breach. Make this a mandatory step in your DevSecOps process to catch and fix issues before they escalate. The intricate nature of GAI models amplifies the risks associated with code-level vulnerabilities. 


Global Chip Shortage: Everything You Need to Know

Supplies of chips began to improve in 2022, due in part to additional capacity with the slowdown in sales of PCs, smartphones and consumer electronics. Foundries in Taiwan reallocated some of this capacity to the automobile and industrial end markets, according to JP Morgan. However, automakers are increasingly requiring chips with higher computing power — especially as the industry transitions to electric and autonomous vehicles, which are significantly different from the ones used in PCs and smartphones. Other issues include tensions between the U.S. and China, which continue to impact the global supply chain. This is ” … spurring new government controls on sales of chips to China,” the world’s largest semiconductor market, the Semiconductor Industry Association noted in its State of the Industry report. There are other significant policy challenges as well, such as the ability to strengthen the U.S. semiconductor workforce by reforming the country’s high-skilled immigration and STEM education systems to increase the number of workers and help contain the talent shortage, according to the SIA.


CDO interview: Carter Cousineau, vice-president of data and model governance, Thomson Reuters

Cousineau says a key part of the work she’s undertaking at Thomson Reuters involves building the foundational elements for effective data governance. “That’s anything around applying policies and standards, and then moving those approaches into action, which involves the implementation of any controls and tools that can help, support and validate the work we’re doing in practice,” she says. .... “My approach to governance and ethics was not to build different frameworks and tools that wouldn’t be able to fit into everyone’s everyday workflows. These workflows differ greatly around the business. The way finance, for example, uses AI machine learning models is very different than product or sales,” she says. “We spent a lot of time understanding the workflows. The last thing I want to do is to make data scientists, model developers and product owners have another list of things to do. If you can make governance and ethics part of their workflows automatically, it becomes a lot easier – and we’ve done that.”


Open Source Development Threatened in Europe

European developers would stop contributing upstream to open source software projects in the event of the passage of the CRA, said Greg Kroah-Hartman, a fellow at the Linux Foundation and the maintainer of the stable branch for Linux. Furthermore, it may mean the use of Linux in Europe is untenable. ... As it stands now, the CRA burdens open source developers. It makes them liable for the open source code they share. Technologies considered “critical” face the most significant scrutiny. These critical technologies include operating systems, container runtimes, networking interfaces, password managers, microcontrollers, etc. The language may change, but it will go into the CRA unless some last-minute changes are made. The CRA calls for standards that still need to be developed. High-risk critical products like an OS would require mandatory third-party assessments. Developers must perform a cybersecurity risk assessment to ensure the product delivers without vulnerabilities. 


How to use structured concurrency in C#

Structured concurrency is a strategy for handling concurrent operations in asynchronous programming. It relies on task scopes and proper resource cleanup to provide several benefits including cleaner code, simpler error handling, and prevention of resource leaks. Structured concurrency emphasizes the idea that all asynchronous tasks should be structured within a specific context, allowing developers to effectively compose and control the flow of these tasks. To better manage the execution of async operations, structured concurrency introduces the concept of task scopes. Task scopes provide a logical unit that sets boundaries for concurrent tasks. All tasks executed within a task scope are closely monitored and their lifecycle is carefully managed. If any task within the scope encounters failure or cancellation, all other tasks within that scope are automatically canceled as well. This ensures proper cleanup and prevents re­source leaks. ... In C#, we can implement structured concurrency by using the features available in the System.Threading.Tasks.Channels namespace. This namespace offers helpful constructs like Channel and ChannelReader that make implementing structured concurrency easier.


CIOs press ahead for gen AI edge — despite misgivings

Power supply giant Generac is one company that’s all in on gen AI, says CIO Tim Dickson. “We are now fully embracing generative AI, with three innovative pilots that are live,” he says. “First, we launched a private instance of GPT-3.5 for internal enterprise exploration. Next, we launched a customer service chatbot to answer customer call questions for our customer service reps. Lastly, we tapped into our data lake to enrich and tailor specific customer emails to drive the conviction of our products and ultimately increased sales. These three programs are already delivering value for the business.” And doing so requires taking risks, he says, something he believe IT leaders must embrace to succeed today. “We are indoctrinating a culture of gen AI within the company,” he adds. Still, the widening availability of gen AI to the public at large keeps many CIOs awake at night. Few enterprises have slammed the brakes, but no doubt it has led to a high emphasis on corporate guardrails, frameworks, and shared responsibility in the C-suite.


Data Governance vs. Data Management

Data Management covers implementations of policies and procedures that do not fall under the mantle of Data Governance. Mainly, focusing on specific technologies and tools and their applications lies outside Data Governance. To understand why these Data Management activities and discussions happen outside of Data Governance, consider that Data Governance meetings mainly comprise businesspeople, councils, subject matter experts (SMEs), stewards, and partners without specialized IT knowledge. While Data Governance members want to remain informed about Data Management at a high level, they do not need the technical details. For example, Data Governance discussions may center around protecting data and creating standards around encrypting data. However, IT staff may take conversations deeper, outside of Data Governance, by discussing what encryption algorithm to use and when, how to customize it through ENCRYPT-CSA, or how big to make the critical size. By moving the technical details outside of Data Governance, organizations can focus on data-driven culture initiatives, change an organization’s approach towards data, and address other human behaviors without getting bogged down in minutia.



