Daily Tech Digest by Kannan Subbiah

September 20, 2016

What To Think About When Moving To The Cloud

In either a private or a public cloud, they need applications to behave a certain way. Unfortunately, it's not always possible to move legacy. A workaround that will require change over a long period, said Stern, is if they put what they can in their private or public cloud until they are able to examine which ones are worth rewriting. Before making the move to the cloud, Alex Hamerstone, GRC practice lead at TrustedSec, said, "Settle on a definition of what the cloud is. It’s really just someone else’s computer. A computer that’s not yours. You should know why you are you moving to the cloud. What are the advantages? Is it cost or that it is easier to maintain?"

Crypto backdoors will be nailed shut

Snowden’s revelations about a backdoor have undermined trust in large amounts of U.S.-made infrastructure, and have had lasting impact. The good news is that new thinking and research about encryption is emerging, with new techniques that can nail shut any attempted backdoors. Alex Russell is a professor at the University of Connecticut, and he has been focusing on the problem of how to ensure that a randomly generated number used to generate encryption keys is in fact random. Russell and his team have shown that by taking the output of the random number generator and running it through a hash function such as SHA-256 hash, a new and truly random number is created that can reliably be used to generate encryption keys.

New path proposed for CPAs in cyber risk management

Evolution of technology and the sophistication of hackers have made cybersecurity one of the most important areas of risk management for businesses. More than 95% of CGMA designation holders participating in a 2015 survey said their companies are concerned with the threat of database breaches, distributed denial of service (DDoS) attacks, phishing scams, and other cyberattacks. ... The proposed frameworks represent an effort by the auditing profession and the AICPA to develop a common foundation for CPAs’ services in response to the growing market demand for information about the effectiveness of cybersecurity risk management programs. “Our primary objective is to propose a reporting framework through which organizations can communicate useful information regarding their cybersecurity risk management programs to stakeholders,” said Sue Coffey

Looking for data loss in all the wrong places

Part of the problem may be that loss prevention tools can’t stand up to new theft targets, the most common of which are personally identifiable information and protected health data. Organizations may also unwittingly alert hackers to their soft targets. Activities that publicize a new or improved service may signal that the service is not yet well secured, the report stated. Besides new projects or products, hackers look for reorganizations and strategic planning activities. This supports the report’s finding that organizations aren’t monitoring data movement in the right places. For instance, only 37 percent of DPB survey respondents said they use endpoint monitoring on physical media, despite the fact that 40 percent of data losses involve some type of physical media.

Banks Are Turning To The Blockchain In A Big Way

Even central banks across the globe have shown their intent to adopt the distributed ledger technology. The Dutch Central Bank has been actively experimenting blockchain and developing the DNBcoin. In July 2016, Bank of England issued a paper that discusses the ‘macroeconomics of central bank issued digital currencies’ which reveals some interesting findings. It says, “In a...model calibrated to match the pre-crisis United States, we find that CBDC issuance of 30% of GDP, against government bonds, could permanently raise GDP by as much as 3%, due to reductions in real interest rates, distorting taxes and monetary transaction costs.” Such findings showcase the potential that the blockchain holds for the financial machinery of a country.

Startup Mentality: What Makes It Good or Bad?

The build – measure – learn loop suggests that speed is a critical factor during successful product development. First, you build the product, then you test its usability (gathering of user feedback and data), and lastly, you acquire critical insights. The insights you get will determine whether the product is ready for deployment, or it needs to be pivoted. The process is then repeated until it results in success. The lean startup method is a prime example of a good, productive mindset when approaching the problem of developing and marketing a product. Instead of being limited to your own company’s predictions and focusing only on early consumer adoption, the continuous monitoring of a product’s usability and tweaking of its features to suit the users’ needs will ensure success upon completion.

Firmware - The New Cybersecurity Target

There are a few fundamental reasons why firmware can make a realistic target: No upgrade path for firmware: In contrast to software, firmware can be more difficult to update. Update policies may not exist; indeed, the ability to update may not even exist. Add to this the resiliency of these systems—literally devices that may sit around for decades. Changes in security requirements (e.g., updated encryption algorithms) may not be reflected in updated firmware. Even unsophisticated attack techniques are highly likely to work across outdated security mechanisms. Traditional methods don’t apply or can be side-stepped: No matter how many layers of security are built into the OS, ultimately a system relies on the underlying firmware to boot and interact with hardware.

Intel's New PC, IoT Chief Brings Fresh Ideas

Nobody inside Intel is coming anywhere near the kind-of-like fatalistic conclusions about where Moore's Law is. Intel has had a stellar track record in delivering node generation like clockwork. Maybe we've moved from a two-year to a two-and-a-half-year cadence, but we already see light at the end of the tunnel. We will continue to drive process technology and nobody is calling timeout on anything. We're working hard on 7-nanometer, we're talking about pathfinding for 5-nanometer. All of that is in the throes. We made a great announcement on Kaby Lake -- that's using an evolution of 14-nanometer transistor geometry that gave a substantially improved user experience compared to Skylake. We're going to continue to do more of that as we continue to drive process leadership.

Cyberspace, Terrorism and International Law

Counter-terrorism policies underscore the need for resilience—the ability to identify terrorist attacks, control the damage and recover. Cybersecurity policy also highlights resilience as critical, and resilience informs development of national computer incident or emergency response teams and cooperation among them. However, cooperation on cyber resilience before or after an incident happens without international legal obligations, which mirrors international law on terrorism. Apart from obligations on law enforcement cooperation, antiterrorism treaties do not include duties to provide assistance to parties attacked by terrorists. This state of affairs also reflects the lack of legal obligations on states to assist countries hit by natural disasters.

Ransomware's next target: Your car and your home

Unless there is clear separation between the engine control units and other systems, hackers could block out the entire car "so you're not even going to get out of your driveway unless you pay," says Samani. This could be a lucrative option for cybercriminals because, while people might be OK with losing some files if they don't pay the ransom, when it comes to a car, they're going to give in, he added. "Quite frankly, if you're sitting in your driveway in 2021 in a self-driving car, if you have to pay two Bitcoins to get to work, what are you going to do? Are you going to pay? Of course you will. If you've got a $60,000 connected car to drive you work and you're being charged $200 to move? You'll pay," he says.

Quote for the day:

"We don't have a choice on whether we do social media, the question is how well we do it." -- @equalman

September 19, 2016

Building the data foundations for smart cities

Emergency services will need to be alerted and receive information as quickly as possible in order to help people affected and deal with any potential escalation. In addition, traffic will need to be intelligently redirected to avoid the affected area; communications networks will need to be flexible enough to direct capacity to where it’s needed; and information will need to be collated to inform citizens about the incident. So it’s essential that smart cities make use of cutting edge data processing and analytics capabilities, and in particular, in-memory latency for external storage. Typically in-memory processing is expensive and limited by the amount of data that can processed.

Cyber-security VCs are holding onto their cash – but that’s OK

“VCs are holding out for companies that are merging to offer more unified-security platforms.” Furthermore, he continues that early-stage companies that were funded in 2015 have since slipped below expectations, with their products quickly shown to be copies, obsolete or simply with revenues that “were not up to expectations.” Jack Gold, principal analyst and founder at J. Gold Associates, agrees that VCs may have got swept away with market hype. “Here’s the problem…if I as a VC find a nice cool company with a new twist on security and I invest in them, there’s a chance I will find six other companies doing the same thing in the same marketplace. “There is an over-abundance of companies trying to get a different bite of the same security meal.”

