Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - November 26, 2023

European Commission Failing to Tackle Spyware, Lawmakers Say

As that deadline looms, lawmakers accused the European Commission of failing to act. On Thursday, they passed a resolution that attempts to force the European Commission to present the legislative changes recommended in May by the PEGA Committee. At a plenary session in Strasbourg, EU lawmakers said that the European Commission's inaction had facilitated an uptick in recent spyware cases. Such cases have included the alleged targeting of exiled Russian journalist Galina Timchenko using Pegasus when she was based in Germany, as well as the Greek government's attempt to thwart investigations into spyware abuse by its ministers. In contrast to the EU approach, lawmakers highlighted the U.S. government's blacklisting in July of European spyware firms Intellexa and Cytrox and the Biden administration's citing of the companies' risk to U.S. national security and foreign policy. Speaking at the Thursday plenary, EU Justice Commissioner Didier Reynders condemned using spyware to illegally intercept personal communications, adding that member states cannot use "national security" as a legal basis to circumvent existing laws and indiscriminately target their citizens.

Mastering the art of differentiation: Vital competencies for thriving in the age of artificial intelligence

With AI designed to make decisions using algorithms grounded in data and patterns, these algorithms are only as dependable as the data they are trained on and can be influenced by the assumptions and biases of their creators. Consequently, it is imperative to employ critical thinking skills to assess AI decisions and guarantee that they align with our values and objectives. Moreover, critical thinking is essential for resolving complex issues that may exceed AI’s capabilities. Developing critical thinking skills involves cultivating the ability to analyze, evaluate, and synthesize information to make informed decisions. ... In this rapidly evolving modern landscape, heavily influenced by digital technologies, cultivating a high LQ is indispensable for the long-term success and sustainability of both employees and organizations. In the business world, change is constant, making continuous learning and development essential at every level of the organization to ensure we consistently make the right decisions. High LQ empowers employees to foster innovation and creativity, cultivate resilience, and position themselves more effectively to future-proof their careers.

Digital advocacy group criticizes current scope of the EU AI Act

The group’s core argument is that the AI Act now goes beyond its original intended scope, and should instead remain focused on high-risk use cases, rather than being directed at specific technologies. Digital Europe also warned that the financial burden the Act could place on companies wanting to bring AI-enabled products to market could make operating out of the EU unstainable for smaller organizations. “For Europe to become a global digital powerhouse, we need companies that can lead on AI innovation also using foundation models and GPAI (general-purpose AI),” the statement read. “As European digital industry representatives, we see a huge opportunity in foundation models, and new innovative players emerging in this space, many of them born here in Europe. Let’s not regulate them out of existence before they get a chance to scale, or force them to leave.” The letter was signed by 32 members of Digital Europe and outlined four recommendations that signatories believe would allow the Act to strike the necessary balance between regulation and innovation.

HR Leaders unleashing retention success through employee well-being

“The pandemic brought the discourse on mental health to the forefront and normalised talk about stress and mental health in all forums. Accordingly, a formalised framework to address the mental health of employees has been put in place. Wellness webinars on these topics are delivered through tie-ups with service providers and in-house subject matter experts. Webinars on mental health are regularly organised with an aim to destigmatise mental health through increasing awareness on topics such as mental health awareness, digital & screen detox and, stress management, etc. We continuously work on instituting policies that are customised as per the individual and life-stage needs of the employees. An employee assistance program, in tie-up with a service provider, is in place to facilitate mental health conversations with qualified professionals. In addition, the employees are nudged to incorporate habits that help take care of their mental well-being as an unconscious part of their lives. Initiatives such as the 'Mental Health Bingo’ card and ‘I De-stress myself by __’ campaigns are launched.

How generative AI changes the data journey

We see generative AI used in the observability space throughout many industries, especially regarding compliance. Let’s look at healthcare, an industry where you must comply with HIPAA. You are dealing with sensitive information, generating tons of data from multiple servers, and you must annotate the data with compliance tags. An IT team might see a tag that says, “X is impacting 10.5.34 from GDPR…” The IT team may not even know what 10.5.34 means. This is a knowledge gap—something that can very quickly be fulfilled by having generative AI right there to quickly tell you, “X event happened, and the GDPR compliance that you’re trying to meet by detecting this event is Y…” Now, the previously unknown data has turned into something that is human readable. Another use case is transportation. Imagine you’re running an application that’s gathering information about flights coming into an airport. A machine-generated view of that will include flight codes and airport codes. Now let’s say you want to understand what a flight code means or what an airport code means. Traditionally, you would use a search engine to inquire about specific flight or airport codes.

Banks May Be Ready for Digital Innovation: Many of the Staff Aren’t

A major roadblock to training workers is that many don’t actually bank with their employer. This makes training critical, especially for frontline staff members, says John Findlay, chief executive and founder of digital learning company LemonadeLXP, based in Ontario, Canada. “If their staff doesn’t bank with them, they don’t use the technologies on offer and it’s pretty difficult for them to promote them to customers,” he says. It’s also difficult for them to answer customer questions. Brian McNutt, U.S. vice president of product management at Dutch engagement platform Backbase, says banks should incentivize their staff to actually use their services as much as possible. One approach is to offer special rates or deals to employees, he says. “I think that really the most important thing is that they are customers themselves. There’s really no replacement for that. For somebody to really be able to empathize or understand customers, they have to experience the products themselves.”

The Future of Software Engineering: Transformation With Generative AI

The application of Generative AI in software engineering is not just a technical enhancement but a fundamental change in how software is conceptualized, developed, and maintained. This section delves into the key themes that underline this transformative integration, elucidating the diverse ways in which Generative AI is reshaping the field. Generative AI is revolutionizing the way code is written and maintained. AI models can now understand programming queries in natural language and translate them into efficient code, significantly reducing the time and effort required from human developers. This has several implications:Enhanced productivity: Developers can focus on complex problem-solving rather than spending time on routine coding tasks. Learning and development: AI models can suggest best coding practices and offer real-time guidance, acting as a learning tool for novice programmers. Code quality improvement: With AI's ability to analyze vast codebases, it can recommend optimizations and improvements, leading to higher quality and more maintainable code.

