Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - March 30, 2024

The future of Banking as a Service: Banking trends 2024

Reflecting on the banking industry trends and emerging technologies explored, what does the future hold for Banking as a Service? And is the banking system changing as a result? The unbanked remains high while financial inclusivity is low, but Banking as a Service systems are helping to change that. While their impact on the customer isn’t direct, it enables non-bank providers to explore new and untapped markets, and expand their embed offerings to underserved consumers. With these non-bank providers, fueled by BaaS, consumers aren’t restricted to traditional banking requirements and now have a wider variety of payment and credit options. As this sector progresses, we could see access and inclusivity to financial services increase, with more personalized finance solutions diversifying the industry’s offering. The adoption of Banking as a Service by traditionally non-financial entities is also a top area to watch. Companies in areas such as telecommunications, energy and utilities, and even education are integrating financial services into their systems, streamlining transactions and improving customer experience.

From Despair to Disruption: Zafran Takes on Cyber Mitigation

Zafran aims to close the gap between threat detection and remediation by anticipating and neutralizing threats before they can be exploited by attackers, according to Yashar. She wants to use the funding led by Sequoia Capital and Cyberstarts to make Zafran's platform more scalable, integrate AI to refine the mitigation knowledge base, and assemble a team of top-tier developers, researchers and analysts. "Raising is not hard when you're solving a real pain,"" Yashar said. "The biggest money is going toward the platform and hiring the best talent." On the risk assessment side, Zafran wants to take a customer's existing controls under consideration when determining what vulnerabilities pose the biggest risk to them, which Yashar said will help organizations optimize their return on investment. The company's dashboard helps customers see what risk is most exploitable as well as risk reduction activity they could carry out with their existing controls. Zafran has built a war game simulation that allows customers to check how well their cyber platform defends against existing threats and how much risk is reduced by paying for additional controls.

Infrastructure as Code Is Dead: Long Live Infrastructure from Code

Despite the clear benefits to scale and automation that come with IaC, it remains very complex because cloud infrastructure is complex and constantly changing. As more teams are involved with cloud provisioning, they have to agree how best to use IaC tools and learn the nuances of each one they choose. With these added pressures, fresh solutions promising to improve the developer experience without increasing risk are emerging. To create the next generation of solutions, organizations need to understand where the problems truly lie for development, platform engineering and security teams. ... With multiple tools and frameworks to choose from, learning new languages and tools can be difficult for teams whose experience stems from manual infrastructure provisioning or writing application code. In addition to requiring a new programming language and interface, most IaC tools define and support infrastructure and resource management using declarative languages. That means teams must learn how to define the desired state of the infrastructure environment rather than outlining the steps required to achieve a result, a challenge for new and experienced programmers alike.

The most versatile, capable category twisted pair ever

There are still many situations that don’t require the versatility and performance of Cat6A throughout the entire network but require at the very least multi-gigabit in specific areas of the network for specific applications, but without the hassle of mitigation efforts. The GigaSPEED XL5 solution, a new addition to the GigaSPEED family, addresses the growing sweet spot for a Category 6 solution that can support the intermediate 2.5 and 5.0 GBE bandwidth demands, guaranteed and without mitigation. GigaSPEED XL5 cables can support four connections in a 100 meters channel to support 5G Ethernet. So, it’s ideal for connecting wireless access points located in the ceiling. And because the cable diameter is only slightly larger than GigaSPEED XL cables, the installation tools and procedures are the same as well. Some companies are now beginning the transition from Wi-Fi 6 to more bandwidth heavy Wi-Fi 6E. It will be several more years before the migration to Wi-Fi 7 and its 10+ GbE demands. As a result, the GigaSPEED XL5 solution has an important role to play in enterprise networks for many years to come.

OpenAI Tests New Voice Clone Model

With hyper-realistic voice generation, a criminal could trick family members into scams or worse. And with an election cycle coming up, concerns about deepfakes used to spread misinformation are growing. “This is a massive, dual-edged sword,” Saxena tells InformationWeek in a phone interview. “This could be another nail in the coffin for truth and data privacy. This adds yet more of an unknown dynamic where you could have something that can create a lot of emotional distress and psychological effects. But I can also see a lot of positives. It all depends on how it gets regulated.” ... Max Ball, a principal analyst at Forrester, says voice cloning software already exists, but the efficiency of OpenAI’s model could be a game-changer. “It’s a pretty strong step in a couple ways,” Ball tells InformationWeek in an interview. “Today, from what the vendors are showing me, you can do a custom voice, but it takes 15-20 minutes of voice to be able to train it. While 15 minutes doesn’t sound like a lot of time, it’s tough to get anyone to sit down for 15 minutes during a day of work.”

How to Tame Technical Debt in Software Development

Huizendveld provided some heuristics that have helped him tame technical debt: If you can fix it within five minutes, then you should. Try to address technical debt by improving your domain model. If that is too involved, you could resort to a technical hack. In the event that that is too involved, try to at least automate the solution. But sometimes even that is too difficult; in this case, make a checklist for the next time. Agree on a timebox for the improvement that you introduce with the team. How much time are you willing to invest in a small improvement? That defines your timebox. Now it is up to you and the team to honour that timebox, and if you exceed it, make a checklist and move on. Don’t fix it yourself, if it can be fixed by machines. If it is messy because you have a lot of debt, then make it look messy. Please don’t make a tidy list of your technical debt. The visual should inspire change. Only people with skin in the game are allowed to pay off debt, in order to prevent solutions that don’t work in practice.

How New Tech Is Changing Banking

At its core, blockchain provides a shared record of transactions that is updated in real time. This allows complete transaction transparency while eliminating inefficiencies and risks associated with manual processes. All participants in a blockchain network can view a single source of truth. For banking, blockchain delivers enhanced security and lower fraud risk. Records cannot be altered without agreement from all network participants, preventing falsified or duplicated transactions. Data is also cryptographically secured and distributed across the network. Even if one location is compromised, the data remains validated and secured. Blockchain also brings new levels of efficiency to banking. With an immutable record and smart contracts that execute automatically, blockchain eliminates laborious reconciliation and confirmation steps. Settlement times can be reduced from days to minutes. These efficiencies translate into lower operational costs for banks. By removing intermediaries and allowing peer-to-peer transactions, blockchain also opens up new opportunities in banking. From micropayments to decentralized finance, blockchain enables models that are impossible with traditional infrastructure.

Cloud Email Filtering Bypass Attack Works 80% of the Time

After examining Sender Policy Framework (SPF)-specific configurations for 673 .edu domains and 928 .com domains that were using either Google or Microsoft email servers along with third-party spam filters, the researchers found that 88% of Google-based email systems were bypassed, while 78% of Microsoft systems were. The risk is higher when using cloud vendors, since a bypass attack isn't as easy when both filtering and email delivery are housed on premises at known and trusted IP addresses, they noted. The paper offers two major reasons for these high failure rates: First, the documentation to properly set up both the filtering and email servers is confusing and incomplete, and often ignored or not well understood or easily followed. Second, many corporate email managers err on the side of making sure that messages arrive to recipients, for fear of deleting valid ones if they institute too strict a filter profile. "This leads to permissive and insecure configurations," according to the paper. ... the fact that configuring all three of the main email security protocols — SPF, DMARC, and DKIM — are needed to be truly effective at stopping spam.

