Daily Tech Digest by Kannan Subbiah

August 21, 2015

Less Dogma Equals Better Decision Making

To seize new opportunities, executives need to constantly review their articles of faith—or convictions of how the world works. The challenge, however is that too many of today’s leaders “like what they like” and “know what they know”. New and valuable information is often declared anathema or quickly discarded, especially when it contradicts an already stated direction or opinion. Moreover, our information systems aren’t helping very much. That vaunted “single source” of truth whether enterprise data warehouse in the early 2000s or enterprise data lake today, still looks far from reality, especially as today’s data lakes are mostly used as data dumping grounds from which various LOB data marts import spurious and questionable data sets.

What Keeps Intel’s CISO Up at Night?

Within Intel’s own IT organization, one thing that helps address the complexity of securing the infrastructure and stay on top of the latest in security tech is partnering with security vendors instead of simply paying them for their products and services, Conran said. Intel has such a partnership with CyberArk Software, a security company whose market debut last September was one of the year’s hottest tech IPOs. Instead of worrying about securing the perimeter, CyberArk specializes in dealing with threats that are already inside the enterprise network. The company is an expert in privileged account security, Udi Mokady, its president and CEO, said. Hackers gaining access to privileged accounts is one of the leading threats today.

4 Ways to Lead Ruthless Innovation

Ambitious, determined, focused entrepreneurs don't choose a career in civil service at a local government office. Similarly anyone looking for two-hour lunch breaks and an easy workload shouldn't choose to work in a fast growing Fortune 500 company that sprouts more innovation every 12 months than many companies create in a lifetime. Amazonians who did their research well prior to accepting a job offer should not be surprised. When I read the New York Times article I winced at some of the personal examples, but quietly nodded along with some of the points of intense focus and relentlessness.

Data security, the achilles heel of DevOps

Forty-six percent of DevOps leaders report data issues as the biggest challenge to enabling their organizations to use DevOps in testing environments. A majority indicate that developers and quality assurance personnel have access to production data, yet this access is not audited (72%). More than two-thirds of all respondents (71%) report that masked data is refreshed from production only once a week or less. Still, a majority, 62%, say full production data is necessary for development and quality assurance. What's unclear is how much of this data may be sensitive or personally identifiable information. The more copies that get sent out to other parts of the organization -- or even outside -- the greater the risk of it being compromised.

Windows Server Getting Open Source Mesos Container Technology for Scaled Operations

Microsoft this week announced its third preview of Windows Server 2016 which features Windows Server Containers, built on Docker's open source container technology. This Docker operating system virtualization technology is designed to make it easier to deploy applications without conflict. Like Mesos, Docker's container solutions were originally designed for Linux servers. The new Mesosphere partnership announced today to bring Mesos to Windows Server is just another open source project overseen by the Apache Mesos organization. The code will be "freely available" and it will integrate with Mesosphere's DCOS, according to Microsoft's announcement. The latest version of the code is already available at the Apache Mesos GitHub repository.

C-Suite and Techies: Best Security Results for the Least Cost

Implementing a new solution does not always require high expense. There are many free and open-source security solutions that should be considered as well. Often, open-source solutions can operate on less expensive or older hardware while providing capability and security equivalent to many commercial options. Open source is not always going to provide the best solution, it might not even provide your organization with a viable option. However, it is important to at least consider open-source solutions when a solution survey is performed. Skipping open source for an odd reason, such as there is no dedicated technical support, because there is no-one to sue, or because of the belief that anything good has to be paid for, is just silly and short-sighted.

Algorithmic Video Editor Turns Amateur Athletes into GoPro Heroes

Software isn’t capable of creative decisions, but Allen says the relatively formulaic structure of extreme sports videos is within its grasp. Shred’s software sets out to make movies that begin with slow moving, establishing shots, for example showing the beach or ski slope at the start of a trip; transition to highlights of the adrenaline pumping action; and then wind down with more shots of scenery and people at the end. “That formula still works even though you’re not doing the most extreme backflips,” says Allen. The software selects footage to use by looking at time stamps and the pattern of acceleration in the frame. It can also shorten and remix any song provided by the user, using algorithms that can identify and edit the different musical parts of a track.

Five digital disruptors talk successes and strategies

"The killing of the IT tile was a rebranding of who we are as an organization and how we're delivering," Colangelo said. Like other platform companies -- Colangelo pointed to Twitter and Netflix as examples -- technology is the backbone of this new business model, not just an enabler of business as usual. "The CTO role at Twitter and other organizations is more public facing and technology is core to product delivery," he said. "That's the recognition at HMH -- that technology is fueling and unlocking so much in the company." Colangelo retains his CIO responsibilities and continues to run HMH's enterprise services and back-office functionality; he's still shifting on-premises applications to the cloud and building an IT as a service model for the business. But his position no longer begins and ends in the back office.

Google Reveals How It Scales Its Network

One major reason for sharing information about its network now is that Google is opening up its infrastructure and offering Google Cloud platform services to others, Google Fellow Amin Vahdat told CIO Journal. “Having a great distributed computing infrastructure requires a world-class network to connect servers together,” he said. Google said it would like developers at other companies to understand they can run jobs such as Big Data analytics on its infrastructure with reliable speed and performance. The company has not shared this level of detail previously because it considers networking a key differentiator, he said. ... “We have some big challenges around availability, configuration and management of the infrastructure and overall predictability,” said Dr. Vahdat

Vulnerability in enterprise-managed iOS devices puts business data at risk

The impact to enterprises depends on the kind of information that might be exposed through their managed app configurations. Appthority scanned millions of apps and found that the majority of those with vulnerable configuration data were MDM clients, corporate apps that grant access to work email and business documents and secure browsers used on internal networks. "We also found apps used in the healthcare industry, giving doctors access to patient data and records," whose compromise could result in possible violations of the Health Insurance Portability and Accountability Act (HIPAA), the researchers said.

Quote for the day:

"Just because something is easy to measure doesn't mean it's important." -- Seth Godin

August 20, 2015

10 Tips to Improve your Corporate Sustainability

Most sustainability initiatives are initiated without a thorough analysis of their outcomes. Many of them are funded for many years, with very little due diligence on their outcomes. Every sustainability initiative should always include a feedback loop in the processes that it undertakes. It could start, simply, by periodically assessing the performance and outcomes of the sustainability initiatives. If this is not possible then the initiative itself needs to be reviewed and outcomes clearly stated before it is allowed to continue. The feedback loop should reach as many affected stakeholders as possible. Once identified, the initiatives with the strongest feedback loop will most likely be identified as the high performers.

New chips took a backseat to robots and 3D cameras

Intel didn’t talk much about its upcoming Skylake desktop CPUs this week, but it did reveal that the chip has an integrated DSP used for a feature called Intel Smartsound, whch will allow computers to listen out for audio signals without using up too much power. It worked with Microsoft to build an upcoming technology for Windows 10 called Wake on Voice, which will let you walk up to a Windows 10 in sleep mode and bring it to life by saying “Hey Cortana.” Some smartphones already have this always-listening feature, but it’s not available yet on a PC. The catch is, we’re told Wake on Voice won’t arrive with the first Skylake chips, which means it won’t be supported in the first wave of Windows 10 PCs.