Reports: China’s Alibaba Shuts Down Quantum Lab

DoNews reported this week that Alibaba’s DAMO Academy –Academy for Discovery, Adventure, Momentum and Outlook — has closed down its quantum laboratory due to budget and profitability reasons. The budget ax claimed more than 30 people — possible among China’s brightest quantum researchers — lost their positions, according to the news outlet’s internal sources. For further claims of proof, DoNews reports that the official website of DAMO Academy has also removed the introduction page of the quantum laboratory. According to the story, translated into English: “Insiders claimed that Alibaba’s DAMO Academy Quantum Laboratory had undergone significant layoffs, but it was not clear at that time whether the entire quantum computing team had been disbanded.” Media further suggest that many of the DAMO Academy quantum team members who were laid off have begun to send their resumes to other companies. According to The Quantum Insider’s China’s Quantum Computing Market brief, Alibaba is a diverse tech conglomerate that has been active in quantum since 2015. The company’s Quantum Lab Academy teaching employees and students about the prospects of quantum computing.

It’s time the industry opts for collaborative manufacturing

The transition from an analogue factory to a digital one underscores the necessity of a coherent and efficient digital infrastructure. This transformation extends beyond the primary tasks of manufacturing, adding efficiency at every stage, including the cutting room. Investments in IoT-enabled machinery, though costly, can lead to significant improvements in output and efficiency. ... The technology underlines the importance of integrated planning software, which aids in production planning, order flow management and the efficient consumption of raw materials.” As technology continues to evolve and digitisation gains ground, an important question emerges while making the roadmap: What are the social implications of this technological revolution? In a city like Bengaluru and its surrounding manufacturing hubs, more than 3.5 million women toil in the garment industry, forming the majority of the workforce. Their livelihoods hinge on operating sewing machines, a vocation they might continue for the next two decades.

The Digital Revolution in Banking: Exploring the Future of Finance

As banks continue to close their physical branches, it becomes crucial to balance the convenience of digital banking and the personalized service that customers crave. While online banking has become increasingly popular, some still prefer the in-person experience of visiting their local branch and interacting with staff. This is especially important when it comes to welcoming new customers. To address this, emerging technologies, such as augmented reality (AR) and virtual reality (VR), may offer a solution to bridge the gap between digital convenience and personalized service. Imagine you are a banking executive looking for ways to improve your customer experience. You know that digital banking is the future, but you also understand that some customers still crave the personalized service of visiting a physical branch. This is where augmented reality (AR) and virtual reality (VR) come in. By incorporating AR into your mobile app, you can enhance the interface and provide customers with more information in an immersive way.

Quote for the day:

"Success is the sum of small efforts, repeated day-in and day-out." -- Robert Collier

Daily Tech Digest - November 25, 2023

Building a Successful Data Quality Program

Assessing Data Quality often includes establishing a standard of acceptable Data Quality, using data profiling and analysis techniques, and using statistical methods to identify and correct any Data Quality issues. The key features (often called “dimensions”) that should be examined and measured are: Completeness:- Data should not be missing or have incomplete values. Uniqueness:- Locate and eliminate copies to ensure the information in the organization’s data files is free of duplication. Validity:- This refers to how useful the data is, and how well the data conforms to the organization’s standards. Timeliness:- Old information that is often no longer true or accurate needs to be removed. Data can be measured using its relevance and freshness. Out-of-date data should be eliminated, so as not to cause confusion. Accuracy:- This is the precision of data, and how accurately it represents the real-world information. Consistency:- When data is copied, the information should be consistent and accurate. The need for a single source of accurate in-house data provides a good argument for the use of master data and its best practices.

Building brand trust in a new era of data privacy

Emily emphasized the importance of anonymizing data to utilize it in aggregate without compromising individual privacy, a task that requires close collaboration between technical and marketing departments. Anita introduced the intriguing concept of a Chief Trust Officer, a role highlighted by Deloitte, which spans data, business, and marketing, safeguarding all aspects of compliance and privacy. The idea of having such a partner resonated with her, underlining the multifaceted nature of trust in business operations. Jake echoed the sentiment, stressing the need for understanding the types of data at hand and leveraging them without violating regulations - a balance that is critical yet challenging to achieve. These insights from the panelists underscore a common theme: building brand trust in the digital age is a multifaceted challenge that requires a blend of transparency, consistency, and compliance. As we continue to delve into this topic, it's clear that the role of data privacy is not just a technical issue but a cornerstone of the customer-brand relationship.

How Does Technical Debt Affect QA Testers

How many times have your testers been caught off guard at the last minute when the delivery manager abruptly appeared and said, “Guys, we need to launch our product in a week, and we are very sorry for not communicating this sooner? Please complete all test tasks ASAP so that we can begin the demo.” Simply put, any missing tests or “fix it later” attitude can result in a tech debt problem. Lack of test coverage, excessive user stories, short sprints, and other forms of “cutting corners” due to time constraints all contribute significantly to the building of technical debt in QA practice. When the complexity of the testing mesh began to grow with each new sprint, a US-based online retailer with a strong presence across various websites and mobile apps found itself in a real-world “technical debt” dilemma. ... Most QA managers mistakenly believe that tech debt is a legitimate result of putting all of your work on the current sprint alone, which leads to completing test coverage manually and completely ignoring automation. According to agile principles, we should see the tech debt problem as an inability to maintain and meet QA benchmarks.

How digital twins will enable the next generation of precision agriculture

Digital twins are digital representations of physical objects, people or processes. They aid decision-making through high-fidelity simulations of the twinned physical system in real time and are often equipped with autonomous control capabilities. In precision agriculture, digital twins are typically used for monitoring and controlling environmental conditions to stimulate crop growth at an optimal and sustainable rate. Digital twins provide a live dashboard to observe the environmental conditions in the growing area, and with varying autonomy, digital twins can control the environment directly. ... Agriculture is among the lowest-digitalized sectors, and digital maturity is an absolute prerequisite to adopting digital twins. As a consequence, costs related to digital maturity often overshadow technical costs in smart agriculture. A company undergoing the early stages of digitalization will have to think about choosing a cloud provider, establishing a data strategy and acquiring an array of software licences, to name just a few critical challenges.

What are Software Design Patterns?

Software design patterns are an essential aspect of software development that helps developers and engineers create reusable and scalable code. These patterns provide solutions to commonly occurring problems in software design, enabling developers to solve these problems efficiently and effectively. In essence, a software design pattern is a general solution to a recurring problem in software design that has been proven to be effective. It's like a blueprint for a specific type of problem that developers can use to create software systems that are reliable, maintainable, and scalable. Software design patterns have been around for a long time and are widely used in the software development industry. They are considered to be a best practice in software design because they provide a standardized approach to solving common problems, making it easier for developers to communicate and collaborate with one another. In this blog, we will explore what software design patterns are, the different types of software design patterns, and the benefits of using them in software development.