RPA promised to solve complex business workflows. AI might take its job

Like most enterprise software companies, RPA vendors are experimenting with generative AI technologies. "Generative AI is poised to amplify the accessibility and scalability of RPA, mitigating the predominant obstacles to entry, namely the need for specialized developers and the risk of bot failure," Saxena said. Alex Astafyev, co-founder and chief business development officer at ElectroNeek, agreed that generative AI will make it much easier to use RPA technology inside companies that have their expensive software developers committed to other projects. "While many RPA platforms follow a low-code approach, thus allowing non-tech users to build automation bots, the knowledge of variables and programming logic might be needed in certain cases. Integration of AI lowers the barrier even further," he said. ... Generative AI technology will also allow RPA systems to deal with complicated problems described with natural language inputs, Pandiarajan said. “In the near future, it is conceivable that you could ask a bot about the status of a customer's package in the fulfillment process, and the AI would understand the process and provide real-time updates," he said.

Why CDOs Need AI-Powered Data Management to Accelerate AI Readiness in 2024

Historically, data and AI governance have been marred by complexity, hindered by siloed systems and disparate standards. However, the urgency of the AI-driven future demands a paradigm shift. Enter modern cloud-native integrated tools – the catalysts for simplifying the adoption of data and AI governance. Pezzetta wishes to leverage AI to clean data and look for anomalies. By leveraging a modernized solution approach, organizations can streamline governance processes, breaking down silos and harmonizing standards across disparate datasets. These tools offer scalability, flexibility, and interoperability, empowering stakeholders to navigate the complexities of data and AI governance with ease. ... “We need to bring AI into our processes. Therefore, we need to define governance processes to develop AI and data together with hubs in business on centralized platforms with integration patterns. I would love to get AI functions in ETL (extract, transform, and load) processes. I hope that we start to use AI in the data pipelines to enhance data quality,” Zimmer adds.

Quote for the day:

“When you fail, that is when you get closer to success.” -- Stephen Richards

Daily Tech Digest - March 29, 2024

Suspected MFA Bombing Attacks Target Apple iPhone Users

Multifactor bombing attacks — also known as multifactor fatigue attacks — are a social engineering exploit in which attackers flood a target's phone, computer, or email account with push notifications to approve a login or a password reset. The idea behind these attacks is to overwhelm a target with so many second-factor authentication requests that they eventually accept one either mistakenly or because they want the notifications to stop. Typically, these attacks have involved the threat actors first illegally obtaining the username and password to a victim account and then using a bombing or fatigue attack to obtain second-factor authentication to accounts protected by MFA. In 2022, for instance, members of the Lapsus$ threat group obtained the VPN credentials for an individual working for a third-party contractor for Uber. They then used the credentials to repeatedly try and log in to the contractor's VPN account triggering a two-factor authentication request on the contractor's phone each time — which the contractor ultimately approved. The attackers then used the VPN access to breach multiple Uber systems.

Finding software flaws early in the development process provides ROI

Unfortunately, enterprise software development teams at many organizations are not finding security-related software flaws as they write their software. As a result, such flaws get shipped in the applications used by customers, partners, suppliers, and employees. This creates serious security risks as threat actors might find and use these flaws to breach enterprise applications and move laterally throughout their target environments. Once a security-related flaw is published to software used in production, the race is on to find the bug first. If a company is lucky, the flaw will be found during a software security assessment by its internal security team or perhaps a third-party provider. If the flaw lingers too long, it’s more likely to be found by an attacker targeting the organization in the hopes of stealing data or perhaps conducting a ransomware attack. The security and increased trust associated with quality software are clear. The return on investment and the business benefits of high-quality and secure software are not always well understood.

7 tips for leading without authority

Leading without authority starts with individuals deciding to create change then bringing people together over a shared goal. If you believe in this strategy and want it to work, make it fundamental to your organizational structure. “We made an intentional transition at the onset of the pandemic to be a fully remote organization,” says Elaine Mak, chief people and performance officer at Valimail. “At the same time, we transitioned from a founder-led to a team-led model.” That transition involved democratizing decision-making, relying on experts within the organization, and leaning into letting people create outcomes through collaboration. “I brought the phrase, ‘Don’t be right, get it right,’ into the organization,” says Seth Blank, Valimail’s CTO. “It’s at the crux of the question of how to lead without authority. If you’re the expert and you bring a team together, come in with humility and ask, ‘How do we do this? How do we learn together?’ If you do that, you can move mountains from anywhere on the organization — if the organization is set up to respond. You need the culture, and you need leaders who expect that. Then people can do amazing things,” Blank says.

Chainguard: Outdated Containers Accumulate Vulnerabilities

EOL software is software that is no longer supported by the creator of the application, either because it is an older version of the software that is no longer maintained, or because the entities that maintained the software are no longer around at all. In either case, vulnerabilities can still be found in these applications, and since they are no longer patched, they soon become a focus for actors with malicious intent. “And the problem becomes aggravated when using container images,” Dunlap writes. “Using a container often means adding additional components from underlying ‘base images,’ which can easily lead to images with hundreds of components, each a part of the attack surface.” The problem only grows worse over time for users, as without regular updates, applications get harder and harder to update to the latest version over time. Looking at software projects listed on endoflife.date, Dunlap found that the longer a project has been EOL, the more vulnerabilities that image will collect. This inspection included images for Traefik, F5’s NGINX, Rust, and Python.

Cisco: Security teams are ‘overconfident’ about handling next-gen threats

Part of the problem that most companies are facing, according to Cisco, is the complicated nature of their security stacks. More than two-thirds of respondents said that their company had more than 10 separate offerings in their security stack, and a quarter said they had 30 or more. “This reflects the way in which the industry has evolved over the years,” the report read. “As new threats emerged, new solutions were developed and deployed to counter them, either by existing vendors or new ones.” Frank Dickson, group vice president for IDC’s security and trust research practice, said that the concern about complicated tool stacks is far from a new one. “We’ve been having that debate in security for ten years,” he said. Efforts to centralize security systems have been around for just as long, he said, but for too long, the offerings peddled as “platforms” weren’t really anything of the sort — more bundles of interrelated products than true foundations for all-around security. That’s finally beginning to change, however, Dickson said.