Patient care put at risk by IT problems at London NHS trust

Southwark’s continuing care team ran into further difficulties when it emerged that administrators were classifying patients in inconsistent ways on the TCM database. In one case staff were using the “deceased” field in the database to record the date of the end of a care package, creating confusion over whether patients were living or dead, Rochford revealed. In another case, administrators were only classifying cancer patients under palliative care, whether they were terminally ill or not, while failing to record other patients with life-threatening conditions as palliative, she said. “You could not follow a patient history. I could not tell what their diagnosis was, whether it was cancer or dementia, because they were coding them in the wrong way,” she said.

NFV use cases emerge as IoT evolves

IoT applications have very different network requirements and characteristics than the smartphones and tablets that currently dominate mobile networks. CSPs have started to use NFV to build IoT-specific sections of their mobile networks with new, virtual Evolved Packet Cores (EPCs). EPCs have many sub-elements that providers will use in different combinations for specific IoT applications. Virtual EPCs give CSPs the ability to cost-effectively customize their networks for individual customers, industries and applications -- critical in the diverse world of IoT. In addition to the EPC, additional NFV elements that CSPs may use to enable the IoT include routing, security, SDN controllers, monitoring and service assurance.

Design Thinking Comes of Age

Design thinking, first used to make physical objects, is increasingly being applied to complex, intangible issues, such as how a customer experiences a service. Regardless of the context, design thinkers tend to use physical models, also known as design artifacts, to explore, define, and communicate. Those models—primarily diagrams and sketches—supplement and in some cases replace the spreadsheets, specifications, and other documents that have come to define the traditional organizational environment. They add a fluid dimension to the exploration of complexity, allowing for nonlinear thought when tackling nonlinear problems.

Rise of the IoT Architect

It seems sensible to have just such a role dedicated to IoT with the necessary breadth in know-how to oversee the many constituent roles and teams. The challenge of course is that with IoT being so nascent there are very few people with the level of skills, knowledge and business authority let alone actual experience across so many disciplines. Creating current architects can take years and some think that this role may take a decade to establish. Of course that means in the interim there will be challenges, but it also means that organizations who see IoT as being significant to their future need to start investing in such individuals now. The flip side to this is that there are current roles within organizations that already possess elements of the skills required by an IoT architect.

How HTTP/2 Eliminates Technical Debt

The technical debt here is accumulated because the code is tightly-coupled to those hosts (and there’s technical ops debt, too, in maintaining those additional CNAMEs in DNS but for today let’s just focus on the code, shall we?) and any changes to the hosts requires changes to the application. Which is bad, because they can be spread out across a whole lot of code in a larger organization. Domain sharding in the application itself, too, can be a burden on the network and downright horrific for mobile applications as it requires additional DNS lookups along with all the extra overhead associated with TCP connections. A new binary framing layer enables full request and response multiplexing and eliminates the need for multiple connections.

Threat intelligence needs to grow up

“Threat intelligence,” added Glines, “is also internal threats, not just rogue employees but machines and devices that are rogue. It’s also employees that don’t know any better.” Enterprises need to do an internal audit to understand their internal and external vulnerabilities because they can’t protect themselves if they don’t know what they are protecting against. “It’s important to understand the attack life cycle, and there are free and open source information feeds out there. The problem with open source feeds is that they provide a lot of information that is not always valuable.” More boutique vendors will be able to provide companies with more valuable and accurate information that will assess intelligence and invest appropriately based on customer needs.

Francis Ford Coppola muses on power of instinct in data-driven culture

Coppola said he relies on instinct and his subconscious, which for him sometimes acts like a broken record, repeating the same thing over and over, to help surface a good idea or the right fit for a role. Specifically with casting, he said it's hard not to root for each candidate in the moment, so he gives himself space and time to mentally sift through auditions before making a decision. "You know how you go to a party and the next day, one person you met sticks with you. That's what I do with casting. Who stuck with me that I can't stop thinking about?" he said. But risks don't always equate to reward -- even for Coppola.

Version Control, Git, and Your Enterprise

Developers want the power to do whatever they may find a need to do. With Git they have more granular control of what is done and how, then they have experienced with other tools. Often Git’s large array of operations is split into two categories – the porcelain and the plumbing. Obviously making an analogy to something like a sink, the point being made is that the traditional tools let you interact with the porcelain, that is the abstraction and controlled interface to the tool, but Git also lets you get under the basin and behind the faucets to change how version control is executed, including rewriting history. Whether a developer needs that power or not, they like knowing that it is at their disposal to use.

Quote for the day:

“Think continally about what you want, not about the things you fear.” -- Brian Tracy

August 19, 2015

Demystifying Data Governance: What it Is and What it’s Not

The key to establishing a solid data governance foundation is to shift from a reactive approach to a proactive approach. It’s common to adopt data governance after poor data quality results in a bad business outcome or when no one takes responsibility for an error. Having a formalized, proactive data governance approach ensures that somebody is clearly responsible not only for fixing the disasters but also for reducing the likelihood of one occurring. ... The term “data owner” is actually a misnomer because, in practice, what is owned is not the data but the standards that guide users in how to achieve good quality. So while many departments may lay claim to the contents of the data, it is the data governance group itself that owns the structures and the quality rules.

BPM drilldown: Product leadership value discipline

As companies take steps toward digital business-ship, CIOs are increasingly being called upon to optimize customer-facing processes. And they're turning to business process management principles to make that happen. One useful tenet of BPM: deciding which of three core value disciplines -- operational excellence, product leadership and customer intimacy -- is most important to the business and then adopting the characteristics of that discipline. In this webcast presentation, Ken Lewis, ITIL consultant at PA Consulting Group, drills down into the product leadership value discipline, laying out goals for a company that prioritizes it above the others.

How the tech industry is greening its data centers

"Traditionally, data centers were call centers. You put them out in suburban and exurban areas," she says. That's where land needed for the center and cooling has been cheaper."When you start integrating renewable generation and DC power networks into your data center choices, you don't have to go to those exurban and suburban locations anymore. You can put them where you want them and where your talent really wants to be," says Redfield. "The road blocks are the same as to any increased penetration of renewables, she says. "Where the grid is already reliable and there's plenty of baseload power generation, renewals are particularly slow to penetrate." The challenge, she says, is to convince companies that they need renewables where there's already an energy infrastructure – even if that infrastructure is close to being maxed out.

3 Ways The Internet Of Things Will Change Every Business

A big part of the Internet of Things isn’t so much about smart devices, but about sensors. These tiny innovations can be attached to everything from yogurt cups to the cement in bridges and then record and send data back into the cloud. This will allow businesses to collect more and more specific feedback on how products or equipment are used, when they break, and even what users might want in the future. ... The most important thing to do when considering how the Internet of Things will affect your business is to think bigger — much bigger. It’s not just about what kind of products you can make “smart,” or how information could impact your business efficiencies, or how you might sell that data to customers and partners.

Why A Trillion-Dollar Enterprise Practice Desperately Needs Disruption

Clearly, the age-old IT procurement bureaucracy is unable to keep up with current advancements in technology. CIOs spend time and pay hefty fees to draft nebulous RFPs and short-list potential vendors. The RFPs are then floated, in response to which service providers churn out long, flowery proposals where they pitch their track records and show examples of happy clients. The whole process can take anywhere from 4 weeks to over 6 months. But in the age of Watson and the Hoverboard, is this really the right way to build technology? Through my own software services marketplace VenturePact, I work with hundreds of CIOs who'd say it wasn't and have moved on from RFPs.