Examples of The Observer Pattern in C# – How to Simplify Event Management

The observer pattern is an essential software design pattern used in event-driven programming and user interface development. It is composed of three primary elements: the subject, observer, and concrete observers. The subject class is responsible for keeping track of the observer objects and notifying them of changes in the subject’s state. On the other hand, the observer is the object that wishes to be notified when the state of the subject changes. Finally, the concrete observer is an implementation of the observer interface. One of the observer pattern’s significant advantages is its capability to facilitate efficient event management in software development. By leveraging this ability, developers can trigger related events without the need for tightly coupling the pieces of code leading to the events. The observer pattern also ensures that the code continues to be free from changes that would cause a ripple effect or the chain reaction of changes. The observer pattern’s primary components are the Subject, Observer, and Concrete Observer. The subject defines the interface for attaching and detaching observers from the subject object.

Cloud Computing: A Comprehensive Guide to Trends and Strategies

As a company moves to the cloud, they reduce the number of servers and other hardware their IT department has to maintain. Cloud computing efficiently uses today’s powerful processors, fast networks, and massive amounts of storage. Cloud virtual machines allow businesses to run multiple servers on one physical machine. Containers take that concept a step further. Containers are a lightweight form of virtualization that packages applications and their dependencies in a portable manner. This means that if, for instance, a company wants to run a web server, they no longer have to devote physical or virtual machines to host the server software. A container with only the needed bits runs in the cloud, appearing to the outside world as if it were its dedicated machine. Many containers can run in the same cloud instance for maximum efficiency. This approach is sometimes called serverless computing or Function as a Service (FaaS). The application-level isolation inherent in serverless computing restricts the attack surface that attackers can exploit.

Judges Urged To Stay Abreast Of Electronic Tools

The Cyber Security Authority (CSA), with funding support from the European Commission Technical Assistance and Information Exchange (TAIEX) Instrument is undertaking a series of workshops across Ghana to enhance the capacity of the judiciary and prosecutors regarding cybercrime and electronic evidence as a decisive factor in contributing to the rule of law. Expressing excitement about the training, the Chief Justice said e-commerce, e-trade, e-contracts, and intellectual property rights, among others, were now being conducted virtually, and the expertise of judges in these new trends was a prerequisite for the efficient trial of cyber-related cases, particularly in the gathering of electronic data. “Judges must develop new working skills by staying abreast of the digital space. You must develop leadership skills in this arena if you want to remain relevant in the system,” she stressed. Albert Antwi-Boasiako, stated that the major regulatory activity being undertaken by the Authority to license cybersecurity service providers and accredit cybersecurity establishments and professionals was tailored to support the training of the judges.

Candy Alexander Explains Why Bandwidth and Security are Both in High Demand

It became painfully clear to everyone that the primary component for productivity depended on bandwidth. The increased bandwidth of networks has become the primary factor of success; whether you're a business just looking to ensure the productivity of your remote workers or provide a cloud service, throughput is everything. And with that, the world has expanded ubiquitous access and high availability of networks. In today's digital world, businesses of all sizes rely on data. That data is used to make decisions, operate efficiently, and serve customers. Data is essential for everything, from product to development, marketing, and customer support. However, with the rise of remote work and cloud computing, it has become more challenging to ensure that the data is always accessible and secure. The application of cybersecurity's golden triad of confidentiality, integrity, and availability is now focused on data rather than the on-premises systems and networks. Again, it's data that has become more important than ever before.

Why Departments Hoard Data—and How to Get Them to Share

"Data hoarding within organizations can be attributed to a combination of cultural, operational and psychological factors," said Jon Morgan, CEO and editor-in-chief of Venture Smarter, a consulting firm in San Francisco. "When departments view data as a source of power or control, they are less inclined to share it with others, fearing that it might diminish their influence." Operational inefficiencies can also lead to data hoarding. "If access to data is cumbersome or time-consuming, employees may be less motivated to share it, preferring to keep it close for their own convenience," Morgan said. In addition, "psychological factors like fear of criticism or a desire to protect one's domain can also drive data hoarding." Employees may worry that sharing data will expose their mistakes or weaknesses, leading to a reluctance to collaborate, he said. Jace McLean, senior director of strategic architecture at Domo, a data platform based in American Fork, Utah, said he believes that cultural factors are the most important lever to use in changing data-hoarding habits.

Quote for the day:

"If you don't demonstrate leadership character, your skills and your results will be discounted, if not dismissed." -- Mark Miller

Daily Tech Digest - November 24, 2023

How American Express Created an Open Source Program Office

American Express has established an open source program office that gamifies the safe development of open source code that can be poured back into the community. “Without the program existing, a lot of people at the company wouldn’t know about giving back to open source, they wouldn’t see the power in it,” said Amanda Chesin, software engineer at American Express, during a presentation at OSFF. The AmEx OSPO started as an informal group of developers trying to establish a symbiotic relationship with the open source community, said Tim Klever, vice president of the development experience at AmEx, at the conference. The first step was to convince the skeptical upper management of the value of open source. Security issues were the single largest concern among 56% of executives surveyed by FINOS. That was followed by quality of components, compliance with external regulations, and licensing of intellectual properties. ... “That’s really when we kind of became official because we had someone to worry about this stuff and work on it the whole time, even though we only got [her] for a summer,” Klever said.

Navigating the uncharted waters of the Digital Protection Act 2023: Overcoming unsolicited challenges in the digital realm

Of particular note is the provision for grievance redressal, affording individuals a legal avenue to hold data fiduciaries accountable. However, in contrast to the penalties imposed on data fiduciaries for non-compliance, the Data Protection Board's authority to levy fines on data principals (for violations of duties not to file frivolous complaints or impersonate others) is limited to a modest sum of up to ₹ 10,000. This duality poses a significant concern, as it introduces the possibility of groundless complaints. A successful complaint can yield a substantial ₹ 200 crore award, while an unsuccessful one carries a comparatively nominal penalty of ₹ 10,000. This dynamic could lead to an influx of speculative claims and an environment of undue frustration. There may be merit in revisiting the penalty structure, aligning it with the sum initially sought by the complainant to ensure the integrity of the complaint forum. One notable absence in the Act is the 'right to be forgotten', a provision in comparable digital data protection legislations like the GDPR.

Could edge computing unlock AI’s vast potential?