Saga Pattern in Microservices Architecture

In a typical microservice-based architecture, where a single business use case spans multiple microservices, each service has its own local datastore and localized transaction. When it comes to multiple transactions, and the number of microservices is vast, there comes the requirement to handle the transaction spanning various services. ... The Saga Pattern is an architectural pattern for implementing a sequence of local transactions that helps maintain data consistency across different microservices. The local transaction updates its database and triggers the next transaction by publishing a message or event. If a local transaction fails, the saga executes a series of compensating transactions to roll back the changes made by the previous transactions. This ensures that the system remains consistent even when transactions fail. ... The Saga Pattern can be implemented in two different ways. Choreography: In this pattern, the individual microservices consume the events, perform the activity, and pass the event to the next service. ... Orchestration: In this pattern, all the microservices are linked to the centralized coordinator that orchestrates the services in a predefined order, thus completing the application flow.

Cisco warns of password-spraying attacks targeting VPN services

Security researcher Aaron Martin told BleepingComputer that the activity observed by Cisco is likely from an undocumented malware botnet he named ‘Brutus.’ The connection is based on the particular targeting scope and attack patterns. Martin has published a report on the Brutus botnet describing the unusual attack methods that he and analyst Chris Grube observed since March 15. The report notes that the botnet currently relies on 20,000 IP addresses worldwide, spanning various infrastructures from cloud services to residential IPs. The attacks that Martin observed initially targeted SSLVPN appliances from Fortinet, Palo Alto, SonicWall, and Cisco but have now expanded to also include web apps that use Active Directory for authentication. Brutus rotates its IPs every six attempts to evade detection and blocking, while it uses very specific non-disclosed usernames that are not available in public data dumps. This aspect of the attacks raises concerns about how these usernames were obtained and might indicate an undisclosed breach or exploitation of a zero-day vulnerability.

Understanding Polyglot Persistence: A Necessity for Modern Software Engineers and Architects

Unlock the Power of Polyglot Persistence with ‘Polyglot Persistence Unleashed.’ This comprehensive guide embarks you on a transformative journey, illustrating the integration of MongoDB, Cassandra, Neo4J, Redis, and Couchbase within Enterprise Java Architecture. It delves deep into NoSQL databases, Jakarta EE, and Microprofile, empowering you with the prowess to architect and implement sophisticated data storage solutions for robust and scalable Java applications. From in-depth exploration to practical examples, optimization strategies, and pioneering insights, this book is your ultimate guide to revolutionizing data management in your Java applications. ... The Jakarta Data specification is a beacon of innovation for Java developers. It offers a potent API that effortlessly bridges the diverse worlds of relational and NoSQL databases. It fosters seamless integration of data access and manipulation, adhering to a domain-centric architecture that simplifies persistence complexities.

What Is AI TRiSM, and Why Is it Time to Care?

The goal of AI TRiSM is to place the necessary trust, risk and security guardrails around AI systems so that enterprises can ensure that these systems are accurate, secure and compliant. This can be a daunting undertaking, for while there are many years of governance experience and best practices for traditional applications and structured system of records data, there are few established best practices when it comes to managing and analyzing AI structured and unstructured data, and their applications, algorithms and machine learning. How, for instance, do you vet all of the incoming volumes of data from research papers all over the world that your AI might be analyzing in an effort to develop a new drug? Or how can you ensure that you are screening databases for the best job candidates if you are only using your company’s past hiring history as your reference? ... In contrast, AI systems have few established maintenance practices. When AI is first deployed, it’s checked against what subject matter experts in the field would conclude, and it must agree with what these experts conclude 95% of the time. Over time, business, environmental, political and market conditions change.

Graph Databases: Benefits and Best Practices

The problems that can develop when working with graph databases include using inaccurate or inconsistent data and learning to write efficient queries. Accurate results rely on accurate and consistent information. If the data going in isn’t reliable, the results coming out cannot be considered trustworthy. This data query issue can also be a problem if the stored data uses non-generic terms while the query uses generic terminology. Additionally, the query must be designed to meet the system’s requirements. Inaccurate data is based on information that is simply wrong. Blatant errors have been included. Inaccurate data may include a wrong address, a wrong gender, or any number of other errors. Inconsistent data, on the other hand, describes a situation with multiple tables in a database working with the same data, but receiving it from different inputs with slightly different versions (misspellings, abbreviations, etc.). Inconsistencies are often compounded by data redundancy. Graph queries interrogate the graph database, and these queries need to be accurate, precise, and designed to fit the database model. The queries should also be as simple as possible.

Quote for the day:

“Accomplishments will prove to be a journey, not a destination.” -- Dwight D. Eisenhower

Daily Tech Digest - March 28, 2024

‘ShadowRay’ vulnerability on Ray framework exposes thousands of AI workloads, compute power and data

The vulnerability was disclosed to Anyscale along with four others in late 2023 — but while all the others were quickly addressed, CVE-2023-48022 was not. Anyscale ultimately disputed the vulnerability, calling it “an expected behavior and a product feature” that enables the “triggering of jobs and execution of dynamic code within a cluster.” ... Ray doesn’t have authorization because it is assumed that it will run in a safe environment with “proper routing logic” via network isolation, Kubernetes namespaces, firewall rules or security groups, the company says. This decision “underscores the complexity of balancing security and usability in software development,” the Oligo researchers write, “highlighting the importance of careful consideration in implementing changes to critical systems like Ray and other open-source components with network access.” However, disputed tags make these types of attack difficult to detect; many scanners simply ignore them. To this point, researchers report that ShadowRay did not appear in several databases, including Google’s Open Source Vulnerability Database (OSV). Also, they are invisible to static application security testing (SAST) and software composition analysis (SCA)

Data governance in banking and finance: a complete guide

Data stewardship is an important concept in data governance that is crucial for creating a culture of accountability and transparency around data management. Data stewards are intermediaries between IT and business units, ensuring that data quality is up to the established standard. In principle, data stewardship creates actors within the organization who are interested in and can be held accountable for data management. This helps mitigate data-related risks and maximize the value of data assets. Appointing data stewards alone doesn't fulfill the accountability cycle. Real accountability in data governance goes beyond the operational level. It needs senior management's active involvement. The sophistication and complexity of the accountability and management structures around data governance depend on the data they will govern. Banks are considered to be enterprises with the highest level of data complexity with an additional challenge of regulatory maneuvers. However, the governance infrastructure's exact scale varies with the bank's size.

Will a Google-Apple deal kill Microsoft’s AI dominance?

Even if the deal goes through, Microsoft could still dominate AI. It has a substantial lead in AI, and it’s not taking anything for granted. OpenAI has been quickly releasing new, more powerful versions of GPT — version 4 was released in 2023, and it looks as if a “materially better” version 5 will be available this summer. So ChatGPT and Copilot are constantly becoming more powerful. In addition, Microsoft just hired Mustafa Suleyman, co-founder of DeepMind, which was bought by Google in 2014 and which ultimately became Gemini. After Suleyman sold DeepMind, he founded another AI startup, Inflection AI, and Microsoft has hired not just Suleyman, but nearly the entire AI staff of Inflection, including its chief scientist Karén Simonyan. Microsoft now has the best AI talent in the world either on staff or working for OpenAI. Microsoft has also been busy monetizing AI. Copilot is now built into the company’s entire product line, offered as a fee-based add-on. Microsoft can plow that revenue back into research. And, of course, it’s not a foregone conclusion that Google and Apple will make a deal. Even if they do, it’s not clear how well it will work.