Quote for the day:

''The manager asks how and when, the leader aks what and why.'' -- Warren Bennis

Daily Tech Digest - October 19, 2023

Regulations are still necessary to compel adoption of cybersecurity measures

Ultimately, though, there should be clear mandates to push the industry toward clear outcomes, Rivas said. Such requirements, for example, could include a proper patch management strategy and robust monitoring system, Sondhi said. These should be accompanied by roadmaps for rollout, so market players would be given the necessary timelines to ensure compliance, he added. Acknowledging there will inevitably be pushback over concerns such mandates have on cost and time-to-market, he said regulations need not be overly complex. They also can point to accompanying standards bodies tasked to provide more details and update the adoption of best practices when necessary. This will free up governments from having to keep up with market changes and to instead focus on mandating high-level requirements, he noted. Enforcement also is a good starting point when the road toward cyber resilience may be long and fraught with complexities. Organizations in operational technology (OT) sectors, in particular, have ecosystems that have to be managed differently from IT infrastructures, Sondhi said.


Beyond The 10X Software Engineer: Focusing On The Bigger Picture

Match team responsibilities with the load they can handle. You can do with additional training, a good choice of underlying technologies, pair programming, reshuffling responsibilities among teams and strategic hiring for the critical skills still missing. For new team members, focus on tasks doable first within a four-hour time slot and then in two to three days, so they can experience repeatable success right away. With time, you can extend the average task timeline to two weeks. Make sure there's a variety of tasks of similar complexity. For example, you don't want to corner a software developer into only fixing bugs. Mix things up to challenge team members with creative tasks like minor new functionalities. Eliminate excessive bureaucracy and low-value business processes. Boring or superfluous administrative tasks are a real motivation drain, so reviewing them and removing those with low value have a visible impact. Map team competencies to task complexity. This can be done formally or informally and usually narrows down the list of competencies for each team.


The Purpose of Estimation in Scrum: Sizing for Sprint Success

In response to the limitations of hours-based estimation, Scrum Teams are turning to alternative methods such as relative estimation (using points). Alternatively, teams are increasingly using flow metrics as a simpler and often more accurate way to forecast value delivery. Relative estimation is a technique used to estimate the size, complexity, and effort required for each Product Backlog item. To use relative estimation, the Scrum Team first selects a point system. Common point systems include Fibonacci or a simple scale from 1 to five. (See our recent article How to create a point system for estimating in Scrum. Once the team has selected a point system, they create an agreement which describes which type of items to classify as a 1, 2, and so on. It is possible for the team just to use its judgment, documenting that information in their team agreements. Then, when the team needs to estimate new work, they simply compare the new work to similar work done in the past, and assign the appropriate number. 


What Enterprises Need to Know About ChatGPT and Cybersecurity

Receiving the most valuable information from ChatGPT requires asking the correct questions and expanding on the initial inquiry to obtain desired results and a deeper understanding. Hackers are learning that they cannot ask ChatGPT a directly malicious question, or they will receive a response such as, “I do not create malware.” Instead, they ask it to pretend that ChatGPT is an AI model that can execute a particular script. Bad actors continue to exploit and socially engineer the process of installing malware or getting people to relinquish credentials for unauthorized data system access. AI tools are making it easier for cybercriminals to harm people. ... One noteworthy point is that the ability to use AI to manipulate humans through social engineering is becoming increasingly controllable. However, ChatGPT is not a Rosetta Stone-like translator for hackers. Although both AI-generated scripts and social media platform scripts are made by machines, their complexity, reliability and security can differ significantly.


Weathering the Storm: A Guide to Preserving Business Continuity

Organizations that are most vulnerable to disruption tend to be those that rely on legacy systems that have a single point of communications failure. The additional risk exposure that accompanies these older networks may well justify shifting to a cloud-based network (such as SD-WAN, a software-defined wide area network) that provides the flexibility to bounce between broadband and ethernet in real time to preserve bandwidth and connectivity. Similarly, it may be worth considering moving to a unified communications platform, which is designed to maintain multichannel communications for customers and employees. ... Based on the risk assessment, create a formal, highly detailed plan specifying how your organization will manage various crisis scenarios, the tools it will use to keep the business running, and how, and by whom, information will be communicated internally and externally. The plan also should identify critical on-premises hardware and brick-and-mortar IT infrastructure (such as data centers) that must be protected, and how they will be protected. Organizations with a continuity plan already in place should revisit it at least annually and update it as needed.