Amazon's Data-Driven Approach Becoming More Common

"What they were able to do was to go in and increase the staffing before they had significant attrition," Barnett said. "The beauty of systems like this is you're able to link actions to outcomes." The downside to a data-driven approach is t can seem "Big Brother"-ish to staffers. But Glint said the surveys that the company sends out have an 80 to 85 percent response rate. "Employees tend to be willing to share," Barnett said. Another drawback: Relying strictly on numbers can lead to the perception of a cold-hearted workplace. "It's easy to get so hung up on statistics that you miss the value of what that individual brings to the table in terms of personality, connectivity and those intangible pieces," said David Lewis, CEO of HR outsourcing and consulting firm OperationsInc in Norwalk, Conn.

Cisco: Flash exploits are soaring

Corporate security pros need to be on the lookout for malware designed to evade detection and also damage the operating systems of the machines it infects if detection efforts become too persistent, the report says. It uses Rombertik as an example of such malware because it performs pointless operations while it is in security sandboxes in an effort to wait out analysis or to delay discovery. Rombertik attempts to overwrite master boot records and if it fails, will destroy all files in users’ home folders. Should it go undetected, then it starts its primary function, stealing data typed into browsers. “It’s a solid bet other malware authors will not only appropriate Rombertik’s tactics but may make them even more destructive,” the report says.

Physicists Unveil First Quantum Interconnect

One of the most promising forms of number crunching is the quantum computer and its various associate quantum technologies, such as quantum communication, quantum cryptography, quantum metrology, and so on. Physicists have made great strides in building proof-of-principle devices that exploit the laws of quantum physics to perform feats that would be impossible with purely classical mechanics. And yet a significant problem remains. These devices must work in isolation since nobody has perfected a way of joining them together effectively. Today, that changes thanks to the work of Mark Thompson at the University of Bristol in the U.K. and a few pals around the world.

Hacking Case Raises Question on Securities Fraud

Stealing confidential information to trade on it before publication is nothing new, although the cases now seem rather quaint because they involved getting advanced word before print editions were delivered to subscribers. The Carpenter case involved a Wall Street Journal reporter who traded and tipped others in advance of the publication of his “Heard on the Street” columns. As recently 2006, the S.E.C. brought charges against defendants who got an employee of a printing plant to steal pages from coming issues of Businessweek so they could trade on the companies discussed in it. The hacking is not all that different from those cases, except that these defendants did not owe a duty of trust and confidence to the news services or companies whose information they stole, unlike the reporter and the printer.

Microsoft Wants To Put Windows 10 On Every Connected Gadget

Microsoft just released Windows 10 IoT Core, a slimmed-down version of Windows 10 that runs on the $40 Raspberry Pi 2 and Intel's $140 MinnowBoard MAX—credit card-sized computer boards that makers use to prototype connected gadgets. A version certified for Arduino (the granddaddy of hardware hacker boards) is coming, says Tony Goodhew, a program manager in Microsoft's IoT Team. ...Microsoft is courting the garage developers of the connected future to build up support for its IoT platform. "We're presenting what we have to bring to the party," says Goodhew, "rather than trying to bring them to our party, which is what Microsoft has done in the past." Microsoft has partnered with Arduino and the Raspberry Pi foundation and become a Maker Faire sponsor, for instance.

Quote for the day:

“There are two kinds of leaders, cowboys and Shepherds. Cowboys drive and Shepherds lead.” -- John Paul Warren

August 18, 2015

Q2 DDoS attacks double in a year, says Akamai report

The largest DDoS attack of the quarter measured more than 240Gbps and lasted more than 13 hours, but the report said peak bandwidth is typically constrained to a one to two-hour window. ... That attack volume is capable of taking out tier 1 routers, such as those used by internet service providers (ISPs), the report said. DDoS attack activity set a new record in the quarter, up 132% compared with the same quarter in 2014 and up 7% on the previous quarter. Average peak attack bandwidth and volume increased slightly in the second quarter of 2015 compared with the previous quarter, but remained significantly lower than the peak averages observed in the second quarter of 2014, the report said.

Object Storage Solutions with CTERA for HP Helion

At its core, object storage is a scalable and efficient means of combating the challenges associated with the massive amounts of unstructured data enterprises generate every day. It is a viable and fast-growing technology that enables simple deployment of massive data stores. With CTERA and HP Helion, organizations can overcome adoption challenges and transform object storage into a wide variety of managed file services that enable organizations to sync, serve, protect and govern file-based data like never before. We’re going to be talking a lot more about how CTERA can be deployed in conjunction with HP Helion.

What is success for a scrum master?

In order to help Scrum Masters create their own approach we have collected many different views in the Scrum Master Toolbox podcast and have collected some of them here for you to read and refer to in the future. Below you will find a list of 15 tools and approaches that Scrum Masters all over the world use. Experienced Scrum Masters explain how they define and measure their own personal success as Scrum Masters, and share their lessons learned about how to achieve success. From how to deal with stakeholders, to how to improve your coaching skills, to how to help the team achieve a sustainable pace. The lessons shared below come from many years of experience and will help you improve your performance as a Scrum Master.

What CIOs can learn about security threats from 4 recent hacks

Keeping one step ahead of hackers is no easy task for IT security executives. There are so many ingenious hacker ploys, shady tricks and nefarious techniques to compromise your data, it might seem like no company could ever keep up. Cybercrime is clearly on the rise, and CIO have plenty of reasons to be anxious. Four recent high-profile hacks demonstrate that cybercriminals are breaching networks, stealing data and using social engineering to trick employees. We asked several security experts to weigh in on these cases, how they occurred and what CIOs should do to reduce the likelihood of a similar compromise. Hint: it’s more than just installing a new firewall and insisting that employees use antivirus apps.

10 more security startups to watch

The emergence of cybersecurity startups has continued unabated as entrepreneurs vie for corporate customers seeking new technologies to battle ever increasing and innovative attackers. The expertise of these new companies range from various improvements to encryption products to analyzing the wealth of security-incident data gathered from networks to gear that detects the potentially malicious wireless activity of Internet of Things devices. Based on the continued interest in these startups from venture capital investors, these companies will continue to proliferate. Here are 10 more security startups we are watching and why.

The more things change: Value creation, value capture, and the Internet of Things

The mere creation of information does not enable its effective use, however, and so we are well-served to capture the stages between action in the world and improved action in the world. In completing a circuit of the Value Loop, from action back to modified action, information iscommunicated from its location of generation to where it can be processed—perhaps in the case of the tennis racquet, to your smartphone. Information is aggregated over time or space in order to create data sets that can be analyzed in ways that generate prescriptions for action. After all, data from a single tennis stroke do not provide nearly as much value as data over a one-hour practice session, or as much motivation as comparing your stroke with those of relevant peers.

Android for Windows Mobile tools leaked on web

Microsoft has provided plug-in replacements for Google Play and Google Maps. Interestingly, developers also need to swap Google Mobile Ads for the Microsoft Advertising (Ads in Apps) service. If the app uses the Google Cloud Messaging service, according to the leaked Microsoft documentation, developers will need to configure their app server to use the Windows Notification Service instead. But the tool does much more, according to reports on the web. Because Windows Phone has Android running in a Linux virtual machine, Android apps can be ‘side-loaded’ onto Windows Phones, enabling end users to run certain apps that do not use Google Play Services. This is similar to how BlackBerry BB10.3 devices can run Android apps without modification.