The increasing potential and challenges of digital twins

Evidently, there are many commonalities across these domains when it comes to current obstacles and opportunities for digital twins — but at the same time, there is also variability in how digital twins are perceived and used depending upon the specific challenges faced by each research community. Accordingly, the National Academies of Sciences, ... The report — recapitulated by Karen Willcox and Brittany Segundo in a Comment — proposes a cross-domain definition for digital twins based on a previously published definition and highlights many issues and gaps also echoed by some of the manuscripts in the Focus, such as the critical role of verification, validation, and uncertainty quantification; the notion that a digital twin should be ‘fit for purpose’, and not necessarily an exact replica of the corresponding physical twin; the need for protecting individual privacy when relying on identifiable, proprietary, and sensitive data; the importance of the human in the loop; and the need of sophisticated and scalable methods for enabling an efficient bidirectional flow of data between the virtual and physical assets.

Why CTOs Must Become Better Storytellers

David Lees, CTO of Basis Technologies, says impactful storytelling by CTOs can help demonstrate a complete understanding of stakeholder needs. “Most CTOs know their technological offerings inside and out, and how they can help the organization in the immediate and longer term,” he says. However, CTOs will need to communicate their expertise in a way that is accessible to other C-suite members in non-tech departments, turning complex, jargon-heavy ideas into simpler narratives. Gaining inspiration from stakeholders is not a one-size-fits-all exercise, so an in-depth knowledge of everyone empowers CTOs to tailor their communication on a case-by-case basis. Some employees or investors are motivated by facts and figures, for example pointing out how recent upgrades have doubled service speeds in comparison to a competitor. ... Petrovskis says he recommends ditching whitepapers and reading case studies, but most important is to get out in front of your customers. “Don’t get me wrong, there’s a time and place for whitepapers, but they don’t really provide the real feel of customer issues and understanding the issues your customers face will allow you to be far more relatable to the audiences you’re trying to reach,” he explains.

Navigating the Complexities of Data Privacy: Balancing Innovation and Protection

Certainly, the regulations surrounding the use of personal data have evolved significantly since the Cambridge Analytica scandal, in which a British consulting group obtained personal data from millions of Facebook users without their consent for political advertising purposes. Both Meta (Facebook’s parent company) and Google have introduced privacy guides — albeit somewhat intricate — aimed at empowering users to prevent a recurrence of such a notorious incident. Yet, while tech giants like Google and Facebook can readily afford the expenses associated with robust privacy measures, it raises concerns about the potential burden imposed on innovative but underfunded startups. Fledgling entities, brimming with promising ideas, may find themselves constrained by the necessity for extensive privacy controls, hindering their abilities. For tech businesses, adapting to these privacy laws can mean increased compliance costs and potential innovation delays. For consumers, while their data rights are better protected, the experience of using digital services may become more cumbersome due to consent requirements.

Patchless Apple M-Chip Vulnerability Allows Cryptography Bypass

The new vulnerability is associated with a performance optimization feature called data memory-dependent prefetchers (DMP) in Apple's M1, M2, and M3 microprocessors, which are used to preemptively cache data; they allow the chip to anticipate the next bit of information that it will need to access, which speeds up processing times. DMP "predicts memory addresses to be accessed in the near future and fetches the data into the cache accordingly from the main memory," according to the paper. Apple's specific take on DMP takes prefetching a step further by also considering the content of memory to determine what to fetch, the researchers noted — and therein lies the problem. Many developers use a coding practice or technique called constant-time programming, especially developed for cryptographic protocols. The idea behind constant-time programming is to ensure that a processor's execution time remains the same, regardless of whether the inputs are secret keys, plaintext, or any other data. The goal is to ensure that an attacker cannot derive any useful information by simply observing execution times or by tracing the code's control flow and memory accesses.

AI-Driven Cloud Revolution: Transforming Business Operations and Efficiency

AI-driven optimizations have a significant impact on cloud expenditure for businesses, driving cost savings and efficiency gains across various dimensions. AI algorithms analyze usage patterns to predict resource needs, enabling businesses to automatically scale resources up or down as needed. This eliminates over-provisioning and under-provisioning, ensuring optimal resource utilization and avoiding wasted costs. AI automates tasks like resource management and infrastructure optimization, reducing the need for dedicated personnel. AI helps identify and eliminate underutilized resources and predict hardware failures, preventing downtime and associated expenses. Data management is also optimized by archiving less-accessed data in cheaper tiers and utilizing compression techniques, further reducing storage costs. To help businesses propel, at G7 CR, we reduce their “Cloud spend by minimum 25%”. Also, as mentioned earlier, we are launching the “AI Apps Program”, a cost-effective way to leverage AI and achieve extravagant results.

How AI-powered employee experiences can create an engaged workforce?

AI-driven recruitment platforms are transforming this landscape by automating repetitive tasks, identifying top talent more efficiently, and enhancing the overall candidate experience. AI algorithms help recruiters to analyze vast amounts of data to identify patterns and predict candidate success, leading to more informed hiring decisions. Additionally, AI-powered chatbots can engage with candidates in real-time, providing personalised support and information throughout the application and onboarding process. Virtual assistants, for instance, can improve communication and shorten response times by giving staff members immediate access to resources, information, and assistance. To promote a culture of appreciation and recognition, managers require AI-driven feedback and recognition platforms to promptly provide feedback and acknowledge their team members. Virtual assistants powered by AI can also address common HR inquiries, provide access to relevant policies and procedures, and even offer personalised recommendations for stress management and self-care. Several businesses have started using AI-powered tools to monitor and control employee engagement.

Hackers Developing Malicious LLMs After WormGPT Falls Flat

Crooks are looking into hiring AI experts to exploit private GPTs developed by OpenAI and Bard to jailbreak restrictions put in place by the application developers and create malicious GPTs, he said. "They're looking for things that will help them with generating code that actually does what you're supposed to do and doesn't have all hallucinations," Maor said. A March 19 report by Recorded Future highlights threat actors using generative AI to develop malware and exploits. The report identifies four malicious use cases for AI that do not require fine-tuning the model. The use cases include using AI to evade detection tools used by LLM applications that use YARA rules to identify and classify malware. "These publicly available rules also serve as a double-edged sword," the report said. "While they are intended to be a resource for defenders to enhance their security measures, they also provide threat actors with insights into detection logic, enabling them to adjust their malware characteristics for evasion." Using the technique, Recorded Future altered SteelHook, a PowerShell info stealer used by APT28 that submits the malware source code to an LLM system.