Phishing emails are more believable than ever. Here’s what to do about it

Because most ransomware is delivered through phishing, employee education is essential to protecting your organization from these threats. That said, there’s no single “one size fits all” education program--these training efforts should be tailored to your enterprise's unique needs. Below are several types of services and/or programs that are designed to help users understand and detect phishing and other cyber threats, all of which can serve as a great starting point for building a comprehensive employee security awareness program. ... Delivering simulated phishing emails to your organization’s employees allows them to practice identifying malicious communications so that they know what to do when a threat actor strikes. The FortiPhish Phishing Simulation Service uses real-world simulations to help organizations test user awareness and vigilance to phishing threats and to train users on what steps to take when they suspect they might be a target of a phishing attack. ... As with the introduction of any new technology, cybercriminals will continually find ways to use these tools for nefarious purposes. 


9 Steps to Platform Engineering Hell

The platform team still works with a DevOps mindset and continues to write pipelines and automation for individual product teams. They get too many requests from developers and don’t have the time or resources to zoom out and come up with a long-term strategy to build a scalable IDP and ship it as a product to the rest of the engineering organization. ... More platform engineers are finally hired on the team, all very experienced, with years working in operations. They come together and think hard about the biggest Ops issues they experienced during their careers. They start designing a platform to fix all those annoying issues that bugged them for years, but developers will never use this platform. It doesn’t solve their problems; it only solves Ops problems. ... Because you’re a large enterprise with inefficient cross-unit communication, mid-management starts several platform engineering initiatives without aligning with each other. Leadership doesn’t intervene, efforts double, communication is not facilitated and gets progressively worse. You end up with five platforms for five teams, most of which don’t work at all.


The must-knows about low-code/no-code platforms

Low-code/no-code platforms inadvertently make it easy to bypass the procedural steps in production that safeguard code. This issue can be exacerbated by a workflow’s lack of developers with concrete knowledge of coding and security, as these individuals would be most inclined to raise flags. From data breaches to compliance issues, increased speed can come at a great cost for enterprises that don’t take the necessary steps to scale with confidence. ... Maintaining a strong team of professional developers and guardrail mechanisms can prevent a Wild West scenario from emerging, where the desire to play fast and loose creates security vulnerabilities, mounting technical debt from a lack of management and oversight happening at the developer level, and inconsistent development practices that spur liabilities, software bugs, and compliance headaches. AI-powered tools can offset complications caused by acceleration and automation through code governance and predictive intelligence mechanisms however, enterprises often find themselves with a piecemealed portfolio of AI tools that create bottlenecks in their development and delivery processes or lack proper security tools to ensure the quality of code.


What It Takes To Architect A Culture Of Cybersecurity

Just because organizations impart mandatory compliance and security awareness training to their employees does not mean employees will act securely. This is because of something called the knowledge-behavior gap. Having knowledge does not mean that people behave in a certain way. For them to transition from behavior to knowledge, they also need “acceptance” and “intent.” Think of it like the speed limit sign we consciously choose to ignore. We know the sign’s there, we know it’s against the law to exceed it, we know that speeding kills, and yet we choose to turn a blind eye. Since most organizations do not actively manage and cultivate their security culture, they assume that it does not exist in their organization. The reality is that every organization, regardless of size, has a culture. The way in which organizations and leadership teams treat, value, and manage security, influences and builds its security culture. Unfortunately, most organizations do not track the security-related aspects of their culture in its early stages and eventually, it ends up spiraling out of control and manifesting into something the organization may have difficulty reversing.
A semantic layer allows business users with little or no technical skills to access and consume data without needing to understand the underlying technical complexities. It makes data more accessible and understandable to non-technical users, enabling them to easily query, analyze, and make informed decisions based on the data. ... Integrating data into a semantic layer from multiple sources -- each with its own structure, format, and levels of detail -- can be a complex undertaking. The process of harmonizing these sources demands time and meticulous attention to detail. Creating intricate business views using precise calculations within the semantic layer presents yet another challenge. Applying complex formulas, conditional rules, and computations across multiple data sources is a grueling task. Mapping business metrics with consistency in calculations and hierarchies across diverse BI tools can be highly complicated as each tool handles it in a different manner. ... You’ll need a scalable and efficient semantic layer that is adept at collaborating with multiple BI tools. 



Quote for the day:

"Nothing in the world is more common than unsuccessful people with talent." -- Anonymous

Daily Tech Digest - October 18, 2023

Implementing an Effective Data Strategy

What challenges must a data strategy overcome: Creating a data culture? Building the data business case? Or fixing data issues? Martin Davis, CIO of Southern Company, said, “It is all of those, but it starts with data ownership. Once you have the right business ownership, you can work on the culture, the business case, and other things.” Jim Russell, CIO for Manhattanville College, claimed that with ownership established, “What most organizations are lacking are foundational skills in the workforce. As competing knowledge requirements have intensified, fewer employees seem to have data literacy or data fluency. For this reason, I’ve been pushing data literacy as a foundational requirement with expertise resulting in data fluency which means different things in different campus communities. ... Obviously, a smart data strategy comes from business and digital strategy. For this reason, Russell said, “It is important to start with a common vision that spans data products and services. With this, CIOs should help teams define vision and create clear scaffolding that overarching vision...”