How ITSM laid the foundation for a cultural transformation

Solving the service management conundrum has allowed Oshkosh to turn its attention to other pressing matters. Schecklman is currently trying to consolidate 15 disparate general ledger systems, including some 20-year-old Mapics and J.D. Edwards ERP software, and operate them under a financial shared services model. Oshkosh is also improving cybersecurity to protect the company's intellectual property, including details about such new machines as the Joint Light Tactical Vehicle, which the Army is using to replace its Humvees. Creating a layered strategy for defending data is crucial because interest in hacking Oshkosh broadens after it wins contracts in foreign countries worldwide, Schecklman says.

CIO Insights: Bring data out of the dark

In this episode of CIO Insights, Martin describes how businesses can use a hybrid analytics architecture to compete effectively, and we discuss how doing data analytics on the cloud is a much safer bet today than ever before. Also, tune in to hear Martin outline the things that CIOs should keep in mind during their transition to the cloud. Don’t miss other episodes in this series of C-level interviews. Also, be sure to set aside time to hear IBM CEO Ginny Rometti, journalist and author Thomas Friedman, IBM Chief Data Officer Inderpal Bhandari and other engaging speakers live at IBM Insight at World of Watson 2016. Martin has a Ph.D. and M.A. in economics from Tufts University and a B.S. cum laude in mathematics from University of Massachusetts Lowell.

The Cloud Is in for Bubble Trouble

Tech companies are beginning to position themselves in the IoT space, but the smart ones are doing so cautiously for one very important reason: the trend is extremely broad and Wall Street has yet to figure out who the winners will be. But that hasn’t stopped everyone from GE and IBM to Cisco and Intel from jumping on the bandwagon. Intel CEO Brian Krzanich recently made a big splash about the chip giant’s evolution from a PC company to one that “powers the cloud and billions of smart, connected computing devices,” meaning IoT. Unfortunately, the chip giant is not nearly as evolved as its PR would seem to indicate. For one thing, Intel’s cloud computing platform is little more Xenon processors for servers. Nothing new there. And those billions of smart devices are powered mostly by ARM, which Softbank is acquiring for $32 billion, ...

Why augmented reality means augmented risk to networks

Three important factors to consider are your mobile device management (MDM) solution, since AR apps like Pokémon GO are focused on the smartphone market. Employee training and awareness is also crucial, since human error and carelessness is often a key vulnerability for cybercriminals to target. The third key factor in an AR risk mitigation strategy should be visibility of app traffic on your network. To protect against sensitive data being exposed, or malicious data being introduced, you need to ensure that you have comprehensive, real-time visibility into all your network traffic, all the time. A variety of tools and solutions exist that purport to offer such network visibility; what you are looking for is intelligent filtering and distribution, including across Layer 7 application flows and encrypted traffic, at line rate with zero loss of packets.

Why your next storage solution may depend on blockchain

Blockchain has become an increasingly hot topic in recent months due to its ability to deliver distributed security. Its impact, however, has mostly evaded storage. The developers at Storj, an open source object store similar to AWS S3 or Microsoft Azure Blob Storage, aim to change that. Storj (pronounced like "storage") hopes to make object storage easier to use through intuitive tooling and documentation, a modern API, and an open source, try-before-you-buy approach. But really, much of the magic derives from blockchain. Think of Storj as a distributed cloud storage network, suitable for static content today but with aims to expand far beyond this in the future. This blockchain-based decentralization allows developers to store data in a secure, performant, and inexpensive way, spreading it across many nodes.

Architecture Is About Tradeoffs

First, any time you adopt a framework for building an application, you are inevitably going to spend time debugging and becoming expert in the framework. So while it is true that our team was able to focus primarily on just writing our business logic in the form of session beans and message-driven beans, it was also true that any time we had an edge case (long running processing, need for a sequence of events to occur in a certain order, complex data updates) we would run into issues with the way we were using the frameworks. This puts a strain on the subset of the team that is expert. Second, migrating to the new version of a Java Enterprise application server is made more complicated by the number of moving parts.

Unix tips: Making troubleshooting with lsof easier

Since lsof has such a huge collection of options, remembering which option to use for what sometimes makes the command hard to use as often or as effectively as you might like. So what we're doing today is looking at several ways to make the use of this very helpful tool a bit easier. We do that by creating useful aliases, by providing something of a "cheat sheet," and by deploying a number of lsof options in a script that makes educated guesses about what you're going after. Both of the aliases below will list whatever files are open on your behalf when you are logged in. I suspect that few sysadmins will want to type “showmyopenfiles.” It might be less of a problem to remember the lsof option or print out a cheat sheet. On the other hand, “showmine” would be somewhat ambiguous – my open files or my processes?

Master data management gains ground in UK public sector

“Where we had blockages in getting data out of old legacy systems that were a bit clunky, we just concentrated on another dataset,” says Farina. He adds that if users had tried the system with just some of the data, they might have dismissed it: “I’ve worked on projects before where it’s been done in that phased approach, and users can just lose interest in it.” Camden has found many uses for the system, with more than 300 approved staff in 35 teams having access. The first type of work was data intelligence, which allows the council to produce reports from multiple parts of the organisation with greater ease, such as a government social care return that includes information on education.

Quote for the day:

"No man will make a great leader who wants to do it all himself, or to get all the credit for doing it." -- Andrew Carnegie

September 18, 2016

Telecom APIs could increase African innovation

This has opened up a great avenue for developers to bring innovation into the hands of every African. However, this can only be achieved by companies opening up their APIs to the ecosystem. “Mobile operators already play a central role in nurturing the development of innovative solutions in Africa,” the GSMA report said. “They have traditionally supported various initiatives to identify and develop new talent and solutions, including incubators, accelerators and competitions, mostly through funding and mentorship.” The report also highlighted the interest that mobile firms have had in the tech industry. MTN, Millicom and Orange have acquired equity stakes in Africa Internet Group, the organisation that owns ecommerce giants Jumia and Kyamu.

How smart materials will literally reshape the world around us

Here’s how it would work: An airplane component (like the wing) is made out of a composite material that has been coated with a thin layer of nanosensors. This coating serves as a “nervous system,” allowing the component to “sense” everything that is happening around it — pressure, temperature and so on. When the wing’s nervous system senses damage, it sends a signal to microspheres of uncured material within the nanocrystal coating. This signal instructs the microspheres to release their contents in the damaged area and then start curing, much like putting glue on a crack and letting it harden. Airbus is already doing important research in this area at the University of Bristol’s National Composites Centre, moving us closer to an aviation industry shaped by smart materials.

What’s New in the Economics of Cybersecurity?