Quote for the day:

"Brilliant strategy is the best route to desirable ends with available means." -- Max McKeown

Daily Tech Digest - March 27, 2024

‘Observability’ Is Not Observability When It Comes to Business KPIs

We all find ourselves in a continual search for faster and faster identification and resolution, but what we really want is to switch to a paradigm of being “proactive.” After all, if we only focus on solving issues faster — falsely equating proactivity with speed — then we’ll forever be responding to fire drills based on technical KPIs. Sure, we’ll get faster at them, but we won’t be making the best decisions for our business. “Proactivity” means running all engineering efforts based on leading indicators of core business metrics. Indicators that map to purchase flows, startup times, user abandonment — the KPIs that are specific to our apps that reflect what our business cares about, like churn, revenue and LTVs. These leading indicators should be specific to our business and should ultimately connect with the end user of our apps. And so the true goal for whatever structure of data that we end up with is that it must reflect the end-user experience — not myopic, disconnected backend metrics and KPIs. Anything less and we cannot connect technical failures to business failures — and definitely not without massive amounts of toil and guesswork.

How security leaders can ease healthcare workers’ EHR-related burnout

EHR systems have been designed to facilitate the billing and documentation aspects of patient care, with health management and patient needs often being an afterthought. For example, charting solutions have recently been adding the ability for patients to exchange messages with their providers via patient portals. This addresses patients’ needs to communicate with their provider, but – without careful design –puts an additional burden on clinicians who now need to spend unbillable time to respond to messages that are interrupting their day. ... Things would be so easy if we didn’t have to put up with those security controls! Thus, a call to action: Take a closer look at where in the ecosystem your policies and/or tooling might contribute to issues that play into a less-than-optimal user experience for your healthcare system’s workforce. By (re-)evaluating how control requirements can be met without standing in the way of modernizing record management systems, CISOs may be able to identify opportunities that will help their CTOs with the task at hand while maintaining an appropriate risk posture

Risky business: 6 steps to assessing cyber risk for the enterprise

A BIA is used to determine the potential business impact should any information asset or system have its confidentiality, availability, or integrity compromised. The first step in a BIA is to identify all relevant information assets, such as customer and financial data, and information used for the operation of services and systems, across all environments and across the entire information lifecycle. Once assets are identified, a value can be assigned to them. Then the extent of any potential security incident can be determined by comparing realistic scenarios comprising the most reasonable impact with worst-case scenarios for each asset. ... Threat profiling starts with the identification of potentially relevant threats through discussion with key stakeholders and analyzing available sources of threat intelligence. Once the threat landscape is built, each threat it contains should be profiled. Threats can be profiled based on two key risk factors: likelihood of initiation — the likelihood that a particular threat will initiate one or more threat events — and threat strength, or how effectively a particular threat can initiate or execute threat events. Threats can also be further profiled by separating them into an overarching group: adversarial, accidental, or environmental.

How Artificial Intelligence Will First Find Its Way Into Mental Health

Although there are many challenges when relying on an artificial bot to interact with patients, there are still areas where artificial intelligence can augment decision-making. Health insurance companies already see the value in AI in reducing costs by identifying patients who are high utilizers of health care services. Prescribing providers routinely receive notifications from health insurance companies regarding irregular refills of prescriptions to encourage discontinuation of prescriptions that are not optimally used. Indeed, large insurance companies possess sizable datasets that are currently being analyzed to predict the onset of Alzheimer’s, diabetes, heart failure, and chronic obstructive pulmonary disease (COPD). In fact, AI has already become FDA-approved for specific uses, and currently, AI shines when it is applied to a very specific clinical issue. AI systems are initially being sought to enhance clinical judgment rather than replace clinical judgment. Ideally, AI will enhance clinician productivity by handling mundane tasks and alerting to that which may be equivocal and require further investigation by a human.

Women in IT: 'Significant Strides' Have Been Made, Yet Challenges Persist

The biggest challenge continues to be the underrepresentation of women in the tech industry, according to Meredith Graham, chief people officer at Ensono. "While we have seen improvement in recent years, there is still a large gap, particularly at the senior levels," she said. "To address discrimination and microaggressions, there can't be only one or two women in the room." Graham admits this isn't going to change overnight, and to create a safe work environment for women, there needs to be a collective effort within leadership to continue to create inclusive workplaces and to not tolerate discrimination at any level. "There are several strategies, but the two I have seen success with are women's mentorship programs and ensuring that women are considered for leadership positions," she said. Mentorship programs can encourage and foster growth as well as help women overcome any self-doubt when they have experienced senior mentors guiding them. "We've all had challenges throughout our careers, and learning that those challenges can be overcome is important for continued growth," Graham said.

5 Leadership Misconceptions That Hinder Success

There is a misconception that a leader's role is to dictate orders, perpetuating a command-and-control mentality. Leadership requires action, and leaders are the ultimate decision-makers in a company. However, command-and-control leadership stifles creativity and discourages open communication. Great leaders establish an inclusive working environment where collaboration flourishes, innovative ideas are shared freely, and team members are empowered to contribute their expertise — even if it means challenging preconceived notions. A leader's role is not just to give orders but to inspire, guide and facilitate the success of the team. ... Some leaders think they need to insulate their employees from bad news so the team doesn't get deflated by business challenges. But when leaders shut off communication, the team ends up making up their own stories to fill in the gaps, and the leader ends up isolated. As Jim Collins says, "Face the brutal facts." Great leaders respect their team, win their hearts and minds when they are transparent and see them as partners in overcoming challenges. Transparent communication also creates shared accountability.

Think you can ignore quantum computing? Think again.

Even before the algorithms are officially approved this summer, CIOs should start taking steps. Moody recommends they start by doing a cryptographic inventory to see which public key crypto systems they and their partners use. This isn’t easy, but several vendors are developing tools to help with that process. CIOs can also ensure they assign somebody to lead in the transition, and that they have the funding and expert staff they need. Organizations can also start testing the algorithms in their environments and check their supply chain partners are doing the same. Jeff Wong, global chief innovation officer at EY, says even if they’re not yet required to make a change, CIOs can already start planning NIST-approved algorithms into their cybersecurity upgrades. ... Another thing CIOs should do is protect against “store-now, decrypt-later” attacks. Hackers may be collecting encrypted data already that they can decrypt once quantum computers become big enough and reliable enough to run Shor’s algorithms. Some industries are more affected than others, such as healthcare, financial services, and higher education, where medical records, financial information, and academic records need to be protected for a lifetime.

Striking a balance for sustainable growth in the AI-driven data center

When density rises, however, the extra heat generated creates a challenge because it means additional cooling is required. Meeting that need can take the form of innovative liquid and immersive technologies. At Data4, we are harnessing liquid cooling at our Marcoussis site in the Paris region with European cloud provider OVHcloud and have plans to expand this method to all our campuses. As we expand, this type of optimization is paramount when analyzing new sites and entering new markets. This is the case with the development of our new data center in the city of Hanau near Frankfurt, our first in Germany. With plans to invest €1 billion-plus to develop the 180MW facility on the 25-hectare site in stages until 2032, it will be one of the largest and most powerful data center campuses in Europe. Data centers of such scale are comparatively more efficient than smaller ones, having sufficient space to allow for scaling up to meet accelerated demand and therefore helping future-proof investments to a degree.