The evolution of deception tactics from traditional to cyber warfare

There are many concerns when determining the next steps in responding to a cyber incident or attack that require careful navigation of ethics, further underscoring the importance of international governance and regulations. An escalatory response to a cyberattack, such as a “hack back” or “attack back,” raises legal and ethical questions if such action could lead to a larger conflict. Because cyber attackers are becoming more skilled at hiding their true identities, there is indeed cause for concern about whether a response could lead to retaliatory actions and collateral damage against innocent parties. Additionally, the intentions of the original attacker could be misidentified by the victim, leading to disproportionate or unneeded attacks. ... This necessitates a cyber defense strategy that doesn’t just block or react, but one that is also designed to seek out attackers’ motives and identities. It’s a tale as old as time in the military world—if you understand your opponent’s motives, you have the upper hand.


Developers and the AI Job Wars: Here's How Developers Win

“Software development is less about writing software and more about understanding the problem you are trying to solve,” says Louis Lang, CTO and co-founder of Phylum. “While the likes of ChatGPT and Copilot might make the writing process quicker, it has a long way to go before it can reason through a novel problem domain. Making development faster with AI only applies to scaffolding new projects and writing well-trodden code and even this seems problematic from time to time. If you try to produce something that requires deep expertise, AI will not help you.” But what jobs it does destroy, it replaces with new roles. For example, AI is itself software and as such requires developers. “With the rise of generative AI, software developers play a pivotal role in designing, building, and maintaining the underlying infrastructure that powers AI applications,” says Adam Prout, CTO of SingleStore, a cloud-native database. “Their position is vital to implementing algorithms, creating data pipelines, and optimizing models in close collaboration with data scientists and machine learning engineers. The expertise of a software developer is integral to bringing AI projects from conceptualization to real-world deployment.”


It’s time for cloud tech to meet operational tech at industrial sites

Industrial sites’ challenges can be daunting, but advances in cloud computing—particularly in security and edge computing—have come a long way. Some industrial sites are already adopting standards in site data collection, such as OPC Unified Architecture (OPC UA), a machine-to-machine communication protocol that allows control systems to exchange data securely and consistently. ... Edge computing can store a subset of data at a site, and in some cases can even provide cloud compute capabilities, thus allowing sites to continue to use cloud capabilities even if network connectivity is lost. Of course, the corresponding edge computing architectures—the amount of computing needed to store and process data before sending it to the cloud—will vary based on the size of the connectivity gap, the amount of data to be transferred, and the use of digital assets, such as sensors and recording devices. Edge computing also manages data’s return trip from the cloud to sites, making cloud-dependent, on-site applications faster and more reliable, since it reduces reliance on network connectivity.


Opportunities and Limitations of Deploying Large Language Models in the Enterprise

The progress we’ve seen in the last few months is nothing short of impressive. While natural language understanding and processing is not net-new, it’s now much more accessible. Not to mention that models have gone from 0 to 60 in terms of depth and capabilities. But, for many CIOs, the value may not be immediately obvious. Many organizations have been slashing budgets in the last year and making blind investments is not in their agenda. ... Large Language Models (LLMs) like GPT-4 are based on neural networks, which are inherently probabilistic in nature. This means that given the same input, they might produce slightly different outputs each time due to the randomness in the model’s architecture or during the training process. This is what we mean when we say LLMs are “non-deterministic.” ... Despite these challenges, there are ways to manage the non-deterministic nature of LLMs, such as using ensemble methods, applying post-processing rules or setting a seed for the randomness to get repeatable results.


How to get internal employee poaching right

Even if your company has an open culture, it’s critical to develop cooperative relationships with managers in other departments because losing a top performer isn’t easy for anyone. Nevertheless, if a user department manager recognizes an employee’s interest in transfering to IT, and you have a strong working relationship with that manager, internal hiring can go a lot more smoothly. ... At some companies, poaching an employee from another departments is considered unethical and underhanded. Regardless, internal employee poachingcan certainly be an issue if you actively recruit another department’s employee without letting the other department manager know. It is vital to know up front the actions and behaviors that are acceptable within your company before you start recruiting another department’s employee. For instance, in some cases, it is acceptable for an employee to be “loaned out” from one department to another for the duration of a specific one-off project. Such a policy helps provide temporary resources for projects while enabling employees on loan to gain knowledge and cross-train in another discipline. 


The Never-Ending Battle: Routine Patching vs. Operational Stability

There’s an on-going battle between competing priorities being waged every day in enterprises globally, and it’s been going on for decades. Cyber security teams are concerned with unpatched vulnerabilities and the breaches they risk, while IT professionals are driven by operational availability, the lack of which jeopardizes the business’ ability to operate. In today’s world, operational stability is winning, to the delight of threat actors everywhere. ... Existing vulnerability management strategies and tools focus only on the prioritization of risk. While that helps organizations identify which vulnerabilities they should attend to first, the actual orchestration of remediation is often ignored entirely. Remediation efforts must be handled discretely by different tools, processes, and teams, often with little to no continuity between them. Further, tangibly demonstrating the efficacy and progress of a vulnerability and patch management program is a massive undertaking. With each new vulnerability and patch, individual teams tackle discovery, correlation, and remediation in a one-off fashion, compounding existing inter-team frustration and increasingly blurring the distinction of success.