How 'vendor bias' is killing your IT budget

Vendors usually have good intentions, but they still have a natural bias toward their own products. That can mean they're unlikely to recommend a competitor's product (often because they're unfamiliar with other products). They may also genuinely feel their own solutions will solve all your problems. Well-meaning or not, vendors simply don't have an objective view of what's possible beyond their limited scope of performance. In the worst case, trusting a vendor can be like asking the fox to design and build a better hen-house. ... What happens if the system doesn't work at all? You spend even more money trying to solve your problems "In any new system, there's at least a bottleneck or two," Gentry says. "You can never right-size every aspect of a system based solely on theory."

Companies hope cybersecurity experts in the boardroom can counter hacks

Data show that corporate boards have a long way to go. Just 11% of public-company boards queried this year reported a high-level understanding of cybersecurity, the National Assn. of Corporate Directors said. A review by the New York Stock Exchange and security firm Veracode found that two-thirds of board members questioned think their companies are ill-prepared for a cyberattack. Yet consulting firm PricewaterhouseCoopers reports that 30% of boards surveyed never talk about cybersecurity at all. That fact raises eyebrows. "There's some liability in not taking every measure you can to protect your clients, to protect your revenue stream," said Gary Matus, managing director at the executive recruiting agency RSR Partners. "To give people confidence, you have to be getting the best advice you can."

How college CIOs brace for back-to-school

It's a combination of value-added service and cost reduction that enterprise IT teams dream of. "What we're doing is actually improving service while at the same time reducing costs," says Haugabrook. "Our wireless project will provide students with more access, and Internet-based television is actually going to reduce our overall cable costs." ... Some of these data-driven decisions include transitioning to a 24-hour help desk to accommodate adult and online learners, as well as training overnight library staff to serve as IT support specialists for late-night queries. What's more, rather than hire full-time employees, VSU is hiring students part-time to function as help-desk technicians, enabling VSU to cut the overall IT budget by 5% this year while offering greater service, Haugabrook says.

Quote for the day:

"Vision without execution is a daydream. Execution without vision is a nightmare." -- Japanese Proverb

August 17, 2015

Five Critical Layers of Next-Gen Data Center Automation and Orchestration

If you look at the modern data center and cloud landscape you’ll notice a lot more interconnectivity and new capabilities to dynamically pass resources. Some solutions even allow for cross-connects for the easier flow of data. The interesting piece here is how all of these technologies, which are currently influencing the end user and corporation, are directly pushing for the evolution of the modern data center through data center automation. Cloud computing, Big Data and IT consumerization have transformed the data center into the central hub for everything. Today, there are entire organizations that are born from a cloud model which resides within the data center.

Polyera Wove Band Boasts Flexible Display

At a basic level, a display is made up of two parts: The first is a frontplane, which is the layer that makes the image you see. The second is a backplane, which is an array of TFTs that control which pixels in the frontplane turn on and off. With Polyera Flexible TFTs, the backplane can be made flexible, making the full display flexible, in contrast to traditional display technologies where the backplane has previously been a constraint. "Most attempts to make flexible displays have relied on depositing traditional electronic materials, such as silicon, on plastic substrates," the company explains on its website. "This approach allows the creation of products with displays in a fixed curve, but the brittleness of these electronics layers makes them unsuitable for products which are dynamically flexible.

Key findings from the 2015 US State of Cybercrime Survey

It’s no wonder, then, that we found rising concern among the 500 US executives, security experts, and others from the public and private sectors who participated in the 2015 US State of Cybercrime Survey. In fact, 76% of respondents said they are more concerned about cybersecurity threats this year than in the previous 12 months, up from 59% the year before. Organizations must summon the vision, determination, skills, and resources to build a risk-based cybersecurity program that can quickly detect, respond to, and limit fast-moving threats. The US State of Cybercrime Survey is a collaborative effort with PwC, CSO, the CERT® Division of the Software Engineering Institute at Carnegie Mellon University, and the U.S. Secret Service.

Target launches new beacon program using a system in need of change

This is the world we live in now. With each new evolution of The Internet of Things, we have to face the fact that every step forward will be faced with a step or two backwards, as those that can... do. Unfortunately, there is no getting around it. Hacks will happen. Should you create something of interest, something on a network, it will be found and it will be cracked. The more you advertise something, the more will know about it.And if you think there isn't a monetary gain to be had from hacking your system... think twice. Your swell new app or system has a user-base, that means there's a database of users that can be sold to the highest bidder.

Are comatose servers your next big IT headache?

To get a sense of the cost of the problem, think about how much you could save if you just turned off a third of the hardware that you manage – got rid of or re-used the licensing, unplugged the hardware, and liquidated the rest of it. It’s a problem with an enormous cost, and even if the study is half wrong, at 15 percent, that’s still a significant cost. Why does this happen? Fundamentally it comes down to the problem of not knowing what you have and what it is doing. It used to be a little easier to keep track of things because in order to roll out new servers, you had to requisition one, send a PO, receive it, inventory it and mark it, so at least you knew what type of silicon you had on your server closet racks. The operating system and software was another story, but at least you had a fighting chance.

For CIOs invested in digital transformation, think platform

It's the technology, the data, the people and the processes that hardwire some capability into your organization. One place where this was attempted in many companies was the implementation of an ERP and the associated transformation. Companies that had all of these processes were messy, disjointed and they suddenly said, 'We ought to have standard processes around finance, around supply chain.' So they built platforms. Some of them were really good -- this is why I've so enjoyed studying Lego; they went after their supply chain and fixed it. Campbell's Soup went after theirs; Nordstrom has an unbelievable supply chain platform.

3 security mistakes developers make with online services

One big danger with online source code comes from the data that is committed there. For example, if developers use a public repository to host the code of an internal application, they could be inadvertently exposing corporate infrastructure details on the internet. Sometimes configuration files refer to internet-facing test systems, user names, passwords, or hidden interfaces. Other intellectual property includes proprietary algorithms, undocumented APIs, or even production data that is being used as test data. Private keys (for SSH, for TLS web servers, for mobile app signing, and more) are found frequently in online repositories, where it is easy to search for them. Small to medium-size businesses are especially likely to leverage free or nearly-free online services this way.

Can big databases be kept both anonymous and useful?

This is a true dilemma. People want both perfect privacy and all the benefits of openness. But they cannot have both. The stripping of a few details as the only means of assuring anonymity, in a world choked with data exhaust, cannot work. Poorly anonymised data are only part of the problem. What may be worse is that there is no standard for anonymisation. Every American state, for example, has its own prescription for what constitutes an adequate standard. Worse still, devising a comprehensive standard may be impossible. Paul Ohm of Georgetown University, in Washington, DC, thinks that this is partly because the availability of new data constantly shifts the goalposts. “If we could pick an industry standard today, it would be obsolete in short order,” he says.

Hackers Find Infiltrating Government Computers is not Mission Impossible

“You would think the federal government would have better safeguards, but ultimately they are only as strong as their weakest employee,” says Daugherty, who has spoken at cybersecurity gatherings. “That boils down to knowledge and training.” Daugherty says security risks are one reason there are concerns about Hillary Clinton using a private server for her e-mail when she was secretary of state. “The potential for sensitive e-mails to be lost is the issue,” he says. “Whether they actually were or were not lost is not the issue, so Hillary's e-mail headache isn't going away anytime soon.” He suggests tips that both government agencies and private businesses need to remember to defend against hackers:

Optimization Analytics Comes to the Mass Market

As computing capabilities became increasingly affordable, companies could use more complex algorithms to handle ever more difficult optimization problems. For instance, the airline industry used it to determine how best to route aircraft between two cities and to staff flight crews. Not only can software find the best solution for scheduling these assets in advance, it also can rapidly re-optimize the solution when weather or mechanical issues force a change in how aircraft and crews are deployed. Airlines were also in the vanguard in the 1980s when they started using revenue management techniques. In this case, the optimization process was designed to enable established airlines to compete against low-cost startups.