The Value of an IT Architect – Why Focusing on Outcomes

First and foremost an IT architect’s main role is to drive change that creates business opportunity through technology innovation. IT architects shape and translate business and IT strategy needs into realizable, sustainable technology solutions, whilst taking end-to-end solution delivery ownership from idea to benefits delivery. Without an IT architect most solutions will end in being more expensive to operate, delivery will be late and customer satisfaction will be poorer. So, the main value of an IT architect is to reduce cost, risk and increase quality. There are several papers that details the value of IT enterprise architecture. One example is a article issued in the Journal of Systemics Cybernetics and Informatics in March 2018 by Kurek et al. The research paper provided empirical indications for the effects of enterprise architecture on 3076 IT projects in 28 organizations. It summarised that it had seen an increase of 14,5% of successful projects, and a decrease of 26,2% of failed projects when the organization has an enterprise architecture. Other studies focusing in on enterprise architecture are finding similar results (see [2-6]), albeit some seem to be contradictory.

Alert: Hackers Hit High-Risk Individuals' Personal Accounts

"This is not a mass campaign against the public but a persistent effort to target people whom attackers consider to hold information of interest," says its guidance for high-risk individuals. The NCSC defines high-risk individuals in a cybersecurity context as anyone whose "work or public status means you have access to, or influence over, sensitive information that could be of interest to nation-state actors." This includes anyone who works in the political sphere, including elected legislators, candidates, staff, and activists as well as academics, lawyers, journalists and human rights groups. Hackers typically pick the fastest, easiest and least technical strategy required to achieve their goal, and that increasingly includes targeting not just high-profile individuals but also their families, said Chris Pierson, the CEO and founder of cybersecurity firm BlackCloak. "We saw this really increase in 2022 with attacks on personal cell numbers and emails in the Twilio, Uber and Zendesk attacks," he said. "We saw, publicly, executives being targeted in association with attacks on large companies like MGM and Dragos."

Quote for the day:

"Nothing in the world is more common than unsuccessful people with talent." -- Anonymous

Daily Tech Digest - March 26, 2024

What Every CEO Needs To Know About The New AI Act

The act says “AI should be a human-centric technology. It should serve as a tool for people, with the ultimate aim of increasing human well-being.” So it’s good to see that limiting the ways it could cause harm has been put at the heart of the new laws. However, there is a fair amount of ambiguity and openness around some of the wording, which could potentially leave things open to interpretation. Could the use of AI to target marketing for products like fast food and high-sugar soft drinks be considered to influence behaviors in harmful ways? And how do we judge whether a social scoring system will lead to discrimination in a world where we’re used to being credit-checked and scored by a multitude of government and private bodies? ... The act makes it clear that AI should be as transparent as possible. Again, there’s some ambiguity here—at least in the eyes of someone like me who isn’t a lawyer. Stipulations are made, for example, around cases where there is a need to “protect trade secrets and confidential business information.” But it’s uncertain right now how this would be interpreted when cases start coming before courts.

What’s behind Italy’s emergence as a key player in Europe’s digital landscape?

Regional cloud providers can respond promptly to needs that hyperscalers do not meet, equipped with more flexible offerings, highly customized services, and attention to local specificities. These are increasingly popular and insistent demands from businesses that require greater flexibility and customization of cloud services to adapt to their specific needs and a widespread presence in particularly strategic geographical regions to offer services that better meet local or sectoral needs. As a result, regions like Italy are increasingly becoming preferred cloud regions, and the data center sector is taking the same parallel path, which sees Italy as Europe's newest data hub. Credit is also due to local providers breaking away from the 'one size fits all' dynamic, offering tailor-made and ad hoc services for the needs of companies migrating to the cloud. ... Combined with the geographic benefits of being based in Italy, the current socio-economic climate, and the focus on regulatory compliance, Italy is well-positioned to solidify its place as a significant player in the future of the European cloud and data center scene.

Customer science: A new CIO imperative

Science is defined by many as the rigorous and systematic identification and measurement of phenomena. In both the for-profit and nonprofit sectors the most important phenomenon is customer behavior and mindset. Customer science puts customer behavior and mindset under a microscope. Is your organization good at customer science? Does your organization measure customer experience? Does your organization employ “scientists” to observe and explain customer behavior based on the data you have collected? ... The path to customer science is fraught with paradoxes. The organizational paradox is that if the “Customer is King” why is there no one in the enterprise with the authority to ensure that every interaction meets or exceeds expectations. Is this the role of the now very much in vogue chief customer officer? The chief experience officer? Glenn Laverty, now retired and former president and CEO at Ricoh Canada, finessed this responsibility/authority paradox tying every employees’ compensation to customer experience/satisfaction metrics. What gets measured and what gets rewarded drive behavior.

Enhancing Secure Software Development With ASOC Platforms

There are many ways to adopt DevSecOps. For those looking to avoid complicated setups, the market offers ASOC-based solutions. These solutions can help companies save time, money, and labor resources while also reducing the time to market for their products. ASOC platforms enhance the effectiveness of security testing and maintain the security of software in development without delaying delivery. Gartner's Hype Cycle for Application Security, 2021, indicated that the market penetration of these solutions ranged from 5 to 20% among the intended clients. The practical uptake of this technology is low primarily because of limited awareness about its availability and benefits. ASOC solutions incorporate Application Security Testing (AST) tools into existing CI/CD pipelines, facilitating transparent and real-time collaboration between engineering teams and information security experts. These platforms offer orchestration capabilities, meaning they set up and execute security pipelines, as well as carry out correlation analysis of issues identified by AST tools, further aggregating this data for comprehensive insight.

The cybersecurity skills shortage: A CISO perspective

Experienced cybersecurity professionals are poached daily, enticed with higher compensation and better working situations. Successful CISOs keep an eye on employee satisfaction and make sure to help staff manage stress levels. Active CISOs also open avenues for staff to grow their skill sets and career opportunities. ... There’s no reason why cybersecurity staff should be underpaid or underappreciated. Proactive CISOs educate the brass on competitive salary comparisons and risks/costs associated with understaffed teams and employee attrition. When it comes to cybersecurity staffing, executives must understand the foolishness of tripping over dollars to pick up pennies. ... How do you bolster staff efficiency without adding more bodies? Automate any process that can be automated. Automating security operations processes is a good start, but advanced organizations move beyond security alone and think about process automation across lifecycles that span security, IT operations, and software development. Examples could include finding/patching software vulnerabilities, segmenting networks, or DevSecOps programs.