Beyond the increased performance that AI applications demand, a key benefit of the edge model is reliability and resilience. Consumers have taken to AI, with 73% worldwide saying they trust content produced by generative AI, and 43% keen for organizations to implement generative AI throughout customer interactions. Businesses that can’t keep their AI-powered services running will suffer from declining customer satisfaction and even a drop in market share. When a traditional data center suffers a power outage – perhaps due to a grid failure or natural disaster – apps reliant on these centralized data centers simply cannot function. Edge computing avoids this single point of failure: with compute more distributed, smart networks can instead use the processing power nearest to them to keep functioning. There are also benefits when it comes to data governance. If sensitive data is processed at the edge of the network, it doesn’t need to be processed in a public cloud or centralized data center, meaning fewer opportunities to steal data at rest or in transit. ... Finally, there are cost savings to think about. Cloud service providers often charge businesses to transfer data from their cloud storage.

Cloud security and devops have work to do

First, they are not given the budget to plug up these vulnerabilities. In some instances, this is true. Cloud and development security are often underfunded. However, in most cases, the funding is good or great relative to their peers, and the problems still exist. Second, they can’t find the talent they need. For the most part, this is also legit. I figure that there are 10 security and development security positions that are chasing a single qualified candidate. As I talked about in my last post, we need to solve this. Despite the forces pushing against you, there are some recommended courses of action. CISOs should be able to capture metrics demonstrating risks and communicate them to executives and the board. Those are hard conversations but necessary if you’re looking to take on these issues as an executive team and reduce the impact on you and the development teams when stuff hits the fan. In many instances, the C-levels and the boards consider this a ploy to get more budget—that needs to be dealt with as well. Actions that can remove some of this risk include continuous security training for software development teams.

Windows-as-an-app is coming

Windows App, which is still in beta, will let you connect to Azure Virtual Desktop, Windows 365, Microsoft Dev Box, Remote Desktop Services, and remote PCs from, well, pretty much any computing device. Specifically, you can use it from Macs, iPhones, iPads, other Windows machines, and — pay attention! — web browsers. That last part means you'll be able to run Windows from Linux-powered PCs, Chromebooks, and Android phones and tablets. So, if you've been stuck running Windows because your boss insists that you can't get your job done from a Chromebook, Linux PC, or Mac, your day has come. You can still run the machine you want and use Windows for only those times you require Windows-specific software. Mind you, you've been able to do that for some time. As I pointed out recently, all the Windows software vendors don't want you to run standalone Windows applications; they prefer web-based Software-as-a-Service (SaaS) applications. They can make a lot more money from you by insisting you pay a monthly subscription rather than a one-time payment. Sure, Microsoft made its first billions from Windows and the PC desktop, but that hasn't been its business plan for years now.

Q-Learning: Advancing Towards AGI and Artificial Superintelligence (ASI) through Reinforcement Learning

At its essence, Q-learning is akin to introducing a reward system to a computer, aiding it in deciphering the most effective strategies for playing a game. This process involves defining various actions that a computer can take in a given situation or state, such as moving left, right, up, or down in a video game. These actions and states are meticulously logged in what is commonly referred to as a Q-table. The Q-table serves as the computer’s playground for learning, where it keeps tabs on the quality (Q-value) of each action in every state. Initially, it’s comparable to a blank canvas – the computer embarks on this journey without prior knowledge of which actions will lead to optimal results. The adventure commences with exploration. The computer takes a plunge into trying out different actions randomly, navigating the game environment, and recording the outcomes in the Q-table. Think of it as the computer playfully experimenting and gradually figuring out the lay of the land. Learning from Rewards forms the core of Q-learning. Each time the computer takes an action, it earns a reward.

ChatGPT Use Sparks Code Development Risks

Randy Watkins, CTO at Critical Start, advises organizations to build their own policies and methodology when it comes to the implementation of AI-generated code into their software development practices. “In addition to some of the standard coding best practices and technologies like static and dynamic-code analysis and secure CI/CD practices, organizations should continue to monitor the software development and security space for advancements in the space,” he told InformationWeek via email. He says organizations should leverage AI-generated code as a starting point but tap human developers to review and refine the code to ensure it meets standards. John Bambenek, principal threat hunter at Netenrich, adds leadership needs to “value secure code”, make sure that at least automated testing is part of all code going to production. “Ultimately, many of the risks of generative AI code can be solved with effective and thorough mandatory testing,” he noted in an email. He explains as part of the CI/CD pipeline, ensure mandatory testing is done on all production commits and routine comprehensive assessment is done on the entire codebase.

6 common problems with open source code integration

Closed source software is typically maintained, updated and patched exclusively by the software vendors, which can be a big benefit for development teams who lack the time, resources or expertise to do it themselves. Some open source platforms receive active support from proprietary software vendors, such as Red Hat Enterprise Linux and commercial distributions of Kubernetes. For the most part, however, organizations that deploy open source software are responsible for ensuring it remains updated. Failure to do so carries the risk of running outdated code that is buggy or has security vulnerabilities. This challenge is exacerbated by a lack of centralized management consoles or automated update processes that can help ensure all the open source components in use are up to date -- something often highlighted as an advantage of paying the price for proprietary software suites. This is another reason SCA tools are crucial for organizations that commit to the open source approach. While these tools don't provide automated update capabilities, they help the organization track what open source components exist and what each one's current version is.

AI and contextual threat intelligence reshape defense strategies

Cybersixgill believes that in 2024, threat actors will use AI to increase the frequency and accuracy of their activities by automating large-scale cyberattacks, creating duplicitous phishing email campaigns, and developing malicious content targeting companies, employees, and customers. Malicious attacks like data poisoning and vulnerability exploitation in AI models will also gain momentum, which cause organizations to provide sensitive information to untrustworthy parties unwittingly. Similarly, AI models can be trained to identify and exploit vulnerabilities in computer networks without detection. Cybersixgill also predicts the rise of shadow generative AI, where employees use AI tools without organizational approval or oversight. Shadow generative AI can lead to data leaks, compromised accounts, and widening vulnerability gaps in a company’s attack surface. ... The C-suite and other executives will need a clearer understanding of their organization’s cybersecurity policies, processes, and tools. Cybersixgill believes companies will increasingly appoint cybersecurity experts on the Board to fulfill progressively stringent reporting requirements and conduct good cyber governance.