Policymakers’ choices can influence cybersecurity in various sectors. In “Economic Impacts of Rules- versus Risk-Based Cybersecurity Regulations for Critical Infrastructure Providers,” Fabio Massacci and his colleagues address the pressing issue of finding an optimal way to alert operators of critical infrastructures about cybersecurity risk. In particular, they compare the US’s rulebased model to the EU’s risk-based approach. A proposed cybersecurity model for public policy in the presence of strategic attackers is calibrated to the National Grid, which operates in the UK and the East Coast of the US. The model shows that, depending on the combination of incentives, operators will stop investing in risk assessment and care only about compliance, or vice versa.

Now or never - India CEO Outlook 2016

Technology serves both as a trigger as well as an enabler of innovation. CEOs expect that over the next three years, technology is likely to have a huge impact on their growth, next only to global economic factors. They agree that almost every function of their businesses is bound to be influenced, with key focus areas for technology adoption in the near term likely to revolve around customer centricity, efficiency enhancement and employee satisfaction. ... Integration of basic automated business processes with artificial intelligence and cognitive processes remains an important concern for nearly 92 per cent of the surveyed CEOs. Key underlying causes could be the fact that planning for technology in many organisations takes place in silos, rather than at a unified organisational level, paired with a lack of ability to identify the right technology to meet organisational needs.

Bank of England wants next payment system to be blockchain-ready

It's not just about linking up with external blockchains, though: The bank will, it said, also continue to explore the use of distributed ledgers in its own systems, including through its own startup accelerator, which will shortly begin selecting a second round of participants. The first round includes a security assessment service, BitSight; a data anonymization tool, Privitar -- and a blockchain demonstration platform developed by the bank and PwC to explore the possibilities of smart contracts. "The resilience characteristics of the distributed ledger in particular are potentially highly attractive from a financial stability perspective," the bank noted. But it pretty much ruled out the possibility that the new RTGS would be blockchain-based.

Will Fog Computing Hide the Clouds of the Internet of Things?

The OpenFog Reference Architecture is an architectural evolution from traditional closed systems and the burgeoning cloud-only models to an approach that emphasizes computation nearest to the edge of the network when dictated by business concerns or critical application the functional requirements of the system. The OpenFog Reference Architecture consists of putting micro data centers or even small, purpose-built high-performance data analytics machines in remote offices and locations in order to gain real-time insights from the data collected, or to promote data thinning at the edge, by dramatically reducing the amount of data that needs to be transmitted to a central data center. Without having to move unnecessary data to a central data center, analytics at the edge can simplify and drastically speed analysis while also cutting costs.

The Top 5 Problems with Distributed Teams and How to Solve Them

It’s easy to put the problems in a list of 5. Putting the solutions in such list is a lot harder. Every setup, company and situation is different. I sometimes have people coming to my trainings expecting ‘cures’. The only thing I can deliver is a set of ideas, some of which may apply to their situation. It’s about turning a button here, tweaking a bit there and adjusting step by step. Agile, iterative. ... By creating a positive team spirit and addressing the cultural differences, we avoid the trap of ‘us versus them’ and we create awareness about how each team member behaves given the cultural context. We also define actions to organize around the differences and benefit from the similarities. Implementing a structure or tool to share the knowledge about the product or project we’re building, helps team members understand what they’re working on.

Singapore's cut-off from the internet is not so crazy

There are good reasons for Singapore's big disconnection, since Asian countries suffer a huge number of targeted attacks on their internet infrastructure. Those attacks are increasingly sophisticated in terms of both the technology employed and the psychological profiling of targets. In fact, Singapore's decision is more a question of philosophy than IT security. Actually, there are two questions: 1. Is it possible to completely secure a system that's connected to the internet?; 2. If not, what are the potential consequences if such a system is compromised? The answer to the first question is a resounding no. No operating system is exploit-free. The same applies for any mail client or web browser. Vulnerabilities may not be widely known yet, but they exist and will be discovered.

Bad migration experiences leave IT bosses gun-shy

IT shops don't think about the web of dependencies and connections between what they are upgrading and other systems, says Arnold. They don't look at storage subsystem compatibility, app dependency and true dependency of apps to servers. You might have to take down and replace several things all at the same time. But therein lays the challenge. Arnold spoke with one CIO who talked of wanting to solve the constant change in his environment but there were too many variables in these migrations to make a move. "There is no one particular issue because everyone has a different experience. I've had people plan these out and thought they knew how it would go and had a storage subsystem fail on them," he says.

This Is Why Securing Your Business Is More Important Than Ever

While attackers do continue to target large enterprises more frequently, small businesses are proving to be an emerging gold mine as they store the same valuable information, but have fewer resources to defend themselves against threats. In our most recent survey, we found that despite the majority of small businesses reporting being concerned about cyber attacks, a third were not taking any proactive measures at all to mitigate cyber risks, and only 12 percent had a breach preparedness plan in place. ... Awareness, education, monitoring and response, will all play a role in helping you safeguard your company information. There are a number of free, easily accessible resources, like the National Cyber Security Alliance and the Federal Communications Commission, for information on security best practices.

Quote for the day:

"Anticipation is the ultimate power. Losers react; leaders anticipate." -- Tony Robbins

September 17, 2016

What’s Wrong With Using Design Templates?

Contrary to templates which are designed for a broad business category, custom designs are built by experts to meet specific business needs. A great website is more than stunning visuals and smart widgets. Custom designs are personalized at a conceptual level, delivering great user experience on desktop or mobile, and engaging users to follow your calls-to-action. Founded on the business brand, custom web design allows more control over creative elements, helping businesses to forge a meaningful connection with their audiences. With custom design comes customized support of a designer able to perfectly align the look of the website with specific business needs. If you're opting for a custom design, here are some questions you should ask your web designer

How the startup world is bringing digital nomadism closer to reality

One of the trickiest things about travel is dealing with different time zones. WTB is a world clock converter and meeting scheduler that lets you schedule personal and professional events at a glance over multiple time zones. With a number of useful features, like Google Calendar integration, WTB is a great newer tool for working away from home. WTB has not disclosed funding information. According to reports, growth took a dive around November 2015, but shot back up in December 2015, and has maintained steady growth through 2016. As remote work continues to grow and more people refuse to compromise lifestyle for professional success, the digital nomad lifestyle is now even more attainable. If you’ve ever dreamed of leaving the cubicle behind and hitting the road, these startups provide the insider help you need to make it happen.

ViaWest: How Cloud Computing Alters Data Center Design

Now, certain well-known data center customers — Leonard cites Akamai as one example — are moving from a 12-15 kW per rack power usage profile down to about 9 kW/rack. Service providers are capable of making such deliberate changes to their applications to enable this kind of energy efficiency. Suppose a hypothetical SP customer of this same data center is inspired by Akamai, re-architects its application, and lowers its power consumption. “Well, now they can’t use the power that’s in that space,” argues Leonard. “Creating space where power and cooling are irretrievably tied to the floor space that is being delivered on is a really bad idea. When the use of that floor space, power, and cooling changes over time — and there’s a dozen dimensions that can cause it to change — those data centers are rigid and inflexible in their ability to react to those changes.”

Reasoning About Software Quality Attributes

Attribute primitives provide building blocks for constructing architectures. However, they are building blocks with a focus on achieving quality attribute goals such as performance, reliability and modifiability goals. Quality attribute design primitives will be codified in a manner that illustrates how they contribute to the achievement of quality attributes. Therefore each attribute primitive will be described not only in terms of their constituent components and connectors, but also in terms of the qualitative and/or quantitative models that can be used to argue how they affect quality attributes. Consider an example: the client/server attribute primitive. This is collaboration between the providers and users of set of services. The attribute primitive separates one collection of responsibilities (the client's) from another (the server's).