Misaligned upskilling priorities could hinder AI progress

“The rapid rise of AI requires business leaders to build and shape the future workforce now to thrive or risk lagging behind in a future transformed by a seismic shift in the skills needed for the era of intelligence,” said Libby Duane-Adams, Chief Advocacy Officer at Alteryx. “Not all employees need to become data scientists. It’s about championing cultures of creative problem-solving, learning to look at business problems through an analytic lens, and collaborating across all levels to empower employees to use data in everyday roles. Continuous investments in data literacy upskilling and training opportunities will create the professional trajectories where everyone can “speak data” and exploit AI applications for trusted, ethical outcomes.” “As India invests US$1.2 billion in a wide range of AI projects, the country’s is set to become a significant force for shaping the future of AI” said Souma Das, Managing Director, India Sub-continent at Alteryx. “As organisations gear up for the future, our research highlights how imperative it is to nurture a diverse workforce with a range of data and analytics abilities to ensure employees are empowered to navigate the dynamic landscape together.

Want to be a DevOps engineer? Here's the good, the bad, and the ugly

"The DevOps ecosystem is huge and constantly evolving," he added. "Tools and frameworks so popular yesterday may be replaced by new alternatives. On top of your regular job as an engineer, you probably need to give up some of your free time for studying." Even when you gain more experience, "the learning doesn't stop," Henry said. "In fact, it's commonly noted as one of the things that DevOps engineers love most about their job. With the pace of development and introduction of AI tools like ChatGPT, DevOps engineering today won't be the same as DevOps engineering two or three years from now." One aspect that may separate passionate DevOps engineers from other colleagues is the infrastructure management part of the job. "If you're not a fan of managing infrastructure, you're going to struggle," Henry cautioned. "This is a big one. As a DevOps engineer, I spend a huge amount of time setting up, configuring, and maintaining the cloud infrastructure that supports various applications. This means dealing with servers databases networks and security on a daily basis. Now, if this excites you, great. This world could be perfect."

Decoding AI success: The complete data labeling guide

Data labeling is essential to machine learning data pre-processing. Labeling organizes data for meaning. It then trains a machine learning model to find “meaning” in new, relevantly similar data. In this process, machine learning practitioners seek quality and quantity. Because machine learning models make decisions based on all labeled data, accurately labeled data in larger quantities creates more useful deep learning models. In image labeling or annotation, a human labeler applies bounding boxes to relevant objects to label an image asset. Taxis are yellow, trucks are yellow, and pedestrians are blue. A model that can accurately predict new data (in this case, street view images of objects) will be more successful if it can distinguish cars from pedestrians. ... Locating and training human labelers (annotators) starts data labeling projects. Annotators must be trained on each annotation project’s specifications and guidelines because use cases, teams, and organizations have different needs. After training, image and video annotators will label hundreds or thousands of images and videos using home-grown or open-source labeling tools.

4 steps to improve root cause analysis

It’s easier for devops teams to point to problems in the network and infrastructure as the root cause of a performance issue, especially when these are the responsibility of a vendor or another department. That knee-jerk response was a significant problem before organizations adapted devops culture and recognized that agility and operational resiliency are everyone’s responsibility. “The villain when there are application performance issues is almost always the network, and it’s always the first thing we blame, but also the hardest thing to prove,” says Nicolas Vibert of Isovalent. “Cloud-native and the multiple layers of network virtualization and abstraction caused by containerization make it even harder to correlate the network as the root cause issue.” Identifying and resolving complex network issues can be more challenging when building microservices, applications that connect to third-party systems, IoT data streams, and other real-time distributed systems. This complexity means that IT ops need to monitor networks, correlate them to application performance issues, and perform network RCAs more efficiently.

From Chaos to Clarity: Streamlining DevSecOps in the Digital Era

No development team deliberately sets out to build and deploy an insecure application. The reason applications with known vulnerabilities are deployed so often is because the cognitive load associated with discovering and remediating them is simply too high. The average developer can only allocate 10% to 20% of their time remediating vulnerabilities. The rest of their time is spent either writing new code or maintaining the application development environment used to write that code. If organizations want more secure applications, they need to find ways to make it easy for developers to correlate, prioritize and contextualize the vulnerabilities as they are being identified. Most of the time when developers are informed a vulnerability has been discovered in their code, they have long since lost context. Vulnerabilities need to be immediately identified at the time code is written, builds are created, and pull requests are made – and identified in a way that is actionable. Otherwise, that vulnerability is likely to be thrown atop the massive pile of technical debt that developers hope they’ll one day have the time to address.

Quote for the day:

“Let no feeling of discouragement prey upon you, and in the end you are sure to succeed.” -- Abraham Lincoln

Daily Tech Digest - March 25, 2024

Two ways to improve GDPR enforcement

Centralised enforcement would certainly add efficiency and consistency to the enforcement process. However, implementation could take years, and even once it’s in place, there’s a risk that member states may disagree about enforcement decisions because one member state could take issue with rulings made by the central enforcement agency. The other foreseeable approach is for the EU to stick with its current decentralised approach to GDPR enforcement, but to invest in measures that would make enforcement more consistent and efficient. ... Developing clearer guidelines about GDPR interpretation would help, too. As a principles-based framework, the GDPR can be overwhelming to interpret, making it challenging for businesses to comply and for enforcement authorities in various countries to determine when a violation has taken place. Centralised interpretation guidance in the form of clarifications about complex GDPR requirements or examples of successful compliance would help ensure more consistent and efficient enforcement of the GPDR, even without a centralised enforcement agency.

How to get your CFO to buy into a better model for IT funding

To ensure persistent teams stay within budget, and thereby reduce risk, it’s crucial that executives understand the fundamental agile principles related to flexible scope and fixed budget. Sometimes, management needs to make a change in direction, and persistent teams allow for this. By using data insights from the quarterly business performance report, the CFO is made aware of situations where the organisation is not tracking towards goals. The executive is then empowered to reprioritise, while still focusing on the ‘why’ or outcome to be delivered. They can change persistent teams’ focus by working with them to swap one initiative for another — rather than asking for additional funding. Making trade-offs means they need to prioritise wisely, as there is a fixed budget to work within. “When there is a change in direction, executives are empowered to make trade-offs to deliver on their needs. It is no longer an ‘ask’ of technology,” says Hubbard, regarding Rest’s use of an agile approach in conjunction with persistent funding. We set up a persistent pilot team at Rest in 2023 to test out the concept. About three months into the six-month pilot, the team uncovered that one of the initiatives wasn’t technically feasible at this time.