DeepMind Co-founder: The Next Stage of Gen AI Is a Personal AI

Suleyman said Pi will do away with the popular internet model of offering a product, like Google Search or Facebook, free for users and instead rely on advertising to pay the bills. The ad-based approach does not align the interest of the tech platform with the user. “Really, the customer for Facebook and Google and the other big companies is the advertiser,” he said. “It’s not the user.” Pi will be different since it does not disseminate its APIs, which is needed for commercial uses. Instead, “you as the consumer are the only person that pays for the AI,” Suleyman said. As for the known risks of generative AI including toxic content, hallucinations and bias, Suleyman said Pi was built to avoid toxic subjects. He claims that “none of the prompt hacks work against us.” Prompt hacks, which includes asking the AI to pretend to be another persona, are geared to get around safeguards in disclosing dangerous or toxic responses. For hallucinations, Suleyman said Pi has access to real time information but admits this remains a challenge. 


What are the cyber risks from the latest Middle Eastern conflict?

One substantial difference observed between the two conflicts is a lack of cyber activity before the initial Hamas attack. Prior to Russia’s invasion of Ukraine, which had been signalled months in advance by the Russian government, Ukraine was bombarded with a widespread campaign of cyber intrusions designed to soften up critical targets in advance. This was not the case in the Gaza war, and this is not much of a surprise, because out of necessity, Hamas spent months – maybe years – plotting its initial attack with exceptional attention paid to operational security (OpSec). Indeed, it has been suggested that some senior members of Hamas were kept in the dark entirely, in case they were compromised by Israeli intelligence. Therefore, for the incursion to take Israel by complete surprise, it may have been necessary for pro-Palestinian groups and Hamas-affiliated actors to confine their activity to normal levels. According to SecurityScorecard’s intel team, this was almost certainly the case. 


Microsoft Playwright Testing: Scalable End-to-End Testing for Modern Web Apps

With the playwright/test runner, tests run in independent, parallel worker processes, with each process starting its own browser. Moreover, increasing the number of parallel workers can reduce the time it takes to complete the full test suite. However, when running tests locally or in a continuous integration (CI) pipeline, there is a limitation to the number of central processing unit (CPU) cores on a local machine or CI agent machine. ... With Microsoft Playwright Testing, developers can use the scalable parallelism provided by the service to run web app tests simultaneously across all modern rendering engines such as Chromium, WebKit, and Firefox on Windows and Linux and mobile emulation of Google Chrome for Android and Mobile Safari. In addition, the service-managed browsers ensure consistent and reliable results for functional and visual regression testing, whether tests run from a CI pipeline or development machine.



Quote for the day:

"One advantage of talking to yourself is that you know at least somebody's listening." -- Franklin P. Jones

Daily Tech Digest - October 17, 2023

Beware the cost traps that can strain precious cybersecurity budgets

Overlapping services that duplicate functions are another common overspend that can eat into security budgets. "Paying for these duplicate security functions can be financially inefficient and strain the budget," says Nick Trueman, CISO at cloud services provider Nasstar. It can also result in integration challenges whereby coordinating and integrating multiple providers with similar functions leads to complexities and interoperability issues, he adds. CISOs should conduct a comprehensive review and identify all current security providers and the services they offer. ... On the topic of redundancies, CISOs can often end up paying for tools that do not deliver the expected benefits, significantly impacting their security budgets and coverage plans. CISOs may encounter scenarios where they invest in security tools or technologies that, despite their initial promise, fail to provide the anticipated value or return on investment (ROI), says Paul Baird, chief technical security officer at Qualys. This could happen for several reasons, including inadequate integration with existing systems, limited user adoption, or the tools not effectively addressing the organization's specific security needs.


Essential cyber hygiene: Making cyber defense cost effective

When it comes to dollars and cents, the industry as a whole has made many attempts to calculate the cost of a cyber attack. The same can’t be said about estimating the costs of implementing cyber defenses. But there’s value in knowing both of those metrics. Knowing what an enterprise can spend to prevent an attack is helpful when you know what they’re willing to spend to recover from an attack. For example, if the cost of recovering from a cyber attack is $1.25 million but an enterprise can spend only $1 million on implementing a set of robust cyber defenses, which one should they choose? To estimate the cost of IG1 Safeguards, we looked at the tools that an enterprise needs to implement them. Tools are priced in many ways, the most common being the following: by number of employees, users, workstations/servers, and/or by usage (e.g., megabyte, gigabyte, hours). CIS created IG1 Enterprise Profiles to help streamline the process of calculating costs. Our estimate shows that obtaining and deploying commercially-supported versions of the tools should be less than 20% of the Information Technology (IT) budget for any size enterprise.