Code ownership and software quality

The owner of source code usually refers to the person who implemented the code. However, larger code artifacts, such as files, are usually composed by multiple engineers contributing to the entity over time through a series of changes. Frequently, the person with the highest contribution, in terms of lines written or code changes made, is defined as the code owner and takes responsibility for it. ... Weak ownership means distributing the responsibility for a particular part of software among multiple developers. We speculated that code without a primary owner might have no champion who will take responsibility to maintain and test the code. Without such code owners, knowledge about the inner working and functionality of code might be limited and once lost completely, it might take time to recover. Overtime, such files become more susceptible to bugs.

How to Keep Your Passwords, Financial & Personal Information Safe

Keeping your passwords, financial, and other personal information safe and protected from outside intruders has long been a priority of businesses, but it's increasingly critical for consumers and individuals to heed data protection advice and use sound practices to keep your sensitive personal information safe and secure. There's an abundance of information out there for consumers, families, and individuals on protecting passwords, adequately protecting desktop computers, laptops, and mobile devices from hackers, malware, and other threats, and best practices for using the Internet safely. But there's so much information that it's easy to get confused, particularly if you're not tech-savvy. We've compiled a list of 101 simple, straightforward best practices and tips for keeping your family's personal information private and protecting your devices from threats.

The end of password expiry

So, should we force users to change passwords, and if so, how often? It's not an easy question to answer and the industry seems divided in its opinion – for some, requiring people to change them often is bad, as it may encourage poor password choices and re-use of passwords on different sites, while others suggest it should be monthly or more for access to corporate applications and systems. In a recent Centrify survey, it was alarming to see how much password sharing between employees happens – often to enable a colleague to do work they can't usually do from their own account. Regular enforced password change would help ensure the person the password is being shared with would be unable to log in if they leave the company, albeit there would be a window of time when they still could.

Improving security, efficiency, and user experience in digital transformation

Humans can still be bugged or tricked into revealing their passwords. There is malware, or malicious software installed on computers; there is phishing, in which cyber crooks grab login, credit card, and other data in the guise of legitimate-seeming websites or apps; and there are even “zero day” attacks, in which hackers exploit overlooked software vulnerabilities. And of course, old-fashioned human attacks persist, including shoulder-surfing to observe users typing in their passwords, dumpster-diving to find discarded password information, impersonating authority figures to extract passwords from subordinates, discerning information about the individual from social media sources to change their password, and employees selling corporate passwords.

Enterprise-architecture – a changes report

In other words, at this stage – in the mid-2000s – all of this mainstream ‘enterprise’-architecture was still strictly IT-centric. For example, whilst the FEAF PRM briefly mentions ‘Human Capital’ and ‘Other Fixed Assets’, there’s nothing in that specification that actually describes them in any significant detail. For anything more than that, we had to turn to industry-specific frameworks such as eTOM or SCOR, or else roll our own. And where ‘enterprise’ is mentioned at all in the mainstream ‘EA’-frameworks, there’s also an assumption that ‘the organisation’ and ‘the enterprise’ are one and the same. By the time of the launch of TOGAF 9, in 2009, this becomes more overt: there’s an implication that whilst there must be some clients out there somewhere, they’re essentially ‘out-of-scope’ for the architecture, and that the maximum reach we’d need to worry about as enterprise-architects is an ‘inside-out’ view of the business-world

Dear CIO/CFO: “What is Enterprise Architecture?”

First, Enterprise Architects – real Enterprise Architects – are not “smarter” than everyone else. They do, however, have a very specific skill set and a level of experience of understanding that a systems view (People, Process, and Technology) is more important than a point solution perspective. I accept that what they produce and provide can be profoundly of value to an organization that wishes to understand itself and how the organization might improve “efficiencies”. They can provide an incredible amount of corporate intelligence to you, but this is nothing that a CIO or CFO should fear. Real Enterprise Architects are your personal “007”. Remember, James Bond still works under “M”, right? Enterprise Architecture is not, what many CIOs and CFOs seem to constantly tell me, about “pretty network diagrams”. No, that is “Network Architecture”.

Quote for the day:

"Having more data does not always give you the power to make better decisions." -- Jeffrey Fry

September 16, 2016

5 security practices hackers say make their lives harder

It's easy to fall into the trap of thinking of privileged accounts in terms of the human users who have them. But privileged accounts are also extended to machines and systems to allow them to interact. Organizations typically have two to three times more privileged accounts than they have employees. Carson notes that every system that gets deployed comes with a default account, and those systems get connected to service accounts to maintain them. Each virtual machine that gets deployed also receives privileges that don't expire when the machine they're associated with get spun down. And if a VM is cloned, those privileges get cloned along with them. As a result, organizations often wind up with large numbers of rogue privileged accounts with access to their environment.

Polymorphism of MVC-esque Web Architecture: Classification

Arguably, the model has experienced the most significant changes since the inception of the MVC almost forty years ago. For this discussion, the model is defined liberally to include the in-memory model object (such as record set), the source data/document/file/signal of system of record (SoR) behind the object, and all the processes synchronizing and bringing them together. The type of data repository of the model has evolved from a small floppy disk to RDBMS, and to MMDBMS (multi-model database management system). The repository has gone from co-locating with the in-memory model object isolated on the user’s desktop to locating remotely from the domain object as broadband-connected, distributed and/or cloud-based systems.

5 Things You Should Know About Nigerian 'Digital Check Washing' Rings

WWG1 uses a simple tool to crawl the Internet and scrape employee email addresses from corporate websites. Those employees are then bombarded with viral emails (the kind with a virus, not the kind that gets Internet-famous). The goal is to infect one machine, and then use that as a foothold to ultimately secure privileged access to the company's Web email server. Once they gain control of the email server, they begin daily monitoring for purchase order communiques. They also prepare lookalike emails, as well as arrangements to wire funds into bank accounts set up to launder stolen payments. None of this requires any special hacking expertise; the necessary software and tutorials are widely available online.

How blockchain is transforming business models

To put it simply, multiple distributed ledgers are just a method of recording data digitally, and can be applied to anything that needs to be independently recorded and verified as having happened e.g. transactions, agreements, contracts, ownership, etc. According to a SWIFT Institute Working Paper, it is the robustness and relative simplicity of the Bitcoin blockchain that has sparked the interest of similar technology to be applied to wholesale markets’ securities settlement as this can potentially reduce costs and risks. And according to a White and Case report, a similar blockchain can also be used to improve and enhance currency exchange, supply chain management, trade execution and settlement, remittance, peer-to-peer transfers, micropayments, asset registration, correspondent banking and regulatory reporting

What Airbnb can teach HR about trust

You may be thinking, sharing a car with someone and then rating them on their driving skills is nowhere near equivalent to the relationships that form in the workplace. In reality, with websites like Glassdoor and Indeed, companies are already developing their own online reputations based on employee reviews. The potential impact of these reviews can be explained by the similarity bias. Job seekers are going to be much more apt to believe in the reviews of current employees than in company recruitment efforts or statements by the CEO. Creating trust between employees and managers should therefore be at the top of every HR department’s agenda. Using best practices from the sharing economy can be easier than you think.Essentially, what Airbnb and other companies have proven is that opening yourself up to feedback will increase trust in the eyes of others.