7 Tips for Managing Cross-Border Data Transfers

Partners are great for business, but they can misunderstand and make mistakes, too. Their errors can cost your organization as much as its own mistakes can. Take steps to ensure all third parties you work with comply as well. “Increasingly, companies that want to mature and manage their cross-border data transfers are putting in place three-part vendor risk programs that include pre-contract assessments, contractual safeguards model privacy and data protection provisions and data processing addendums (DPAs), and post-contract audits,” says Jim Koenig, a partner at Troutman Pepper and co-chair of its privacy and cyber practice group. The first ensures third parties meet your security requirements and provides an inventory of data transfers. The second -- contractual safeguards model privacy and data protection provisions and DPAs -- “define the specific uses and restrictions on secondary uses, including AI algorithm training, and compliance requirements,” Koenig says. And the last, post-contract audits, “assesses the recipient company’s compliance with the applicable data transfer laws, such as EU GDPR, Saudia Arabia, China’s PIPL and others, and specific contract requirements,” he says.

Getting Ahead of Shadow Generative AI+

Generative AI should help you differentiate what your company does. However, using public LLMs alone will not deliver this, and you will sound the same as everyone else. Companies can make their generative AI strategies more effective and tailored for them and for employees by bringing their own data to the table using retrieval augmented generation, or RAG. RAG takes your own data, gets it ready for use with generative AI, and then passes this data as context into the LLM when your employee asks for a response. RAG is part of solving problems like hallucinations, and it also makes results more relevant for your organization and your customers, rather than getting similar results to other companies that are asking for the same kinds of questions. ... To implement this, you will have to combine various tools from vector data stores and AI integrations to build a RAG stack that makes it easier and faster to get started. Delivering this quickly will help you prevent some of those “off the books” deployments that teams might try to do for themselves while they wait for central IT.

The state of ransomware: Faster, smarter, and meaner

The pace of innovation on the part of ransomware criminal groups has hit a new high. “In the past two years, we have witnessed a hockey stick curve in the rate of evolution in the complexity, speed, sophistication, and aggressiveness of these crimes,” says John Anthony Smith, CSO and founder of cybersecurity firm Conversant Group. ... “They have combined innovative tactics with complex methods to compromise the enterprise, take it to its knees, and leave it little room to negotiate,” Smith says. One sign of this is that dwell time — the length of time before the first entry to data exfiltration, encryption, backup destruction, or ransom demand — has dramatically shortened. “While it used to take weeks, threat actors are now often completing attacks in as little as four to 48 hours,” says Smith. Another new tactic is that attackers are evading multifactor authentication by using SIM swapping attacks and token capture or taking advantage of MFA fatigue on the part of employees. Once a user authenticates themselves, tokens are used to authenticate further requests so that they don’t have to keep going through the authentication.

Companies are about to waste billions on AI — here’s how not to become one of them

As you think about saying yes to that next AI project, look at the cost of the needed resources, today and over time, to sustain that project. Ten hours of work from your data science team often has 5X the engineering, DevOps, QA, product and SysOps time buried underneath. Companies are littered with fragments of projects that were once a good idea but lacked ongoing investment to sustain them. Saying no to an AI initiative is hard today, but too frequent yes’ often come at the cost of fully funding the few things worth supporting tomorrow. Another dimension to cost is the increasing marginal cost that AI drives. These large models are costly to train, run and maintain. ... The simplest bets are the ones that better the business you are already in. The old BASF commercial comes to mind: “We don’t make the things you buy, we make the things you buy better.” If the application of AI provides you momentum in the products you already make, that bet is the easiest to make and scale. The second easiest bets are the ones that let you move up and down the value chain or laterally expand to other sectors.

Securing Modern Banking Applications – Do’s and Don’ts

The consumer also plays a pivotal role in the security of their mobile banking. As the device user, consumers and/or employees need to beware of banking applications that ask for tons of accessibility permissions. Granting accessibility permissions without closely looking at what they are requesting can be risky because these permissions can give apps broad control over a device’s functionalities. Banking trojans will often ask for and then exploit accessibility features to automate transactions, capture sensitive data (such as passwords) or overlay fake login screens on legitimate banking apps. Just because the app is legit, consumers should still proceed with caution, knowing that trojans will often use this “preconceived trust” as a launching pad for their destructive attacks. Consumers should also avoid downloading banking apps from unvetted sources, such as third-party app stores that lack the rigorous security controls that actual Apple or Android stores have. Lastly, beware of phishing emails, URLs or texts that look legitimate. Threat actors will often reverse-engineer banking apps to steal logos and other icons to imitate the actual app.

8 cybersecurity predictions shaping the future of cyber defense

By 2028, the adoption of GenAI will collapse the skills gap, removing the need for specialized education from 50% of entry-level cybersecurity positions. GenAI augments will change how organizations hire and teach cybersecurity workers looking for the right aptitude, as much as the right education. Mainstream platforms already offer conversational augments, but will evolve. Gartner recommends cybersecurity teams focus on internal use cases that support users as they work; coordinate with HR partners; and identify adjacent talent for more critical cybersecurity roles. ... By 2026, enterprises combining GenAI with an integrated platforms-based architecture in security behavior and culture programs (SBCP) will experience 40% fewer employee-driven cybersecurity incidents. Organizations are increasingly focused on personalized engagement as an essential component of an effective SBCP. GenAI has the potential to generate hyperpersonalized content and training materials that take into context an employee’s unique attributes. According to Gartner, this will increase the likelihood of employees adopting more secure behaviors in their day-to-day work, resulting in fewer cybersecurity incidents.

Data Security Posture Management in the Education Sector: What You Need to Know

The first and perhaps most crucial step is identifying where all instances of student data reside within your institution. With a best-of-breed DSPM solution, advanced machine learning (ML) and AI can autonomously scan and categorize student data, regardless of where it’s stored (including in structured and unstructured data repositories, email/messaging applications, or cloud or on-premises storage), including its semantic context. It can identify the data, learn its usage patterns, and determine if it’s at risk. This thorough discovery and identification process is also especially important for educational institutions aiming for FERPA compliance. ... The ability to identify and classify sensitive student data puts institutions in a great place, but once identified, any vulnerabilities and risks found must be remediated. Leveraging deep learning, DSPM solutions can compare each data element with baseline security practices used by similar data to detect risk -- even without relying on rules and policies. Even better is to address these access risks in real time -- whether that means remediating access control issues, disabling sensitive file sharing, or blocking an attachment in a messaging platform.

API Security Best Practices That CTOs Can Action Today

The basic function of APIs is to facilitate the exchange of data from one system to another, a process that inherently multiplies potential security risks. The current pace of innovation, with new services, features, and operations being rolled out almost daily, means that several foundational security practices are often overlooked. This oversight can dramatically decrease an organization’s security posture because APIs, by their very design, open up access to data and systems – often beyond the direct control of the organization. This aspect of APIs – the “link” to external entities – is a double-edged sword. While it enables unprecedented levels of interconnectivity and functionality between applications, it also demands that security controls be as robust and comprehensive as those applied to internal access management. However, therein lies the problem: while developers and IT professionals are adept at quickly setting up APIs in the interests of enhancing their services and operations, they often don’t apply the same security standards as they would to strictly internal operations.

Quote for the day:

"The more I help others to succeed, the more I succeed." -- Ray Croc