Quote for the day:

"Remember, teamwork begins by building trust. And the only way to do that is to overcome our need for invulnerability." -- Patrick Lencioni

Daily Tech Digest - November 23, 2023

Web Shells Gain Sophistication for Stealth, Persistence

One reason attackers have taken to Web shells is because of their ability to stay under the radar. Web shells are hard to detect with static analysis techniques, because the files and code are so easy to modify. Moreover, Web shell traffic — because it is just HTTP or HTTPS — blends right in, making it hard to detect with traffic analysis, says Akamai's Zavodchik. "They communicate on the same ports, and it's just another page of the website," he says. "It's not like the classic malware that will open the connection back from the server to the attacker. The attacker just browses the website. There's no malicious connection, so no anomalous connections go from the server to the attacker." In addition, because there are so many off-the-shelf Web shells, attackers can use them without tipping off defenders as to their identity. The WSO-NG Web shell, for instance, is available on GitHub. And Kali Linux is open source; it's a Linux distribution focused on providing easy-to-use tools for red teams and offensive operations, and it provides 14 different Web shells, giving penetration testers the ability to upload and download files, execute command, and creating and querying databases and archives.

Will More Threat Actors Weaponize Cybersecurity Regulations?

Based on what has been disclosed thus far, the breach sounds relatively minor, but ALPHV’s SEC complaint throws the company into the spotlight. “The SEC won’t take a criminal’s word, but the spotlight is harsh. ALPHV's motives seem less about ransom, more about setting a precedent that intimidates,” Ferhat Dikbiyik, Ph.D., head of research at cyber risk monitoring company Black Kite, tells InformationWeek via email. “MeridianLink's challenge now is to navigate this tightrope of disclosure and investigation, all while under the public and regulatory microscope.” Dikbiyik points out that ALPHV’s SEC complaint suggests that the group may have ties in the US. The group demonstrates a strong command of English and knowledge of American corporate culture, he explains. Its knowledge of the American regulatory system is particularly indicative of potential stateside ties. “ALPHV's clear English on the dark web could be AI, but their quick SEC rule exploit? That suggests boots on the ground,” says Dikbiyik.

‘Digital Twin Brain’ Could Bridge Artificial and Biological Intelligence

“Cutting-edge advancements in neuroscience research have revealed the intricate relationship between brain structure and function, and the success of artificial neural networks has highlighted the importance of network architecture,” wrote the team. “It is now time to bring these together to better understand how intelligence emerges from the multi-scale repositories in the brain. By mathematically modeling brain activity, a systematic repository of the multi-scale brain network architecture would be very useful for pushing the biological boundary of an established model.” As that systematic repository, the team’s digital twin brain (DTB) would be capable of simulating various states of the human brain in different cognitive tasks at multiple scales, in addition to helping formulate methods for altering the state of a malfunctioning brain. ... “The advantages of this research approach lie in the fact that these methods not only simulate [biologically plausible] dynamic mechanisms of brain diseases at the neuronal scale, at the level of neural populations, and at the brain region level, but also perform virtual surgical treatments that are impossible to perform in vivo owing to experimental or ethical limitations.

How hybrid cloud and edge computing can converge in your disaster recovery strategy

Hybrid cloud and edge computing are not mutually exclusive. There has been significant growth in hybrid solutions, distributing computing intelligently to combine the benefits of cloud and edge. A bespoke hybrid approach with proper planning and management can enhance your business’s DR strategy. Hybrid cloud’s scalability allows businesses to allocate additional cloud resources during a disaster. These additional resources can be allocated to potentially replace failed edge platforms and devices, maintaining critical applications and systems that are servicing the business needs, while reducing the pressure of the recovery process. The speed benefits of dedicated resources in a hybrid cloud solution are multiplied when combined with the reduced latency and enhanced availability of edge computing. Edge devices can be used to process data locally, and cache essential data which can be recovered to a cloud platform in case of a disaster. Processing on the edge and transmitting key information to the cloud can enrich your data, and inform your DR planning.

Gaining Leadership Support for Data Governance

There is no better way to showcase positive business outcomes than by tracking the ways in which good governance can help tackle obstacles over time. The most obvious of such tracking methods is a data audit. Though an audit may be slightly daunting in terms of its invasiveness in operations, it can be indispensable in uncovering lapses in data quality and risky security gaps in storage and retention. You can cover much of the same territory more informally – and less invasively – through interviews and surveys with stakeholders in the company. With a more open-ended, personalized intake of challenges in governance, these modes of recording can capture the nuances that arise in data integration and glitches in system compatibility, and they’re more likely to harvest the sorts of idiosyncratic insights that might fall through the cracks of a formal audit. Indeed, while Seiner advocates for methods of recording that fall on the more facts-and-figures end of the spectrum – single-issue tracking, analytics, and monitoring – he finds that “one of the most successful ways of doing assessments is simply to talk to people.

Optimizing Risk Transfer for Systematic Cyberresilience

As cyberthreats loom large, enterprises of all sizes are increasingly recognizing the need for cyberinsurance. Cyberinsurance offers financial protection and support in the event of cyberattacks or data breaches. It is predicted that by 2040, the cyberrisk transfer market will become comparable in size to property insurance. However, navigating the cyberinsurance market can be complex and daunting. Understanding the key considerations and making informed decisions are crucial to ensuring adequate coverage and effective risk management. ... In this context, alternative risk transfer solutions such as the use of captive fronting are emerging as crucial tools for managing and transferring cyberrisk. By leveraging a captive solution, enterprises can enhance their cyberresilience, mitigate potential financial losses and navigate cyberinsurance more effectively. Captives help increase the attachment point for the insurance market and act as a solution to cover gaps in the insurance market’s capacity. Insurers are increasingly encouraging the use of captives for cyber.

6 green coding best practices and how to get started

While opting for SaaS dev and test tools may be generally more efficient than installing them to run on servers, cloud apps can still suffer from bloat. Modern DevSecOps tools often create full test environments and run all automated checks on every commit. They can also run full security scans, code linters and complexity analyzers, and stand up entire databases in the cloud. When the team merges the code, they do it all over again. Some systems run on a delay and automatically restart, perhaps on dozens of monitored branches. Observability tools to monitor everything can lead to processing bloat and network saturation. For example, imagine a scenario where the team activates an observability system for all testing. Each time network traffic occurs, the observability system messages a server about what information goes where -- essentially doubling the test traffic. The energy consumed is essentially wasted. At best, the test servers run slowly for little benefit. At worst, the production servers are also affected, and outages occur.

Australia ups ante on cyber security

“The government’s ‘health check’ programme announcement is a valiant effort – the true test will be how it goes about educating the right people across an extremely diverse SMB landscape. ‘Concierge-style’ support only goes so far, particularly if it doesn’t know where to go, and businesses don’t understand why to seek it out. “The problem is SMBs don’t know how to start conversations, nor who to turn to. Working alone makes the cost of cyber security defences untenable, but it doesn’t have to be this way. Your local florist, corner store, or even the grassroots neighbourhood startup can contribute to building Australia’s resilience; they need the education to know why and how to be government compliant, fight increasing cyber insurance premium costs, and protect their customers’ PII [personally identifiable information] data.” On the law enforcement side, Operation Aquila will be stepped up to target the highest priority cybercrime threats affecting Australia, and increased global cooperation will be sought to address cybercrime, particularly through regional forums such as the Pacific Islands Law Officers’ Network and the ASEAN Senior Officials Meeting on Transnational Crime.