Cognitive Computing: Five “I wish I would haves” to Avoid

Computing capabilities are unbelievably strong today. There’s a greater discipline in algorithms than we’ve ever seen. Data storage costs, what, around 3 cents to store a gig of data today? Put it all together, and you realize that whatever we’ve done in cognitive computing today will soon be considered quaint early indicators of the seismic changes that follow. We are heading down an exponential change curve. Because cognitive computing is already a burgeoning reality among the businesses I work with every day, I’ve already observed a few serious risky views on it. Why are they risky? Because if they take hold, they’re likely to lead many to say, “I wish I would have” in the not-so-distant future. And in this case, the implications of getting it wrong, or simply not getting on board fast enough, could be serious.

It’s time to practice what we preach in cloud security

Most hackers are after a quick and easy payday. And any savvy hacker knows there’s loot to be had from cloud services. Given today's consumer / corporate crossover world we live in, things like Dropbox are a prime target as they’re a vast cache of IP and corporate databases – and probably a fair amount of personal information that can exploited. At the same time, apps like OneLogin are designed to increase security and anyone looking to procure a few passwords would do well to try their luck here. The cloud industry has been hard at work dragging people over the line in the security debate for some time. We have worked hard to tackle the issue head on and incidents like these don't help assuage the doubts that many still have.

For regulators, cybersecurity must be more than just site visits and questionnaires

One has to do with the fact that regulatory bodies still rely on a rather old-fashioned technique for assessing compliance in cybersecurity (and really any area): having an examiner visit an organization's site and ask questions, or require the organization to fill out questionnaires. This kind of "point-in-time" monitoring certainly has its value, but too easily can be a once-a-year bureaucratic exercise that provides only a snapshot of an enterprise's cybersecurity health. These exercises are quite financially burdensome for the regulated entities to comply with, and budget-strapped agencies are also hard-pressed to stay on schedule with the assessments. Regulatory agencies, fortunately, are looking at new commercially available technologies that provide critical cybersecurity performance data in a continuous fashion.

Pros and Cons of Cross-Platform Mobile App Development

Since the User Interface (UI) and User Experience Design (UXD) of iOS and Android are quite different from each other, it’s not an easy task to create a uniform GUI wrapper on top of it. Though Xamarin and others have put in significant work on this front, it is far from perfect. It works well if you design your application to live within the framework’s limitation, however, if you need anything that doesn’t fit with the framework’s vision, it requires a lot of work to implement and requires writing platform specific code. To give you an example, in Xamarin Forms, it takes a lot more work if your designer chooses to give custom colored borders to text fields. As this is not obvious to the designer, once you have settled in on the design, the programming team needs to put in a lot of efforts to pull off this seemingly simple design.

Risk Management Best Practices For CISOs

There are a few basic steps that CISOs should take after establishing their resiliency baseline in order to start improving it. We suggest that CISOs perform a value-chain mapping exercise, which will result in a much more detailed pictorial view of the security landscape. The X-axis of this map is “Evolution of Resiliency” and the Y-axis is the “Invisible to Visible Value Chain”—meaning, what solutions currently exist and what can be implemented over the evolution timeline to increase the visibility of security, which has a direct positive effect on resiliency. This exercise will also flesh out any duplicative efforts, which decrease efficiency. After the initial map has been created, it can be used as part of a continuous resiliency improvement process.

Quote for the day:

"As we look ahead into the next century, leaders will be those who empower others." -- @BillGates

September 15, 2016

If an Infosec policy falls in the forest

If you don’t have a proper governance structure in place it can cause you some angst. As an example, how can you remove an employee who is surfing porn on the Internet if you have no framework in place to deal with such an action? That is the simplest example that comes to mind. To spin it differently, there was a shop that I worked for at which I was told that I could not use a certain piece of software. It was a fairly benign software application so, I couldn’t help but to ask why. Now, bearing in mind I had no argument with being told no. I was just interested in knowing what the rationale was for that decision. The answer I received was, “because $group said no."

Chief Data Officer Barney Krucoff Drives Washington, D.C.’s Data Strategy

My impression is that D.C. has a tremendous technology infrastructure. We are more unified in our technology than many large cities or states. There’s a city-owned network backbone that connects us all, and there’s a centralized security team, so not everybody’s got their own firewall group and you’re not necessarily negotiating that across multiple agencies. The IT department is fairly operational, not just a policy shop. We run all the email, we run many applications, we run the centralized web team. So there’s a lot of infrastructure in D.C., and there’s a reasonable amount of resources for the amount of government we have. We weren’t necessarily as efficient as we’d like to be, and I think that’s part of my job, to try to align these pieces.

How can we address the Insecurity of Things?

“With IoT, it's only a question of time that with regards to privacy and physical security issues, governments will have to enforce regulations and standards,” said Sayag. “It's a two way process. One is from the regulatory authorities, to come up with really strong steps, to encourage development of security of IoT nodes and devices; and on the side of users, they should be more aware of the kind of things that can be hacked,” said Chattopadhyay. “I think we are too passive about these new challenges, we think that they will be sorted out by themselves, maybe by market forces. We should work faster, and we should encourage more innovative technologies and products with built-in security in mind. That is something the security community, researchers and the industry, should consider right now. I think this is a problem we should solve altogether,” emphasized Sayag.

Security Think Tank: Brexit – An opportunity for infosec pros to take the lead

The main negative point is the uncertainty, but as the EU will deny access to its marketplaces to any company not up to code, certainty comes back into the picture again as we realise the regulations have to be implemented anyway. Not quite incidentally, when considering international data regulations in this context, those responsible in a risk and compliance role should keep keen eyes on the progression of the Safe Harbour and Privacy Shield saga in the Irish courts. Opting for private model contracts to cover international data exchanges in the absence of Safe Harbour is a legally uncertain decision, and their use could cause major international disruption if ruled inadequate.

8 Culture Change Secrets Most Leaders Don’t Understand

Results will actually precede the cultural change. This important insight runs counter to arguments from some leaders that think they don’t have time for culture since they need results now and culture change takes a long time. Focusing the work on a top mission or performance priority will actually increase the likelihood of seeing results in a meaningful area AND supporting the targeted cultural shift. Behaviors that lead to positive results will spread. Schein said these behaviors will not be spreading because employees were “told to” but because “they work”. I love his explanation: “if it’s successful, and people like it, and it becomes a norm then you can say it’s become a culture change.” So, what’s a norm? That question brings us to our next secret.

Cybersecurity Is Every Executive’s Job

While the CISO will identify risks and prioritize security protocols, it is incumbent on senior executives to understand and carry out the procedures across the business — to the most-vulnerable points of entry for cyber criminals. Executives must sponsor the CISO’s threat assessments and review the results together. The CISO should be included on new business initiatives early on so that security is baked in rather than bolted on afterward. In fact, the best practice is to have the CISO work with each team to determine ways to reach goals in the most secure fashion, and then executives must hold their people accountable for risks and flaws identified by the CISO. What’s more, executives should help promote the importance of security within the organization, starting with better education and training.