Quote for the day:

"The Internet, mobile and social media have ushered in a new normal when it comes to customers' expectations." -- Paul Cho

August 16, 2015

Visa to Deploy Blockchain Research Team in Bangalore, India

Considered the innovation hub of India, Bangalore, which was selected in November to host Visa’s technology center in that country, offers Visa the ability to attract world-class talent in a thriving community with world-class innovation centers and technology facilities. Other Indian technology companies, such as Tata Consultancy Services and Infosys, have invested in blockchain technology. In fact, almost a third of the work done by Indian IT firms is for global banks, and many global banks are trying to jump on the blockchain bandwagon before it’s too late. Visa itself, which outsources part of its technology development to Infosys and other Indian firms, said it is open to working with some of them on blockchain-related developments.

Andrew Duguay, Prevedere on Economic Intelligence from Integrating Public Datasets

The sheer volume of analysis would have taken a detrimentally long time to do with traditional tools such as Excel or legacy statistical packages, making this a new and unique way of harnessing and finding analytical value in Big Data. Our patent pending software uniquely provides any company a competitive advantage. ... Prevedere is a gathering place for publicly available data that is structured, time series, and could possibly relate to businesses. Businesses are using Prevedere to see how their internal metrics are relating to common economic indicators such as Gross Domestic Product, Housing Starts, Consumer Sentiment, Disposable Personal Income and the Purchasing Managers Index.

How Big Data is Driving the Consumerization of Health Care

In conjunction with mobility, big data is changing the way patients engage with their doctors and experience their treatment. Research has found that three out of five patients would choose telehealth visits over in-person appointments for minor check-ups and follow-ups. In PwC's survey, more than 50 percent of respondents would feel comfortable sending a digital photo of a rash or skin problem to a dermatologist for an opinion. Not only is the technology for "virtual treatment" available, but 64 percent of surveyed patients expressed their willingness to adopt new, non-traditional ways of seeking medical attention. In a world where services are available in an instant, doctors must start treating their patients as a customer to continue to meet their needs.

3 Business Alignment Opportunities for CIOs

Most CIOs agree that they need to focus most intently on aligning with the line of business. “While CEOs can have a strategic plan, they do not operationalize it into strategic objectives. It filters down and becomes operationalized by the line of business.” However, CEOs and CIOs need to connect what IT is doing better to their business strategy. This is exciting because it is a new window of opportunity for the CIO to get IT’s priorities right and thereby, secure a better relationship with their CEO. This matters because the CIOs that I am talking to see a strong CEO relationship as being critical to having IT viewed as a strategic business unit.

Bruce McConnell Interviewed by The Open Group

There’s also a reflection of the lack of trust between the major cyber powers these days. How do you build trust? You build trust by working together on easy projects first, and then working your way up to more difficult topics. EWI has been promoting conversations between governments about how to respond if there’s a server in one country that’s been captured by a bot and is attacking machines in another country. You have to say, ‘Could you take a look at that?’ But what are the procedures for reducing the impact of an incident in one country caused by malware coming from a server in of another country? This assumes, of course, that the country itself is not doing it deliberately. In a lot of these attacks people are spoofing servers so it looks like they’re coming from one place but it’s actually originating someplace else.

Secure or not, IoT is everywhere. Get used to it.

One of the ways we can avoid IoT security paranoia -- in addition to standardizing on better authentication mechanisms is to move to the IPv6 stack for all IoT devices and to have IPSec be a requirement for device to device and device to cloud communication. And to use much stronger and longer encryption keys. This is really a necessity because we've effectively run out of IPv4 address space and device proliferation is going to make IPv6 a virtual requirement. But that means broadband and wireless service providers as well as consumer and carrier network equipment manufacturers and the IoT vendors need to get on board with this quickly. And yes, longer/stronger encryption keys for Wi-Fi networks as well as standardizing devices on the current WPA2+AES+CCMP implementation and using end-to end,

Clearing Pathways for Entrepreneurial Innovation - Introduction

Disruptive, transformative innovation is by definition unchartered. Entrepreneurs who propagate revolutionary ideas have the power to reshape markets. This can unseat incumbents and have a short-term, negative impact on jobs. It is no surprise that policy-makers and regulators in many cases have an uneasy relationship with this kind of innovation. ... This report is part of a larger effort by the World Economic Forum to understand entrepreneurship and how policy-makers can best support it. The report focuses on disruptive entrepreneurs, due to their outsized impact on industry transformation and the current scarcity of an effective policy discourse regarding disruptive innovation.

Biometric security: Authentication for a more secure IoT

Consumers are becoming more familiar with, and comfortable with, on-device biometrics. The latest Apple and Samsung mobile phones, as well as many new desktop and laptop computers, contain embedded biometric sensors. These devices also include a Trusted Platform Module, or Trusted Execution Environment, that handles the validation of biometric information separately from the device’s core operating system. This is an important distinction, as those core operating systems are susceptible to malware. When it comes to verifying identity, the IoT has another important distinction. When authenticating to a smart lock, or even a smart car it is important that authentication take place on the smart device rather than on the user’s end.

Seven sins – 4: The Meaning Mistake

Once again, though, don’t laugh at other people’s mistakes, because the enterprise-architecture field is barely any better. If you ask for a standard definition of obviously-important terms such as process or service or capability – let alone enterprise or architecture – you’ll discover very quickly why the collective-noun for people in our trade is ‘an argument of architects’. It’s possible, with some care, to build definition-sets that are consistent within themselves for some aspects of architecture: but there’s still no consistency across the overall space at all – and, by the nature of what we’re dealing with, probably never will be, either.

5 things only disruptors know about the future

There is no “common thread because disruption can come from different directions”, believes Bill Gurley, investor in Uber, Zillow and OpenTable. “Industries get disrupted for different reasons. Technology can disrupt an industry” but so can other things, as explained by Clay Christensen’s Innovator’s Dilemma. To identify opportunities for disruption Gurley proposes to ask, “Where does technology have the opportunity to materially change the user proposition or the user experience? There is so much venture capital available today that you’ll see “Uber for this, Uber for that” but I’m not a believer that every industry needs disruption. ...”

Quote for the day:

"The quality of the company?s board has now become an important evaluation factor for institutional investors." -- Russel Reynolds

August 15, 2015

Refactoring for Software Design Smells

Design smells can have many roots, some are caused by limitations in the programming language (e.g. lack of generic programming support in early Java versions, or the missing lambdas prior to Java 8) others by inexperienced programmers (e.g. applying design patterns without understanding their drawbacks) or quick hacks that are made under time pressure. The book focuses on structural design smells in common object oriented languages like Java, C# and C++, so it's not about software architecture or implementation smells specific to a programming language.

The Promise and Peril of IoT

Healthcare providers are among the earliest to adopt the IoT. The wider deployment of electronic medical records (EMRs) and deployment of telemedicine technology that relies heavily on the type of remote data collection needed IoT to take it further and this convergence is expected to fuel the growth of IoT. With IoT, patients can submit their vitals from home without having to personally visit their physician and thus experiencing an enhanced and timely care, which could be life saving many times. This also helps in healthcare providers innovate further and come up with preventive care plans. Typical IoT devices that we see now are the fitness trackers, smart watches and other wearable devices like smart shoes.