CISA Roadmap for AI Cybersecurity: Defense of Critical Infrastructure, “Secure by Design” AI Prioritized

The first “line of effort” is a pledge to responsibly use AI to support the mission, establishing governance and adoption procedures primarily for federal agencies. Already at the head of federal cybersecurity programs, CISA will be the conduit for the development of processes from safety to procurement to ethics and civil rights. In terms of privacy and security, the agency will be developing the NIST AI Risk Management Framework (RMF). The agency is also creating an AI Use Case Inventory to be used in mission support, and to responsibly and securely deploy new systems. The second line of effort directly addresses security by design. This is another area in which establishment and use of the RMF will be a key step, and assessing the AI cybersecurity risks in critical infrastructure sectors is the first item on the menu. This process also appears to involve early engagement with stakeholders in critical infrastructure sectors. Software Bills of Materials (SBOMs) for AI systems will also be a requirement in some capacity, though CISA is in an “evaluation” phase at this point.

How to work with Your Auditors to Influence a Better Audit Experience

Remember, auditing with agility is a flexible, customizable audit approach that leverages concepts from agile and DevOps to create a more value-added and efficient audit. There are three core components to auditing with agility:Value-driven auditing, where the scope of audit work is driven by what’s most important to the organization Integrated auditing, where audit work is integrated with your daily work Adaptable auditing, where audits become nimble and can adapt to change Each core component has practices associated with it. For example, practices associated with value-driven auditing include satisfying stakeholders through value delivery. In my book, Beyond Agile Auditing, I state that stakeholders "value audit work that is focused on the highest, most relevant risks and the areas that are important to achieving the organization’s objectives.[1]" As an auditor, I like to ask my clients questions like "What absolutely needs to go right for you (or your business) to be successful?" or "What can’t go wrong for you (or your business) to be successful?" I do this to help identify what matters and what is most valuable to my client’s business.

Quote for the day:

“Good manners sometimes means simply putting up with other people's bad manners.” -- H. Jackson Brown, Jr

Daily Tech Digest - November 22, 2023

What It Means to Be a Software Architect — and Why It Matters

One of the misperceptions that architects face is that we are engaging in architecture for architecture’s sake, or that we propose new technologies mainly because of the “coolness” factor. Our challenge is to counter this misperception by arguing not merely for the aesthetic value of good design, but for the pragmatic, economic value. We need to frame the need for intentional design as something that can save the company significant costs by averting disadvantageous technology and design choices, producing a distinct competitive edge through market differentiation and paving the way for increased customer satisfaction. ... My commentary on some of Martin Fowler’s views of software architecture is not intended to paint a complete picture of this important role and how it differs from other types of architects. Rather, I’ve sought to highlight the importance of designing the structure of a system at the code level to ensure that the application of relevant patterns results in a design that can sustain cumulative functionality over time, increasing business value while reducing time to market.

5 Ways to Supercharge Incident Remediation with Automation

It’s a balance between your confidence in the automation, the value or cost of the incident and the frequency the task occurs. Common incidents with proven automated steps for diagnosis and remediation are good opportunities to trigger with AIOps. From there, follow a similar process to prioritize your incident response. Automate diagnosis and remediation steps for serious outages to speed resolution. Then focus on increasing efficiency by automating recurring diagnostics and remediation actions that occur across many kinds of incidents. You can safely automate and trigger lower-risk actions such as read-only diagnostic pulls with AIOps, giving downstream personnel the information they need, even when they are paged. You can automate common remediation actions and make them available to responders to use. This automation can utilize secrets management tools such as Vault to enable privileged actions in production environments without sharing credentials, making it safer to delegate to responders.

Tech Pros Quitting Over Salary Stagnation, Stress

Gartner Vice President Analyst Lily Mok told InformationWeek via email CIOs should work with their recruitment and compensation teams to identify IT roles and skills areas facing higher attrition risk and recruitment challenges due to noncompetitive compensation. “This will help pinpoint additional funding will be needed in the short term to address pay gaps,” she says. “Organizations with limited financial resources should prioritize allocating increases to high-risk areas.” She also recommends conducting spot-checks of the market pay conditions on at least a quarterly basis and updating pay benchmarks for key IT roles and skills areas with more recent data. “At very least, I would recommend annual review of market pay levels for key IT jobs and skills area,” Mok adds. ... Another suggestion is to create a separate salary structure for IT, an approach that helps avoid force-fitting IT jobs into enterprise wide pay grades that often place a higher weight on internal equity than external competitiveness when valuing jobs across different functions.

Unlocking Cyber Resilience: The Role Of SBOMs In Cybersecurity

Implementing an SBOM strategy is a step towards fortifying your cybersecurity defenses. While having a list of the components that make up your software supply chain is better than not having one, context is also crucial. You don’t just want to know that you have a given code module—but all of the associated data as well. Vulnerabilities and exploits tend to effect specific versions, so you need to know the details of the versions in your environment, the year and date the code was released, where and how the code is used, etc. Automation is essential. It’s impractical, bordering on impossible to try and manage or maintain an accurate SBOM through any manual process. By automating the SBOM generation and maintenance, the margin for human error diminishes, the speed of response accelerates, and organizations can scale their security practices as they grow. Compliance is another piece of the puzzle. Your SBOM solution should align with industry standards and regulatory requirements, ensuring that you aren't just secure, but also compliant.

CISOs can marry security and business success

While businesses aim for different outcomes, one goal that the business typically prescribes for cybersecurity is business continuity. This is probably due to most executives viewing cybersecurity only as an operational necessity. At the same time, they fail to see cybersecurity’s essential contribution to the due diligence aspect of the procurement process. The complexity and length of procurement processes have increased over the years, as prospective clients use this as part of their third-party risk management. Executives that are aware of clients’ needs can use them to improve the cybersecurity of the organization and its offerings, by translating them into features that will raise the offering’s competitive advantage. Traditionally, R&D and innovation teams perceive the CISO’s role as an obstacle to innovation and advancement. Conventional security entities frequently resort to phrases like “this can’t be done due to security protocols,” obstructing changes to existing infrastructure and impeding innovation. If security is confined to an IT concern rather than recognized as a business imperative, CISOs struggle to emerge as strategic partners.