Why the human factor is critical to ITOps success

Communication between developer teams and “business types” can be fraught. Developers typically work very hard for long hours to deliver what customers want. Yet efforts frequently fall flat, due in no small part to a failure of one or both sides to understand or explain what the other really wants or needs, says Shafrir. “There will always be a wall between the two, but especially during this time with tonnes of services on the internet and daily changes to software. It’s a problem if only business people are in touch with customers,” he says. Developers often have little idea how the customers are using the product – not least because they write code and “throw it over the fence”. “Then it’s frustrating when we’re [developers] told our quality is very low and it’s not a good job and we don’t work hard enough and other things,” says Shafrir. Shafrir recommends that IT leaders “take down that wall” between the two teams. If developers are notified and know exactly – continuously – how the code is performing in the customer environment, fixes can be rolled out faster. 


Security Governance and Risk Management in Enterprise Architecture

Security governance isn't just a rulebook. It's a structured approach that champions data protection, system reliability, and seamless business operations. With this governance in place, the intricate realm of cybersecurity becomes a navigable terrain. True security roots itself deep within organizational culture. When every team member, from the top brass to the newest recruit, values security, the organization stands united and fortified. A collective commitment to security amplifies the organization's resilience. ... Frameworks, especially ones like the NIST Risk Management Framework, offer more than theoretical value: they shape practical decisions in technology, placing risk considerations at the forefront. Adopting such guiding principles ensures that architectural choices resonate with both innovation and security. Still, the landscape of risk is dynamic, changing with every technological advancement and emerging threat. Regular, thorough risk assessments become a beacon that illuminates potential security gaps. Allocating resources to these evaluations ensures a resilient and adaptive enterprise architecture, always prepared for the challenges ahead.


Why A One-Size-Fits-All 'Compliance' Plan Can Be Dangerous

IT departments these days use many different architectures with various hardware, software and network configurations. Because of these differences, it's difficult to create a single cybersecurity formula that works for all companies. Some of the pitfalls of trying to cut corners and save costs by implementing a generic plan include: Lack Of Customization - A one-size-fits-all approach doesn't consider the specific problems and needs of each company. What works for one organization may not be enough to address the weaknesses and particular requirements of the next. It's important to customize security measures to fit the unique characteristics of each company to effectively protect against cyber threats. Increased Risk Of Breaches - When companies use a standardized compliance plan, it sets a basic level of security. However, this plan might not take into account the specific risks and security gaps that exist in each organization. Without customized security measures, a greater chance exists of experiencing data breaches or cyberattacks.


Generative AI is everything, everywhere, all at once

Unlike generative AI, which exploded within the past year thanks in part to OpenAI's consumer-facing ChatGPT, AI is nothing new. And it's a fairly ambiguous term, Toubia explained. "There's a wide range of things you could label as AI or machine learning," he said. "There's some very simple statistical methods that have been around for over 100 years that technically could be as clever as AI." Given the enigmatic nature of generative AI, it's also a complicated product to patent, audit, or regulate, which further exacerbates AI washing. "Companies don't really have to publish or explain their AI because it's a trade secret. There's no pattern that you could read, and we don't really know what's under the hood, so to speak," Toubia said. Regulatory institutions like the FTC are certainly trying to control the unwieldy industry with industry-wide warnings and reports. While he appreciates the ideas behind the warnings, Thurai is doubtful that the FTC's stern warnings and oversights will be enforced due to how difficult it will be to prove in court.


The Whats and Hows of DevOps Talent Retention

Given that a lack of opportunities for growth accounts for close to half of DevOps employees’ turnover rates, it once again highlights the importance of a well-planned approach to support ongoing learning. By understanding employee employees’ performance, preferences and environment, a wider range of support offers can be implemented. Providing tailored assignments that allow employees to focus on their skills or passion not only helps build commitment to the job but it also acts as a motivator. This can stem from a simple 15-minute project or a year-long program. But advocating personal development courses and upskilling techniques are not enough. Employers must also harness peer recognition. A sales organization within the United States Postal Service (USPS) recently made an attempt to boost peer recognition by enabling their employees to identify behavior associated with new skills learned by setting up a simple online platform. The group oversaw an overall employee engagement rise by 8% in the initial pilot group. Such strategies were then used to improve work across the organization.


How to Partner with Law Enforcement Following a Cyberattack

Law enforcement will come with the intention of acting as partner to the victim organization, alongside other stakeholders like remediation firms and insurance companies. “We would really expect to be seen as true partners in every sense of the word,” says Alway. A law enforcement team could include investigative agents with cybersecurity backgrounds, as well as technical experts, such as computer scientists and data analysts. That partnership will be based on information sharing. Organizations will tell law enforcement about the nature of the incident, provide logs, and any other evidence of the intrusion and answer questions. Law enforcement will share their knowledge of IOCs and any information they have that can help enterprises during the remediation process. “There’s no such thing as over communication in cyber incidents,” says Alway. It is important to keep in mind that law enforcement’s job takes time. “A lot of times the investigation piece could drag on for multiple years, whereas the company [or] organization is on a shorter timeline,” says Cabrera.