Disrupting beliefs: A new approach to business-model innovation

Executives can begin by systematically examining each core element of their business model, which typically comprises customer relationships, key activities, strategic resources, and the economic model’s cost structures and revenue streams. Within each of these elements, various business-model innovations are possible. Having analyzed hundreds of core elements across a wide range of industries and geographies, we have found that a reframe seems to emerge for each one, regardless of industry or location. Moreover, these themes have one common denominator: the digitization of business, which upends customer interactions, business activities, the deployment of resources, and economic models.

Top 5 trends that are making life easier for data professionals

Data engineers design, build and manage the data infrastructure. They develop the architecture that helps analyze and process data in the way that's most appropriate for the organization, while making sure those systems are performing smoothly. As a result, they work closely with the developers. The application developer creates, tests and programs applications software for computers. At the end of the priority list comes the application designer. Applications fueled by data need to be usable by everyone; it’s said that the app should be so well designed a cat could use it. As business requirements move us into a truly insight-driven economy, data professionals must alter their work methods accordingly.

Interview: Government digital chief Mike Bracken – why I quit

“It is a matter of fact, not opinion, that despite spending over £6bn a year on technology, digital and associated operations, there isn't a government service [developed by a department] that could be considered as a platform, as in that it works for all parts of government. That is a matter of fact,” he says. “We can't just keep making or buying technology solutions in one department and then just chucking it over the departmental wall and saying, 'That will work for the rest of government', because it never does. Ever. New platforms for all of government have to be designed and architected thoughtfully, and probably not by the same people who are fixated, rightly, on in-year policy delivery and massive change to existing service provision.”

Want to be totally secure on the Internet? Good luck

So if I wanted to stay as safe as possible, I would never use Wi-Fi. Experts say most Wi-Fi isn't trustworthy, particularly if it's accessible to the public. When you walk around with your phone's Wi-Fi turned on, your device constantly "probes" for the nearest signal. You've turned your phone into a wandering baby bird, who walks around with a giant name tag asking every signal it finds, "Are you my mother?" Hackers are walking around trying to scoop up those signals. .... I also try to avoid email-based attacks. Called phishing emails, they're emails that seem legitimate but actually contain hacking code or a link to a fake website. So, don't click on links from unknown senders (and be aware that Internet ads might be malware in disguise). Click at your own peril.

Hybrid API Management Architectures Done Right

This pattern is as old as networking itself with a separation of the control plane and the data plane, but it is different to the way most vendors apart from ourselves have architected API management today. These other approaches have essentially fallen into two camps: 1) “route all API traffic through our cloud” or 2) “deploy numerous individual on-premises gateways with a cost per gateway”. Both of these cause single points of failure, deal poorly with scale and end up with oversized costs. When considering APIs for Microservices, IoT and many other modern challenges, it becomes even more obvious that separating how traffic is tracked and controlled from the point of delivery makes even more sense. Control and Data planes should be separate but talk to each other.

Incentivizing Performance in Cloud and Outsourcing Contracts: Key Points

To augment those performance warranties, a common approach is to use a “service level agreement” (SLA). The SLA is a familiar and essential feature in information technology-oriented agreements, such as outsourcing, cloud computing, software-as-a-service and the like. When properly structured and negotiated, SLAs can be an effective tool for more nuanced vendor management than a performance warranty alone could afford. This article will catalog some of the best practices for structuring a service level agreement, and discuss elements enterprise corporate counsel can put to use in the IT and service contracts that come across their desk.

Cloud Computing and the Digital Enterprise:Security Challenges and Opportunities

Digital transformation is leading organizations to adopt cloud, SDN, converged infrastructure and containers. This IT transformation has opened the door to new threats and cyber attacks. Security needs to be built into the fabric through a distributed system that enables visibility and control to ensure comprehensive protection of virtualized and cloud assets. Join this webinar to find out:
What are the top enterprise trends in data center transformation – regarding leveraging cloud, SDN, converged infrastructure and containers?; What are the current technology gaps in today’s security and visibility solutions?; Why are they needed?; and What is the business impact of these gaps?

Analytics Success Requires 3 Types of People

The human element of big data and analytics is probably the most critical factor in building a successful program, but it’s also the least understood. When people think of analytics, they often think of technology and data – and while the sophistication of technology is enabling the capability, the true value lies in the hands of the human beings interpreting and applying the analytics. In other words, analytics provides the greatest value when big data enables big judgment. However, that value will always be limited by how well team members are prepared to work in an analytics-driven business. So where does an organization start? Leaders must first recognize that analytics skill sets must be developed in all of their people, not just the data analysts.

Quote for the day:

"The safest way to get what you want is to deserve what you want." -- Charlie Munger

August 14, 2015

Federal CIOs embrace IT reform, but struggle to move forward

"Federal agency IT execs are neck deep in compliance requirements and mandates," O'Keeffe says. "The history of federal IT is littered with empty, unfunded mandates that failed to deliver value." A common refrain heard in federal IT circles is the admonishment against trying to "boil the ocean." That amounts to an appeal to take large, sweeping calls for reform like FITARA and break them down into smaller, more manageable pieces, and act on them iteratively. In a statement, Rep. Gerry Connolly (D-Va.), one of the authors of FITARA, praises the administration's "efforts to kick-start implementation," but says the low levels of awareness among agency executives about OMB's guidance are a cause for concern.

Rent-A-Botnet Free Cloud-Based Servers May Encourage Cyber Warfare

Cyber warfare extends beyond the virtual and can have a real-life impact on the lives of real people. It's not impractical to assume that within the next 10 years, a widespread attack will be launched against a nation and its people. This attack can result in widespread harm that results in a loss of life or property with a financial impact of billions of dollars. Consider a cyber attack where a nation's transportation system is controlled by an external group of hackers, and you can begin to see how a scenario could unfold that is scarier than the prospect of nuclear detonations. Free servers can be used to heist intellectual property, infiltrate infrastructures and jeopardize high profile individuals email accounts and personal data.

How to hack a Corvette with a text message

This isn't the end of connected car security problems this year. On Tuesday, researchers from the University of California demonstrated at the USENIX security conference how to tap into cellular networks in order to gain wireless access to vehicle driving functions. A dongle, available commercially, is often used by corporations and insurance firms to monitor where and how a car is being driven by employees. Cheap and convenient, nevertheless, security vulnerabilities could place these fleets and their drivers at risk. The control unit is plugged into a vehicle's onboard diagnostic (OBD-II) port, allowing the device to monitor speed, distance and braking -- before sending this data to insurance companies.

Cloud Native Application Platforms – Structured and Unstructured

With so many choices in the market, it’s critical to have alignment between business goals and technology-decision-makers. Instead of measuring the Cloud Native platform based on traditional IT metrics (e.g. cost-reduction), technology teams need to think in terms of business metrics (e.g. time-to-market, market-penetration, customer-satisfaction). Platform vendors, whether they deliver Structured or Unstructured architectures, must be able to clearly show how their technology enables those critical business metrics. ... For many CIOs, creating a PaaS platform strategy will be a top priority in 2015 and 2016. This strategy is an opportunity to reshape how IT is viewed within the business, and an opportunity to redefine processes that are not aligned to quality and throughput of application delivery.