Advanced Applications of Open-Source Technologies

The Evolution of Open-Source Culture The widespread adoption of open-source technologies is attributed to the culture and philosophy underpinning the open-source movement. Early pioneers in the open-source community championed the belief in the transformative power of collaborative, community-driven efforts and unrestricted access to software source code. For young developers exploring careers, open source presents exciting opportunities. Contributing to open-source projects enables developers to hone their skills, gain visibility, and engage with mentorship from experienced professionals. ... Demonstrated by Brazil’s Amazonia-1 satellite program, Julia is instrumental in in-orbit sensor calibration, showcasing its adaptability beyond conventional software development. NASA, a leader in space exploration, also utilises Julia for various purposes, including gaining insights into the intricacies of Earth’s oceans. This strategic adoption of open-source technology highlights its pivotal role as more than just a developer’s tool, serving as a crucial enabler to tackle real-world challenges on a global scale.

Generative AI is a developer's delight. Now, let's find some other use cases

"We aren't surprised that the most common application of generative AI is in programming, using tools like GitHub Copilot or ChatGPT," Mike Loukides, author of the O'Reilly report, writes. "However, we are surprised at the level of adoption." There is also evidence of a healthy tools ecosystem that has already sprung up around generative AI, the report indicates. ... "Automating the process of building complex prompts has become common, with patterns like retrieval-augmented generation (RAG) and tools like LangChain. And there are tools for archiving and indexing prompts for reuse, vector databases for retrieving documents that an AI can use to answer a question, and much more. We're already moving into the second generation of tooling." ... "Programmers have always developed tools that would help them do their jobs, from test frameworks to source control to integrated development environments. Programmers will do what's necessary to get the job done, and managers will be blissfully unaware as long as their teams are more productive and goals are being met."

In the symphony of enterprise, every business today dances to the silent tune of technology

Not all AI applications have had a positive impact – content writing and the media industry are the worst hit. It was widely believed that creative industries will be the last to be impacted by technologies like AI however the ground realities are very different. One of the demands of the striking Writers Guild of America was that AI will not encroach on writers’ credits and compensation. No matter the core product, all functions of an organization are now utilizing technology in some form or manner – planning, organizing, analysis, marketing, sales, customer engagement or service. Technology has always been a catalyst for progress, often propelling non-tech companies into new realms of efficiency and cost-effectiveness. From the industrial revolution’s steam engines to the digital age’s computers, companies outside the technology sector have harnessed innovation to transform their operations. Today, the conductor of this transformative orchestra is artificial intelligence (AI) and the darling subset – Generative AI.

5 pillars of a cloud-conscious culture

“A developer shouldn’t just provision an extra-large server and then leave it running,” says Firment. “Coders have to learn to work in a cloud native way. That requires understanding terms like elasticity, scalability, and resiliency. They need to know what we mean by multiple availability zones. Developers can still leverage their skills in the cloud, but they just have to apply them in the new way.” Building a culture is like building a tribe, and certificates are a good marker of the new tribe. They create a sense of belonging. Rituals are equally important. “As individuals get certified, create a cloud of fame,” says Firment. “That’s a great way to say you value people who develop the skills. And it’s an artifact of the new culture.” Celebrating certification is also highly effective. “Establish a weekly or monthly cloud hour, where people share what they’re learning on the way to getting certified,” he says. “Ultimately, they should share how they’re applying the knowledge and customer success stories. Storytelling is a big part of creating a culture.”

The SSO tax is killing trust in the security industry

Before some of these solutions are adopted, there are steps we can all take. If you are responsible for identity and access management at an organization, have you audited the authentication tokens you rely on to ensure they operate as expected? Have you considered what compensating controls you could put in place? Are there security products that can do that auditing for you or otherwise mitigate this risk in your environment? Do the security questionnaires your company sends to potential SaaS application providers ask how they configure authentication tokens? It is going to take a serious collaborative "security by design" effort between SSO providers, application developers, and browser companies to repair the broken SSO environment we currently operate under. We single out application providers for criticism in this article because they so often charge an upgrade fee to integrate with SSO. If they are going to charge us a tax, they need to step up or share in the blame for the compromises that will continue to happen.

Quote for the day:

"Success consists of getting up just one more time than you fall." -- Oliver Goldsmith

Daily Tech Digest - November 21, 2023

How to apply design thinking in data science

Observing end-users and recognizing different stakeholder needs is a learning process. Data scientists may feel the urge to dive right into problem-solving and prototyping but design thinking principles require a problem-definition stage before jumping into any hands-on work. “Design thinking was created to better solutions that address human needs in balance with business opportunities and technological capabilities,” says Matthew Holloway, global head of design at SnapLogic. To develop “better solutions,” data science teams must collaborate with stakeholders to define a vision statement outlining their objectives, review the questions they want analytics tools to answer, and capture how to make answers actionable. Defining and documenting this vision up front is a way to share workflow observations with stakeholders and capture quantifiable goals, which supports closed-loop learning. Equally important is to agree on priorities, especially when stakeholder groups may have common objectives but seek to optimize department-specific business workflows.

The role of big data in auditing and assurance services

Conventionally, audit judgements rely on sole evidence sourced from structured datasets in an organization’s financial records. But technological advances in data storage, processing power and analytic tools have made it easier to obtain unstructured data to support audit evidence. Big data can be used for prediction by using a complex method of analytics to glean audit evidence from datasets and other sources which encompass organizations, industries, nature, internet clicks, social media, market research and numerous other sources. ... An innovative system will not only enable the application of artificial intelligence embedded Natural Language Processing (NLP) to streamline unstructured data but also ensure its integration with an Optical Character Recognition (OCR). These capabilities and other new cutting-edge technologies will effectively help to convert both structured and unstructured data into meaningful insights to drive audit. Thus, the use of big data is to make it easier to eliminate human errors, flag risks in time and spot fraudulent transactions and, in effect, modernize audit operations, thereby improving the efficiency and accuracy of the financial reporting process.

Operators unprepared for high gains from low-power IoT roaming

A key feature supported by the latest technology is passive or ambient IoT, which aims to connect sensors and devices to cellular networks without a power source and that could dramatically increase the number of cellular IoT devices. This facet is increasingly becoming appealing to several enterprise verticals. NB-IoT and LTE-M are backed by major mobile operators, offering standardised connectivity with global reach. Yet Juniper warned that a key technical challenge faced by operators is their inefficiency in detecting low-power devices roaming on their networks, meaning that operators lose potential revenue from these undetected devices. Due to their low data usage and intermittent connectivity, these devices require constant network monitoring to fully maximise roaming revenue. ... “Operators must fully leverage the insights gained from AI-based detection tools to introduce premium billing of roaming connections to further maximise roaming revenue,” said research author Alex Webb. “This must be done by implementing roaming agreements that price roaming connectivity on network resources used and time connected to the network.”