Cyber security professionals say industry is “booming”

Cyber security professionals are still positive about the industry and their opportunities despite the economic climate, according to The Chartered Institute of Information Security's (CIISec) 2022/2023 State of the Profession report – the eighth annual survey of the cyber security industry. In the survey of 302 security professionals, almost 80% say they have ‘good’ or ‘excellent’ career prospects, and more than 84% say the industry is ‘growing’ or ‘booming’. Despite being protected from economic challenges, the report highlights that the industry is still plagued by issues including stress and overwork. 22% of respondents work more than the 48 hours per week mandated by the UK Government, and 8% work more than 55 hours which, according to the World Health Organisation, marks the boundary between safe and unsafe working hours. The reports also found: Worries over workload loom over cyber security professionals - When asked what keeps them awake at night, the two main sources of stress for cyber professionals are day-to-day stress/workload (identified by 50%) and suffering a cyber-attack (32%).


Are enterprise architects the new platform team leaders?

Today there is a need for platform teams to architect the connections between business processes, outcomes, and the technology. Many teams today still operate in silos which can manifest within their specific functional pieces of technology or just individual teams. However, today, there are several key factors reshaping the way teams approach their work. The easy access to technology outside of corporate IT has fundamentally changed the dynamic. In addition, the idea of IT owning a very small piece of the technology is no longer acceptable. For example, if you are a database team, you can’t just be responsible for the database itself – you must also own the delivery of that database as a service, including the additional technology around it like the OS, compute, memory, and all elements of cost, security, access, and performance. Enterprise architects in this new role as platform leaders must adopt a cross-functional mindset. They must look left and right x-functionally at the technology, how it should fit together, the services the company should offer – and for what use cases.



Quote for the day:

"A leader is always first in line during times of criticism and last in line during times of recognition." -- Orrin Woodward

Daily Tech Digest - October 16, 2023

A Holistic Approach to Cyber Resilience

Beyond investing in the right training techniques to build resilience, it is important for security leaders to set up the right culture for cybersecurity and ultimately build a strong cybersecurity foundation. To help meet today’s cybersecurity challenges, organizations should treat cybersecurity as a team sport, working with employees to adopt a collective responsibility mindset throughout the entire organization so as to not place blame or pressure on just the cybersecurity teams. To start building this collective mindset, begin including employees outside of security teams in security training to avoid the blame game when an attack inevitably happens. ... Not only does this help ease the burden security teams feel, but it also ensures that all employees know the appropriate steps to take when encountering a potential threat. By focusing on creating a culture of understanding, employees outside the security team may be more open to learning from these incidents and identifying concerns in the future, ultimately giving your organization a more holistic view of the true state of its cyber resilience.


Why IT projects still fail

Some project leaders list the prevailing do-more-with-less expectation as another reason for failed IT projects today. They say this mentality generally leads to project teams lacking the resources that they need to get the desired work done on time. “Everybody is very concerned with that bottom line, and they should be concerned about that, but the other side of that is they’re expecting a few people to do a lot of things,” Phillips says. For example, she says workers are frequently assigned to multiple projects simultaneously, and many are assigned to that project work on top of their existing duties. As a result, these workers are pulled in too many different directions. Others say enterprise leaders underestimate costs and the time required to complete the work or they fail to allocate the right talent to the team, even as project managers surface the consequences of under-allocating the money, talent, and time needed for success. Experienced project leaders say it’s crucial for IT project managers and CIOs themselves to ensure that the business sponsors and C-suite executives get the information they need to be realistic about the required resources, support, and schedules.


Making sure open source doesn’t fail AI

The biggest difficulty is in defining open source in a world where data and software are so inextricably linked. As Maffulli describes, the most intense discussions among his working group revolve around the dependencies between training data and the instructions on how to apply it. Perhaps not surprisingly, given the complexity and the stakes involved, “there is no strong consensus right now on what that means,” he says. There are at least two approaches, with two primary factions squaring off in the working group. The first tries to stick closely to the comfortable concept of source code, promoting the idea that “source code” gets one-to-one translated to the data set. In this view, the combination of the instructions on how to build the model and the binary code is the source code subject to “open source.” The second faction sees things in a radically different way, believing that you can’t modify code without having access to the original data set. In this view, you need other things to effectively exercise the fundamental freedoms of open source. 


What Are Data Governance Tools, and How Do They Work?

Data governance tools catalog data assets; they collect data from databases, files, applications and other data sources. They then tag data assets based on predefined or custom metadata attributes and classify them based on their sensitivity, importance or relevance to specific compliance regulations. Data governance software ensures that data is accurate, complete and consistent by performing data quality checks and validations. ... Data governance tools help businesses define and manage data ownership, roles and responsibilities as well as implement data security and privacy measures. They ensure data management processes meet regulatory compliance and quality standards. They also help automate the workflow and provide structure to large volumes of data. Data governance tools serve several purposes, which include data quality management to ensure data remains accurate, complete and consistent across an organization. These tools can even be used to enforce compliance with regulatory requirements, such as GDPR and HIPAA. 