Cyber risk in financial firms is a key concern – Central Bank Guidance

The Central Bank’s concerns are being driven by the potential impact of inadequate cybersecurity controls on the firms themselves, their customers and the risks for financial stability. Given that Information technology is now at the heart of the supply of financial services and that the incidence of cyber-attacks and business interruptions is on the increase, the Central Bank is saying that firms should assume that they will be successfully targeted. Its view is that the security and resilience of IT systems, their governance and management must improve to reflect this reality. ... The Central Bank is demanding increased effectiveness in this area. We are undertaking considerable work to require improved IT risk management and cyber resilience across regulated firms. This includes enhanced supervisory capabilities and increased focus on these risk areas.

Emerging technologies are poking holes in security

Automation affects change management and security because there may not be an understanding of how to support the new information security requirements of automation as change occurs. This can make the enterprise susceptible to intrusion and unable to adequately respond when disaster recovery plans must execute, Davison says. As for information technology service partnering, when partner employees don’t follow the enterprise change management process, information security risks rise, says Walker. In cloud computing environments, simply adding errors in the process of coordinating change among different cloud environments to the already precarious task of implementing federated security across these clouds can add significant risk.

Commodities may be a sweet spot for blockchain

Over-the-counter commodity derivatives are another potential sweet spot for blockchain. Banks such as Barclays have explored the use of smart contracts for interest rate and equity derivatives. They might consider trying them out in OTC commodity derivatives, which are largely not yet subject to regulatory central clearing mandates. The lack of potential resistance from clearing houses, as well as the smaller size of the markets overall, might make it easier to roll out smart contracts in OTC commodities than in other asset classes. Some might question whether commodities – the oldest asset class around – will really be the sector where blockchain takes off. I would advise such sceptics to look at a little company called Ice.

FTC focuses on combating ransomware

"The spate of ransomware incidents are escalating at an alarming rate," Ramirez says, citing an estimate from the Department of Justice that incidents of ransomware, now averaging some 4,000 a day, have increased 300 percent in the past year. "The financial motivation for ransomware attacks suggests that the threat is unlikely to go away any time soon," she says, warning businesses to step up their own defenses to ensure that they are protecting their users from online scammers. The agency has already brought dozens of enforcement actions against companies for failing to adopt what it considers reasonable security protections. Ramirez and some industry experts see ransomware as the latest evolution of malware, but with a notable twist.

Quote for the day:

"If you can't laugh at yourself life is going to seem a whole lot longer than you'd like." -- Sam, Garden State

September 14, 2016

Six shifts that define enterprise digitization in 2020

Before company leadership teams get dragged into conversations about specific technologies or start speculating about how they can be the "Uber of their industry," they first need a common perspective on the business, consumer and technology trends that are driving enterprise digitization, and consensus on which are most important for their context and which can be safely ignored. This creates the starting point for a business-led strategy that will yield much better results than chasing after the latest buzzwords. Often, CIOs find themselves leading the way in creating this shared understanding. So to help, CEB has conducted a comprehensive analysis of the business model, consumer and workforce changes that will have the greatest impact on the digital enterprise by 2020. The trends point to six shifts that apply broadly across industries, geographies, customer types and operating models.

The structure of Blockchain Technology and How it works.

Every block within the blockchain is recognized by a harsh, created with the SHA256 cryptographic hash algorithm on the block header. Every block also references a preceding block, referred to as the parent block. In other words, every block has the hash of its parent in its own header. The series of hashes connecting each block to its parent makes a chain going back to the first block, referred to as the genesis block. Although a block has one parent, it can momentarily have many children. Each child refers to the same block as its parents and has the same parent harsh. Many children appear when there is a blockchain “fork,” a short-term situation that happens when different blocks are found nearly concurrently by different miners. Ultimately, only s single child block becomes the blockchain part and the “fork” is resolved.

Digital government isn’t about user needs – it’s more fundamental than that

It’s not hard to conjecture that exposing the value chains of government services to the public, so that we can all see and compare and improve on them on a daily basis – akin to tinkering with a giant Meccano set made of lots of standard components – would amount to nothing less than a democratic revolution. An early example of an exposed value chain is DVLA’s road tax renewal service, where we watch government join up our registration, insurance and MOT databases, and take our money, in real-time. Instead of stale, self-legitimising talk by public administrators about how they are building stuff to “meet user needs”, the function of public administrators becomes increasingly about providing us with the building blocks to, for example, assemble, innovate, combine, question and contract for our public services.

Montreal cops hunting data thieves

The curious question that comes to mind is how long has this been going on at Concorida? Or even more to the point, where else has this activity been taking place? I would be curious to see if other universities have discovered similar instances. ... This serves as a great lesson to have a strong monitoring regime in place in your organization. Do you have alerting in place to fire in the even someone inserts a USB device into a server in your datacenter? Do you have access controls in place to alert you as to who is coming and going from your data center? This might seem rather basic on the face of it but, I have seen many instances over the years where companies would have all these great biometric controls, man traps, cameras and the like but, then they would prop open the back door so that the security guard could sneak out for a smoke break.

AI Can Recognize Your Face Even If You’re Pixelated

The researchers were able to defeat three privacy protection technologies, starting with YouTube’s proprietary blur tool. YouTube allows uploaders to select objects or figures that they want to blur, but the team used their attack to identify obfuscated faces in videos. In another example of their method, the researchers attacked pixelation (also called mosaicing). To generate different levels of pixelation, they used their own implementation of a standard mosaicing technique that the researchers say is found in Photoshop and other commons programs. And finally, they attacked a tool called Privacy Preserving Photo Sharing (P3), which encrypts identifying data in JPEG photos so humans can’t see the overall image, while leaving other data components in the clear so computers can still do things with the files like compress them.

Future of Banking: IoT, Retail & Mobile Banking Industry Trends

As we move forward, banks are turning toward new IoT technologies to enhance the user experience and reduce costs. Some banks have started using beacons, for example, to send customized offers right to customers' smartphones as soon as they enter the branch. And some ATMs now have live stream video support that allows customers to speak to tellers if they need additional assistance. Financial executives are pouring significant money into these technological changes to help stave off competition from tech companies that are sticking their hands into the financial services industry. A recent PwC survey revealed that these executives expect their digital investments to increase their revenues and enhance the customer experience above all else.

Business and IT alignment gets physical at Avnet

We take business and IT alignment very seriously at Avnet. For example, my senior IT leaders are part of the lines of business unit teams, and they sit in those executive teams. Their variable compensation is tied to business performance and not just IT performance. We take that very seriously. What we find is happening in business, in general, is just the rate of innovation, the rate of change is accelerating. So at Avnet, we're introducing agile methodologies to help move faster and be more nimble. What we're finding is key to that increased rate of innovation is really that we need colocation, so we're colocating our IT teams with our business teams. It helps to really bring the groups together and follow a term that we have in IT, which we call 'place business at the center of IT.'