How to improve cyber resilience by evaluating cyber risk

The biggest challenge in evaluating cyber risk is that we always underestimate it. The impact is almost always worse than what was estimated. A lot of us are professional risk mitigators and managers, and we still get it wrong. Going back to the MGM Resorts cyber attack, I refuse to believe that MGM believed that their ransomware breach was going to cost them US$1 billion in between lost revenues, lost valuation and loss of confidence from both the market and customers. That, to me, is the biggest issue. There is a huge gap there. Even though there are a lot of numbers surrounding the cost of a data breach, they still all significantly underestimate it. So that to me, I think is the biggest area. ... We are spending a lot of time talking about the tools that these actors use, whether it is artificial intelligence (AI), ransomware, hacking, national security threats and so on. To make an impact against this threat we must focus on resilience and what you can tolerate, then understanding what you can withstand and what conditions you can withstand them under.

What Sam Altman's move to Microsoft means for ChatGPT's future: 3 possible paths forward

Microsoft acquires what's left of OpenAI and kicks OpenAI's current board of directors to the curb. Much of OpenAI's current technology runs on Azure already, so this might make a lot of sense from an infrastructure point of view. It also makes a lot of sense from a leadership point of view, given that Microsoft now has OpenAI's spiritual and, possibly soon, technical leadership. Plus, if OpenAI employees were already planning to defect, it makes a lot of sense for Microsoft to simply fold OpenAI into the company's gigantic portfolio. I think this may be the only practical way forward for OpenAI to survive. If OpenAI were to lose the bulk of its innovation team, it would be a shell operating on existing technology in a market that's running at warp speed. Competitors would rapidly outpace it. But if it were brought into Microsoft, then it can keep moving at pace, under the guidance of leadership it is already comfortable with, and continue executing on plans it already has.

Kaspersky’s Advanced Persistent Threats Predictions for 2024

Botnets are typically more prevalent in cybercrime activities compared to APT, yet Kaspersky expects the latter to start using them more. The first reason is to bring more confusion for the defense. Attacks leveraging botnets might “obscure the targeted nature of the attack behind seemingly widespread assaults,” according to the researchers. In that case, defenders might find it more challenging to attribute the attack to a threat actor and might believe they face a generic widespread attack. The second reason is to mask the attackers’ infrastructure. The botnet can act as a network of proxies, but also as intermediate command and control servers. ... The global increase in using chatbots and generative AI tools has been beneficial in many sectors over the last year. Cybercriminals and APT threat actors have started using generative AI in their activities, with large language models explicitly designed for malicious purposes. These generative AI tools lack the ethical constraints and content restrictions inherent in authentic AI implementations.

Alternative data investing: Why connected vehicle data is the future

One of the most promising subsectors of the alternative data realm is geolocation, standing at an impressive valuation of $400 million. Geolocation is prized for its ability to correlate ground-level activities to consumer trends, business health and revenue. But within this sphere, the real game-changer is ‘connected vehicle’ data. Connected vehicle data, a subset of geolocation, is an invaluable resource for investors. It enables analysis of both passenger car and truck activities across almost any location. This opens a window into consumer trends, helping investors decipher current demand dynamics before company earnings calls. Moreover, tracking truck activity provides insights into a company’s supply chain health. By monitoring truck traffic at key economic areas – be it manufacturing facilities, warehouses, distribution centers or seaports – investors can gauge a company’s production, distribution and supply chain efficiencies. This level of detail can provide a holistic view of a company’s operations and its future revenue potential.

The Potential Impact of Quantum Computing on Data Centre Infrastructure

All kinds of use cases involving complex algorithms are the candidates for being addressed using quantum computers. Use cases around financial modelling and risk analysis at macro level, environmental analysis, and climate modelling especially while undertaking the development projects in ecological sensitive areas, supply chain optimisation, life sciences, AI based drug discovery / drug repurposing, custom treatment for complex disease etc would be the candidates for using quantum computing in data centres. Apart from the above, one key area where quantum computing will impact everybody is deep fake. In a very short time, the generative AI has shown its capability of creating fake videos of anybody, with little training material. ... Quantum computing will play key role in providing the required infrastructure support implementation of algorithms which will be able to identify such fake videos and stop them before they become viral and create law & order problems in societies. Players like Facebook (including WhatsApp), Instagram have strong usage requirements of quantum computing to address the menace of fake news and fake videos.

7 steps for turning shadow IT into a competitive edge

A formalized and transparent prioritization process is also important. CIOs need a way to capture lightweight business cases or forecast business value to help prioritize new opportunities. At the same time, CIOs, CISOs, and compliance officers need to establish a risk management framework to quantify when shadow IT creates business issues or significant risks. CIOs should partner with CFOs in this endeavor because when departments procure their own technologies without IT, there are often higher procurement costs and implementation risks. CIOs should also elicit their enterprise architect’s guidance on where reusable platforms and common services yield cost and other business benefits. “Shadow IT often wastes resources by not generating documentation for software that would make it reusable,” says Anant Adya, EVP at Infosys Cobalt. “Insightful and far-reaching governance coupled with detailed application privileges discourage shadow IT and helps build collaborative operating models.” Creating technology procurement controls that require CIO and CISO collaboration on technology spending is an important step to reduce shadow IT.

Running Automation Tests at Scale Using Cypress

With Cypress, teams can easily create web automation tests, debug them visually, and automatically run them in the CI/CD pipelines, thus helping with Continuous Integration (CI) and development. Though Cypress is often compared with Selenium WebDriver, it is fundamentally and architecturally different. It does not use Selenium WebDriver for automation testing. Thus enabling users to write faster, easier, and more reliable tests. The installation and setup part of Cypress is also easier compared to other test automation frameworks as it is a node package. You just need to run the npm command npm install cypress and then use the Cypress framework. ... Cypress offers some out-of-box features to run automation tests at scale. Travel:- Cypress allows you to "time travel" through the web application, meaning it will check out what happens at each step when the tests are executed. We can step forward, backward, and even pause the test execution on run time. Thus providing us the flexibility to inspect the application’s state in real-time test execution. Auto Waits:- Cypress has the inbuilt auto wait functionality that automatically waits for the command and assertion before moving to the next step.

Quote for the day:

"Success is how high you bounce when you hit bottom." -- Gen. George Patton