Enhancing Enterprise Solutions with SOC as a Service Network Protection

Companies that outsource their SOC activities might benefit from the knowledge, use of cutting-edge technology, and risk assessment of safety professionals. Nearly seventy-one percent of SOC analysts state that they are burned out in their jobs, particularly since there are only a few among them who are in charge of the safety of the entire company. The hackers can take advantage of holes on the infrastructure of a business to gain access unauthorized authorisation or disrupt operations. The threat control and oversight services provided by SOC as a Service aid in identifying and assessing potential risks in OT with IT settings. Owing to the proactive approach, companies are able to tackle problems before they might be used on customers. The tendency to overlook is the process of regularly checking for flaws regarding network infrastructure, software, and users. These analyses also uncover present vulnerabilities and analyze the risks associated with each problem, allowing businesses to choose updates and solutions. SOC as a Service provider not only assists in identifying problems, but additionally in monitoring and resolving those flaws.


Unleashing the Power of AI and ML in Data

Businesses can leverage AI to generate data such as fake reviews and use that information to test and demo a product. This type of demo data generation helps to create a valuable and practical data product that is quick and efficient. One of the key benefits of using AI to generate mock data is that it allows businesses to test and demo data products without having to collect real data from users. ... In forecasting, ML delivers highly automated, finely granular, and more accurate predictions than manual projections. It solves the knowledge risk inherent in organizations where projections are based on “gut feel” and “years of experience.” ML can also pick up on the nuances and subtleties of multiple features playing out in parallel that are invisible to the human eye. ... AI is a powerful technology that can enhance and optimize data analysis, but it doesn’t replace the essential role of software engineers and human expertise. Great technology demands leadership, creativity, empathy, and the ability to navigate complex ecosystems and stakeholders – a uniquely human capacity.


How APAC organisations are tapping generative AI

Across the Asia-Pacific (APAC) region, organisations like GovTech and Culture Amp have been doubling down on GenAI initiatives, more so than other parts of the world. According to a recent study by Enterprise Strategy Group and TechTarget, 75% of APAC respondents plan to adopt generative AI within the next 12 months, with nearly a third already running GenAI workloads in production or are testing the technology. The enthusiasm for generative AI in APAC is also reflected in IT budgets, with over half having allocated budgets to GenAI. Among them, 39% have allocated between 5% and 20% of their IT budget to the technology. The blinding speed of GenAI uptake among APAC organisations is also reflected in the 19% of organisations that are not yet sure if GenAI is a budget item. Nevertheless, the rapid emergence of GenAI as a top IT priority is both impressive and alarming. The study shows that GenAI has become the fifth most important strategic initiative in APAC, trailing behind digital transformation, automation, cyber security, and cost-cutting, and surpassing traditional priorities like cloud and application modernisation.


CISOs and board members are finding a common language

“The C-Suite and board of directors are increasingly relying on CISOs for guidance across a sophisticated threat landscape and changing market conditions,” said Jason Lee, CISO, Splunk. “These relationships provide CISOs the opportunity to become champions who strengthen an organization’s security culture and lead teams to become more cross-collaborative and resilient. By communicating key security metrics, CISOs can also guide boards on adopting emerging technologies, such as generative AI, to help improve cyber defense management and prepare for the future.” ... In 47% of organizations surveyed, the CISOs are now reporting directly to the CEO, indicating a closer relationship with the C-Suite and their respective governing boards. Boards of directors are increasingly looking to CISOs to guide cybersecurity strategy, offering an opportunity for CISOs to articulate value and fill in communication gaps. Numerous CISOs across many industries report regular participation in board meetings, including technology (100%), government (100%), communications and media (94%), healthcare (88%) and manufacturing (86%).


Generative AI an Emerging Risk as CISOs Shift Cyber Resilience Strategies

Enterprise risk executives should start by implementing clear rules prohibiting employees from using any unapproved web applications and tools. “It’s really another instance of shadow IT, which includes any IT-related purchases, activities or uses that the IT department is unaware of and which has historically been a big problem in most organizations,” Stevens says. When employees use approved GenAI tools, the company needs rules governing what data can -- and, more importantly, cannot -- be used with the tool. “But these rules shouldn’t be limited to only GenAI tools,” she adds. “They should be in place for all tools and applications used in the organization.” These execs should partner with any key stakeholders who might use GenAI tools. Stevens says ideally, the organization has a CISO, with the infosec organization a key stakeholder for every application that accesses and stores data or lives within the company’s network and ecosystem.


How To Use Serverless Architecture

Imagine an application as being composed of two parts: the frontend, which users interact with, and the backend, which powers the frontend. In serverless architectures, this backend code runs on the infrastructure provided by the cloud service, removing the need for businesses to worry about managing physical servers. While this does simplify things significantly, it doesn’t entirely remove responsibility from the business owner or the developer. There’s still the need to ensure the security of your code, and initial setup is necessary, albeit less time-consuming than traditional server setups. Serverless architectures are also event-driven. When certain events or triggers happen (like an HTTP request or database event, for example), your application responds. While this shifts the security of the physical servers onto the cloud provider, the responsibility for securing your code still lies with you. The building blocks of serverless applications are functions—small pieces of code, each doing a specific task. 



Quote for the day:

"Thinking should become your capital asset, no matter whatever ups and downs you come across in your life." -- Dr. APJ Kalam