Hired guns: The rise of the virtual CISO

There’s no set universal standard for hiring a virtual CISO. You can set up a retainer for a certain number of hours, you can hire someone on a project basis, and/or you can even buy a chunk of support hours and use them when you need them. It's a way of getting the cream of security talent without buying the whole cow.Contracting a virtual CISO can be far more cost effective than hiring a full-timer. They can fill in where you need it the most, helping your CIO pull together your security policies, guidelines and standards. That could entail anything from coming to grips with HIPAA or PCI compliance to staying on top of vendor risk assessments. A qualified virtual CISO is going to be fully up to speed on the latest best practices, they have experience dealing with a wide variety of scenarios, and they are well-positioned to train your internal security staff.

Empower your employees by embracing shadow IT

Embracing shadow IT can actually benefit your company and your employees, but according to Martin Johnson, senior director of Cloud Product Marketing at Blue Coat, attitudes around shadow IT will likely change depending on who you talk to. Employees at smaller business units don't necessarily consider the negatives of adopting new software without IT's knowledge. Rather, they see it as a faster and more efficient way to increase productivity and alleviate redundant tasks. For example, your workers might opt for a third-party cloud service over an internal network, so they can access files across devices or on the go, which leaves IT largely out of the loop, but makes their work lives easier. IT, on the other hand, views it as a "security risk," according to Johnson, but notes that IT departments also understand the importance of remaining on top of the latest technology trends.

Digital Transformation Boosts Captive Offshore Center Growth

Cultural differences and alignment with business objectives historically have been the biggest challenges for captive offshore centers. But as they have taken on higher-level deliverables like digital services, these GICs must also rethink their talent acquisition models. “The GICs are undergoing fundamental shifts in their operating models… from being centered around arbitrage to skill-centric, functional orientation,” says Kala. “This shift is significantly impacting the relative emphasis on talent attributes required for success.” Domain, functional, and technical knowledge are now table takes; digital services require skills in the areas of collaboration, analysis, creativity and innovation.

Quote for the day:

"First ask yourself: What is the worst that can happen? Then prepare to accept it. Then proceed to improve on the worst." -- Dale Carnegie

September 13, 2016

Indian-origin scientist's tech to let you read closed books

Terahertz frequency profiles can distinguish between ink and blank paper, in a way that X-rays can not, and has much better depth resolution than ultrasound. The system exploits the fact that between the pages of a book tiny air pockets are trapped about 20 micrometres deep. The difference in refractive index - the degree to which they bend light - between the air and the paper means that the boundary between the two will reflect terahertz radiation back to a detector. In the new system, a standard terahertz camera emits ultrashort bursts of radiation, and the camera's built-in sensor detects their reflections. From the reflections' time of arrival, the algorithm can gauge the distance to the individual pages of the book.

CIOs, CTOs playing greater role in technology decisions

"What we found is that, in the past, CIOs and CTOs reported to the COO or CFO, and they weren't getting as much of a seat at the table as far as strategy and more tactical initiatives go. Their role was just to make sure IT departments and technology spending were kept under control and overhead was low -- but with the cloud and digital, tech leaders are seen as more than just a cost center, they've become increasingly strategic and their voices are louder," says Steve Keathley, national technology leader, Deloitte Growth Enterprise Services and Partner Deloitte Consulting, LLP. Mid-market organizations are increasingly seeing productivity gains and a faster time-to-value as a result of technology investment, which is driving a willingness to see technology as a solid investment, Keathley says.

Blockchain can not only transform insurers, but also benefit customers; here’s how

A shared ledger can reduce the instances of fraud as companies can ensure that there are no subsequent claims on the same product. But the real application of the technology comes in the form of new niche insurance products it ceates when combined with internet of things (IoT). For instance, the black box in a car can generate data on driving habits of the user based on which blockchain can help create personalised insurance covers for each kind of user. ... One of the pain points of insurance for consumers is the claim approval process. Blockchain can ensure validation of data faster and quicker disbursement. Also, with IoT systems and better tracking of consumers, this process can get even faster. For instance, a home security system with cloud connectivity can allow companies to track information real-time and help process claims.

5 Ways Blockchain will Transform Financial Services

Financial institutions across the world are responsible for complying and reporting on a number of requirements from their local regulator. Know Your Customer (KYC) is a key requirement here but the process can be incredibly time consuming and lack the automated customer identification technology and integration needed by teams to efficiently carry out their work. Blockchain technology could provide a digital single source of ID information allowing for the seamless exchange of documents between banks and external agencies. This would likely result in automated account opening, reduced resource and cost, all whilst maintaining the privacy of data that is legally required.

The IoT and Cloud security measures — not as well developed as needed

“Cloud security continues to be a challenge for companies, especially in dealing with the complexity of privacy and data protection regulations,” said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. “To ensure compliance, it is important for companies to consider deploying such technologies as encryption, tokenization or other cryptographic solutions to secure sensitive data transferred and stored in the cloud.” Agreed Jason Hart, Vice President and Chief Technology Officer for Data Protection at Gemalto, a leader in digital security, “It’s quite obvious security measures are not keeping pace because the cloud challenges traditional approaches of protecting data when it was just stored on the network.

Startup maps journey to automate US freight trucking

“It’s too simplistic to say this is Uber for trucking,” he says. “The Uber problem is one of ‘I need a car now and give me the closest car’; the shipping one is ‘I need a truck at a certain time with a certain load going in a certain direction, plus there are contractual relationships’. Then there’s the Big Data element of understanding traffic patterns, predicting where you need capacity and optimising routes.” Kropp and CFO Jan Gildemeister each have over 10 years’ experience in trucking and logistics and say they want to create the “next evolution of trucking technology”. Kropp says that truck fleet operators have tended to focus on improving fuel economy, aerodynamics and other elements but believes that, by taking a fresh look at the logistics of the industry, much bigger savings are to be had.

5 tips to successfully pitch your IT project

There are many statistics about how many IT projects fail and many internet posts suggesting why. After hearing the above story from a friend, I have been wondering how many worthwhile IT projects never even get greenlighted and why? I suppose accurate statistics would be hard to find, after all, what doesn't get started rarely gets documented and measured. As a guide, though, multiply the number of projects that you yourself have not successfully pitched by the number of project teams that you imagine there are on the planet (Project Management Institute estimates that there are 16.5 million project managers in the world) and you probably have a very big number indeed floating across your mind. These can't all have been terrible projects, can they?

Designing with Exceptions in .NET

If you read early literature on .NET design patterns, you’ll often come across the phrase “pit of success”. The basic concept is this: make the code easy to use correctly, hard to use incorrectly, and ensure the exceptions tell you what you did wrong. This philosophy of API design guides the developer into writing correct code almost by default. This is why a naked NullReferenceException is so bad. Other than the stack trace, which may be quite deep into the library code, there is no information to help the developer figure out what they did wrong. ArgumentNullException and InvalidOperationException, on the other hand, give the library author a way to explain to the application developer how to fix the problem.

CIO skills: The right stuff for executive-board, CEO positions

CIOs are definitely becoming CEOs. We've seen a couple of interesting statistics, and things in the market evolved over the last couple of years. Within the Fortune 500 today, for example, CIOs are now reporting to CEOs 56% of the time. That's up about 12% over the last five years. And depending upon the environment, the CIO touches the enterprise across the entire technology function, likely the platform, becoming much more comfortable with being front and center with clients and customers. And so the CIO is actually very well positioned to take even a greater stride towards becoming CEO in the future.