Value disciplines and the operational excellence model for BPM

In this webcast presentation, Ken Lewis, ITIL consultant at PA Consulting, advises businesses to figure out how they're creating value for their customers and to focus on a "value discipline" -- first described by Michael Treacy and Fred Wiersema in a February 1993 Harvard Business Review article -- where customer engagement and experience is key. Here he explains Treacy's and Wiersema's three value disciplines -- operational excellence, product/service leadership and customer intimacy -- and delves into goals for a company that prioritizes the operational excellence model.

Data And Analytics Strategies: What Investors Think

The report indicates that data and analytics strategies are affecting organizations across industries. While the data-driven maturity of companies varies from industry to industry and business to business, momentum is building. Failing to have a data and analytics strategy, or executing one poorly, can negatively impact a company's ability to compete -- and therefore its value. "Data strategies are here to stay across a number of different areas [where] we're going to continue to invest, and it will be a bigger part of our investing thesis as far as where we put our time and energy in the portfolio," said Ron Heinz, managing director at venture capital firm Signal Peak Ventures. Data and analytics strategies need three key elements to succeed: The technology, the ability to execute, and a culture that embraces data-driven decision-making.

Buffer Overflow

In the classic exploit, the person attacking the program or system sends information to the targeted application that is stored in an undersized buffer. The information on the call stack will be overwritten to include the return pointer of the function or method. The information that the attacker sent will set the return point’s value to transfer control to the computer malware or other malicious code stored in the attacking information. At the program architecture level, a buffer overflow vulnerability normally occurs when an attacker successfully finds a violation of the programming assumptions that error checking did not catch or when there is faulty memory manipulation.

US Commerce Department proposes multistakeholder control of ICANN

The most recent development is the July 2015 Proposal to Transition the Stewardship of the IANA Functions from the U.S. Commerce Department's NTIA to the Global Multistakeholder Community (PDF), a 199-page document by the IANA Stewardship Transition Coordination Group (ICG) offering suggestions of how to fulfill the Commerce Department's 1998 Statement of Policy regarding ICANN. The ICG is soliciting public comment about having a multistakeholder group oversee IANA functions. The last date for commenting is September 8, 2015. As to what multistakeholder means, Claburn quizzed Mueller about it. "Multistakeholder is a code word for self-governance by the Internet community," said Mueller. "That's new [as a governing structure] and that's why we're kind of groping along here."

Android, you have serious security problems

"The rash of vulnerabilities being reported in Android and the difficulty in getting them installed on end-user devices is taking its toll on the mobile OS. Fortunately, there are no current indications that such vulnerabilities are being actively exploited in the wild. Still, Android users -- this reporter included -- have reason to be concerned and to remain wary," Goodin wrote. ... Device manufacturers that were slow to issue patches, and telcos that were even slower -- if they even bothered at all. Even though Samsung and HTC had announced that they'd be moving to a monthly patching cycle -- welcome to the best practices of 2003, guys -- Android end-user security would still be at the mercy of the telcos.

Agile Coaching - Lessons from the Trenches

Agile Coach is not a role mentioned in Scrum, Kanban, XP or any other agile framework or practice. It’s grown organically as larger organizations have realized the benefits of agility and appetite has increased for long-lasting change. Coaching can reap amazing rewards if done skillfully. What does a skillful coach look like? Companies that rely on external agile consultants want to know if they are acquiring good coaches with a proven track record and broad industry experience. Companies that prefer raising their own coaches want to identify the people with coaching aptitude. Individuals that pursue the career of an agile coach wonder if they have what it takes to become a coach.

Quote for the day:

“Leadership Principle: As hunger increases, excuses decrease.” -- Orrin Woodward

August 13, 2015

6 Signs You're Going to Fail At Big Data

"Who is getting Big Data right, and what are they doing differently to get positive results?" I'm asked this question often enough to get the sense that few organizations seem to be seeing positive results from their big data efforts. This in spite of the fact that they are investing millions of dollars, spending thousands of hours and betting their business' future on the success of these analytic efforts. While I've tried to articulate how I have seen some organizations get big data "right," it's frequently more compelling to explain how others seem to be getting it terribly "wrong." In this vein, I offer the following six signs that an organization will likely fail at big data, and a bit of guidance on how not to join them.

New Android Serialization Vulnerability Gives Underprivileged Apps Super Status

Vulnerable classes can be found in specific apps or frameworks, implying a more restricted targeted attack. We therefore decided to analyze 32,701 popular Android apps from top developers in order to find such classes. Since using our aforementioned runtime technique to conduct this experiment would take hours to complete, we decided to use a different approach. We created a tool that runs dexlib2 over the apps’ dex files in a mere 93 minutes. The experiment is so fast because it simply performs a very shallow static analysis, whereas adhering to the previous experiment’s technique would have required installing each app on an Android device — an incredibly slow process.

Cybersecurity’s Human Factor: Lessons from the Pentagon

One key lesson of the military’s experience is that while technical upgrades are important, minimizing human error is even more crucial. Mistakes by network administrators and users' failures to patch vulnerabilities in legacy systems, misconfigured settings, violations of standard procedures—open the door to the overwhelming majority of successful attacks. The military’s approach to addressing this dimension of security owes much to Admiral Hyman Rickover, the “Father of the Nuclear Navy.” In its more than 60 years of existence, the nuclear-propulsion program that he helped launch hasn’t suffered a single accident.

Flash-Based Data Storage is Growing Faster Than Anticipated

"The No. 1 reason why customers are adopting it is because of performance," said Arun Chandrasekaran, an analyst at Gartner Inc. "The second reason is ease of use and management. The products are inherently fast and easy to manage." Flash storage lets companies compress data more efficiently and remove duplicate copies of files. The machines are also cheaper to manage and replace; they take up less space in data centers, and require less electricity and cooling. While flash-based storage remains more expensive than hard disk-based systems, prices are declining and drawing in more customers. "The all-flash array market did grow faster than we thought it would," said Eric Burgener, an analyst at IDC.

DOJ wants encryption that still allows law enforcement access

The DOJ is not asking companies to stop offering encryption, a second official said, but to balance the cybersecurity benefits of end-to-end encryption with the risks of losing valuable evidence in child pornography, terrorism, organized crime and other cases. There may be "theoretical risks" with companies retaining access to customers' encrypted data, one official said. "Are there costs and benefits associated with certain implementations of encryption, and are there costs and benefits associated with lack of law enforcement and national security access to communications in crucial cases?" the official added.

AHIMA: Information Governance Earns High Executive Attention

While there are significant numbers of organizations not yet formally on the IG path, there is evidence that growing numbers are prioritizing information governance. For me, among the most significant findings is that 36 percent of the respondents indicate that a senior executive has been designated to sponsor IG. That’s a major sign that IG has established a toehold in healthcare. This means more than a third of the organizations represented are sufficiently convinced to take this step because they see the value of information as a strategic asset. I hang a lot of hope on this indicator, because without senior sponsorship, IG will not move within the organization.

Enterprise data security best practices mean IT teamwork

When the network, security and other specialists collaborate, security reaps the benefits. A Windows administrator is routinely called upon to allow or deny execution of certain file types based on a user's role within a network, for example. The admin may need to deny permission to run executables from end-users' workstations. This gives the enterprise a file-based security control. The network administrator also denies entry of certain executables at the firewall. In this case, network-based security controls are exercised in tandem with the file-based controls for multiple layers of IT security.