Is your security awareness training program working?

Training in and of itself is not enough. A successful awareness program will have training in conjunction with the testing. "Do the training to know what’s going on and the testing to keep it activated in people’s minds. Who falls for the bait?" Weber said. "Each person in the organization should be tested monthly. It could be more frequent than that, but not to the point of annoying people. That’s measurable," Weber said. Because so many breaches are the result of human error, "Sometimes it’s easier to block access to it all and then grant access by request. Then anybody who requests access needs to install some type of device management software to help organizations keep track and monitor and have a little bit more control over the resources," Weber said.

Quote for the day:

"Distilling truth from overwhelming amounts of information is the essence of leadership." -- Carly Fiorina

September 12, 2016

Thousands Of Seagate NAS Boxes Host Cryptocurrency Mining Malware

The researchers used an internet scanning engine called Censys to identify public FTP servers that allow anonymous access with write privileges. They found 7,263 such servers and determined that 5,137 of them had been contaminated with Mal/Miner-C. Another interesting discovery was that many of those FTP servers were running on Seagate Central NAS devices. While this malware threat does not specifically target such devices, it turns out that Seagate Central's configuration makes it easier for users to expose insecure FTP servers to the Internet. By default, the Seagate Central NAS system provides a public folder for sharing data, the Sophos researchers said in a paper published Friday.

Microservices Imply a Distributed System

When you split up your systems landscape into small components, testing is required at a lot of different levels. First of all, inside your components unit tests will likely cover the component’s internals. Next, the service interface needs to be tested whether it produces the right output or document, such as JSON objects or PDF’s. Next applications or other components consuming services offered by components need to test whether these components still offer the right output. As the services in a microservices architecture are loosely coupled, usually via REST and JSON over HTTP, a change to a service interface is not always picked up immediately by the teams. Having automated tests run at every change of a component, the pipeline signals breaking changes as fast as possible.

5 Tips for How to Work Safely Beyond the Corporate Firewall

Some people tell me we should focus on flexibility and forget about control. Others say we have to control information and forget about flexibility. I say you can and should have both. The only real way to maintain an acceptable level of control is to also offer your workforce flexibility. This is more important than ever in this age of working beyond corporate walls and firewalls. You may have the best information management system and internal governance on the planet, but if you don’t accommodate distributed and mobile staff, you will lose control. People will find a way around your firewall if you don’t provide it for them. Basement email servers, unauthorized cloud drives, and personal smartphones, oh my! To safely work beyond corporate firewalls, follow the “cloud first, Web first, mobile first” principles of solution design for flexibility and control

What You Must Know to Evaluate Unified Communications-as-a-Service

Thus, an all-in-one Unified Communications-as-a-Service (UCaaS) platform is pretty appealing. An extension of Unified Communications (UC), UCaaS wraps a host of business communication and collaboration applications and services into a single experience delivered via the cloud. That encompasses everything from enterprise social messaging and chat apps to online videoconferencing and meeting software to business voice-over-IP (VoIP) services. UCaaS platforms come in all shapes and sizes. There are different types of cloud and on-premises distributions, complicated security protocols, and vendors on all sides of the market—from VoIP and telecom providers to major cloud and enterprise players—pushing their own solution. Here are a few key considerations to help your CISO choose the UCaaS platform that best suits your organization.

Why Security Performance Will be Key in NFV

Think of this as some sort of security microcosm, where as we go from cellular to molecular level, there is the need to drive security deep into the data center, so that it becomes deeply embedded in a system that is analyzing the activity of every packet and application traversing the network. The central nature of the SDN paradigm make this a better security model, in general. Rather than managing security policies on individual devices or proprietary hardware system, a centralized SDN controller could analyze and supervise security across an entire data center. Pursuing a zero-trust, stateful security model – in which all applications are monitored in real-time — can provide enhanced security for east-west traffic within the data center, implemented closest to VMs and containers.

The Malware Battle Is Mostly Silent

For security researchers, the fact that malware authors include abusive messages in their code comes as an acknowledgement of their work. Thus, researchers will continue to report on new and updated malware, regardless of whether developers are dissatisfied with how their malware is portrayed or are unhappy that they made it to the headline. “We believe it’s crucial to inform Internet users, whether home users or people involved in companies, of emerging cyber threats. It’s not only about building awareness, but it’s also an essential tool to help people learn how to get protected,” Andra Zaharia said. “We believe that spreading correct and relevant information about new and improved malware is an important part of helping people become more aware of the issue and its potential impact.”

The Right Time and Place: Data’s Enabling Role in Enterprise IoT

The key to making the most of any operational or service-based enterprise IoT application is to act on data at its peak point of value: the moment it is created. If your vehicle operating system learns about an imminent traffic hazard, you’ll need it to notify the driver immediately, not minutes later. That means enterprises will need to increase the velocity of data processing. The traditional process, where data is collected in one place, and then processed and analyzed in multiple separate phases, slows things down and is not a sustainable model for the volume and velocity of IoT-produced data. Instead, data refinement, processing and analysis must move closer to the connected device. Sensor manufacturers are already developing compute capabilities that happen on the device, breaking analytics out of the data center and putting it into the real world.

Trouble Spotted On The Network

When you work for a smaller organization, you don’t have the luxury of a 24/7 SOC. In my company, we compensate by building automation into the monitoring of our logs and cherry-picking events that will generate email notifications. Other events get our attention when we can carve out time to monitor the threat logs generated by our advanced firewalls and the security logs produced by a multitude of other devices: web and database servers, load balancers, proxies, file integrity monitoring software, etc. We collect the logs in a centralized server, and a few filters help identify logs that meet certain criteria. I and a couple of analysts take turns monitoring the filtered logs. We don’t get 24/7 coverage, but it’s pretty close.

How a loud noise brought a data center to its knees

In a peculiar and rare phenomenon, the loud noise created by inert gas being released during a planned test of fire extinguisher systems not only forced the bank's main data center in Bucharest, Romania, offline, but also managed to destroy dozens of hard drives in the process, causing serious and irrevocable damage. Inergen is a kind of fire extinguishing system which relies on gas rather than traditional foam or liquid. Suitable for enclosed spaces, Inergen, stored in cylinders as compressed gas, is dispersed through hoses and nozzles evenly across a small space to wipe out fires. Usually, this kind of fire protection would be best suited for data centers -- especially as foam and liquid would damage valuable and delicate equipment -- but in this case, something went horribly wrong.

Why automating software testing without restraints reduces benefits

Automation gives you a lot of confidence that things are working. It empowers your QA testers to go off and do the most valuable tasks. We've been using TestPlant [eggPlant Functional] to automate routine tasks, for example. This frees up time for exploratory testing or destructive testing, where testers sit down and really pull the product apart, and try and do weird and wonderful things with it. A lot of QA teams spend way too much time doing regression tests, and that's where automation really does help. Without automation, your scope of your testing is incomplete, because you're only going to do regression testing for what you can remember, which is probably three or four sprints back. And then, things drop off.

Quote for the day:

"Trust because you are willing to accept the risk, not because it’s safe or certain.” -- Anonymous