A strategy for thriving in uncertainty

In uncertainty, both the strategy process and the strategy itself need to change. The most effective leadership teams focus on the vital few uncertainties that matter, understand the possible scenarios that could develop and identify the critical trigger points that signal a swing to one scenario or another—we call these signposts. This leads to a clear and actionable portfolio of strategic actions that balance commitment with flexibility. And the process shifts from an exercise defined by conditions at a discrete point in time to a cycle of “execute, monitor and adapt,” redirecting the company toward the best opportunities over time.

10 scary hacks from Black Hat and DEF CON

SMB relay, the network version of a long-time hacker favorite attack called "pass the hash," was believed only to work inside Windows networks. Security researchers Jonathan Brossard and Hormazd Billimoria found that that's not actually true and that an attacker can harvest Active Directory NTLM (NT LAN Manager) credentials from the Internet by simply tricking a user to visit a Web page in Internet Explorer, open an email in Microsoft Outlook or play a video file in Windows Media Player. SMB Relay involves using man-in-the-middle techniques to capture authentication requests from a Windows computer to a server and then relay those requests back to the server in order to be authenticated as the user.

Instrumenting the human and socializing the machine

As consumers, we’re all becoming instrumented and taking advantage of the wealth of wearables and sensors now on the market. This “quantified self” concept helps us monitor our health and fitness and take advantage of the masses of data that are produced as we go about our daily lives. The pace of instrumentation is picking up in the workplace as well as employers seek to track employee behavior and optimize work activities. ... Even when we look at fully autonomous vehicles such as self-driving cars, the cars are being socialized to be overly cautious when maneuvering to help avoid surprises for passengers and pedestrians alike. Soft robotics is another area of innovation where robots are being designed with soft and deformable structures to work with unknown objects, in rough terrains, or with direct human contact.

Quote for the day:

"If you don't build your dream, someone else will hire you to help them build theirs." -- Dhirubhai Ambani

August 12, 2015

Digital Business is Creating a Profoundly Different Security & Risk Environment

We are on the cusp of a new era – the convergence of IT, OT and Internet of Things (IoT). While IoT is relatively new, the biggest challenge for security and risk professionals to figure out how to bring OT into the fold in a broader security management program, which was traditionally managed by engineers. These roles are expanding and getting more complex. Security has historically being about confidentiality, integrity and availability, but cybersecurity – where IT, OT and IoT come into play – is bringing safety to the forefront as the fourth element. As digital blurs with physical, it becomes possible for digital means to effect kinetic changes, for the technology and automation of devices, people and physical environments to be used to cause injury or loss.

There is more value in the IoT economy than Big Data analytics

IoT devices aren’t just passive data generators relaying information out to Big Data analytics engines. Control systems are some of the oldest examples of the Internet of Things. For example, 33 years ago in 1982, CMU students built the first Internet Coke Machine, so students could order sodas while still at their desktops, charge the cost, and then go pick it up. At the 1989 Interop conference, Dan Lynch with others created the first Internet ... The value here is in automation and distributed control. Security still needs much more attention when connecting devices over the network, per the recent Wired story on how a car was hacked while being driven.

HP pursues big data opportunity with updated products, services, developer program

"Developers are the new heroes of the idea economy," said Mahony. "Through our Haven and Haven OnDemand platforms, we are empowering these heroes to transform their business through data, by allowing them to harness the value of all forms of information, rapidly connect and apply open source, and quickly access the tools they need to build winning businesses." Also addressing the keynote audience was recent Turing Award winner Mike Stonebraker, CTO and co-founder of Tamr. He said that the development of the column store database was the most disruptive thing I ever did. "It transformed the market," he said, and lead to the Vertica big data platform that HP acquired in 2011.

Digital India: Challenges and Opportunities

As is obvious, digital technology’s impact is visible in a big way due to widespread adoption of smartphones, tablets, and social apps. These offer great ease to customers who can use digital channels for interacting with financial institutions from anywhere anytime. The transformational potential of digital technology had undoubtedly eased the customer connect. Customer convenience is more evident in the smart usage of digital technology, like in the case of online, mobile and now social banking. However the real issue is to offer reliable, secure, and superior customer experience through these new ways, and software testing has a major role to play in ensuring these goals.

Limitations of Technical Debt Quantification: Do You Rely on These Numbers?

Currently available technical debt quantification tools focus only on a few dimensions such as code debt and to some extent design debt and test debt. Such tools do not provide a comprehensive support to detect issues pertaining to other dimensions such as architecture debt or documentation debt. In fact, the comprehensiveness of the supported dimensions is also questionable! For instance, how many design debt issues (or design smells) such tools identify and report? Although, such tools support a set of design rules (that may lead to design smell detection), but such rules are just handful. Further, dealing with false positives (i.e., false alarms) generated by the underlying analysis tools is inherently difficult.

Four Questions to Ask Prospective Storage Vendors

When purchasing storage, there are two main areas of risk: financial and technological. To mitigate financial risk, service providers should ask the vendor about its capacity management and scale model. For example, purchasing too much capacity up front can threaten a provider’s profitability. To avoid financial risk, it is critical that the vendor allows for scaling capacity up and down as needed. To reduce technological risk, service providers should consider if the vendor forces migrations and redevelopment of automation, orchestration and integration when moving from one version to another.

The Internet of Things in Retail

In the next few years, expect to see science fiction become retail fact, as augmented reality enhances trying-on-and-buying everything from clothes, cars and furniture to books, movies, and video games. Expect concerns over privacy (though important) to be offset by the convenience of highly personalized services and customized information. IKEA lets you paint, style and place virtual furniture anywhere you drop their product catalogue through your smart phone or tablet. Lego lets you see and rotate a fully constructed and animated Lego set on top of the box at a kiosk or through your device.

How Wearables Startups Can Overcome The Hardware Challenge

The initial design of a device can take months, along with the time needed to create working prototypes. Hunting for the best manufacturing partners can be challenging, and locating the best materials—at the best price point—is key to production success. Straight-forward design and development costs can start in the hundreds of thousands of dollars. The materials available for the creation of wearable devices, from sharp leather bands to precision-cut stainless steel, form an area ripe for misunderstandings. “You might see some of these materials on an Apple watch, but remember that Apple is getting a volume discount and leveraging their supply chain,” Patel said. "Startups obviously don’t have that advantage, so it’s going to cost more.”

What you need to know about chip-embedded credit cards

The main thing to know is that the chip in the card is communicating with the network behind the terminal to enhance security instead of just forwarding your card number and related data to the network, as with the magnetic stripe approach. ... The chip can communicate a unique encrypted token (or an alias) with the network instead of your actual credit card number. That way, the network, and even the store, won't know your card number. When the token reaches your bank, it is decrypted so the bank can verify your account and then authorize payment. This all happens in a few seconds or less. As to whether the security is necessary, the answer is again, yes, especially for banks, but not necessarily for card users.

Google Cloud Platform's entire big data suite now generally available

Serving as a replacement for MapReduce, Dataflow was designed to analyze pipelines with arbitrarily large datasets, crunching information in either streaming or batch mode. After being pushed out as an alpha release, Google later tacked on an open sourced SDK for Java to make it easier for developers to integrate with Google's managed service in order to port Dataflow to other development languages and environments. Dataflow finally made its way into beta by this April as the ... As for Cloud Pub/Sub, designed for integrating apps and services to then analyze their data streams in real-time, Google Cloud product managers touted in a blog post on Wednesday this release follows a "decade of internal innovation."

Quote for the day:

“Only by binding together as a single force will we remain strong and unconquerable.” -- Chris Bradford