Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - April 24, 2024

Beyond Silos: Why Fraud Detection and API Security Must Converge

The shift towards a combined framework for API threat detection and the protection of vital business applications signals a move to proactive and responsive security. ... Companies cannot afford to underestimate the threat bots pose to their API-driven applications and infrastructure. Traditional silos between fraud and security teams create dangerous blind spots. Fraud detection often lacks visibility into API-level attacks, while API security tools may overlook fraudulent behavior disguised as legitimate traffic. This disconnect leaves businesses vulnerable. By integrating fraud detection, API security, and advanced bot protection, organizations create a more adaptive defense. This proactive approach offers crucial advantages: swift threat response, the ability to anticipate and mitigate vulnerabilities exploited by bots and other malicious techniques, and an in-depth understanding of application abuse patterns. These advantages lead to more effective threat identification and neutralization, combating both low-and-slow attacks and sudden volumetric attacks from bots.

Fortifying the Software Supply Chain

Firstly, it enhances security and compliance by consolidating code repositories in a single, cloud-based platform. This allows organizations to gain better control over access permissions and enforce consistent security policies across the entire codebase. Centralized environments can be configured to comply with industry standards and regulations automatically, reducing the risk of breaches that could disrupt the supply chain. As Jen Easterly, Director of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), emphasizes, centralizing source code in the cloud aligns with the goal of working with the open source community to ensure secure software while reaping its benefits. Secondly, cloud-based centralization fosters improved collaboration and efficiency among development teams. With a centralized platform, teams can collaborate in real-time, regardless of their geographical location, facilitating faster decision-making and problem-solving. ... Thirdly, centralized cloud environments offer enhanced reliability and disaster recovery capabilities. Cloud providers typically replicate data across multiple locations, ensuring that a failure in one area does not result in data loss.

GenAI can enhance security awareness training

Social engineering is fundamentally all about psychology and putting the victim in a situation where they feel under pressure to make a decision. Therefore, any form of communication that imparts a sense of urgency and makes an unusual request needs to be flagged, not immediately responded to, and subjected to a rigorous verification process. Much like the concept of zero trust, the approach should be “never trust, always verify”, and the education process should outline the steps that should be taken following an unusual request. For instance, in relation to CFO fraud, the accounts department should have a set limit for payments and exceeding these should trigger a verification process. This might see staff use a token-based system or authenticator to verify the request is legitimate. Secondly, users need to be aware of oversharing. Is there a company policy to prevent information being divulged over the phone? Restrictions on the posting of company photos that an attacker could exploit? Could social media posts be used to guess passwords or an individual’s security questions? Such steps can reduce the likelihood of digital details being mined.

AI and Human Capital Management: Bridging the Gap Between HR and Technology

Amid the strides of technology, the relevance of the human factor remains important for the human resource professional. They grapple with the challenge of seamlessly blending advanced technology with the distinctive human elements that define their workforce. In this contemporary landscape, HR assumes a novel role as a vital link between the embrace of technology and the preservation of human relations. The shift to this new way of working requires an appropriate use of technology to support and enhance existing HR capabilities, thereby increasing their flexibility and effectiveness. ... Ethical considerations comprise one of the most significant challenges while applying AI in HR, which mandates the implementation of mechanisms like equal opportunities, fair decision-making, and transparency in AI utilization in carrying out the duties. Additionally, the integration of AI into HR operations necessitates modifying change management processes to provide reassurance, organize skill preparation and training programs, and cultivate the acceptance of AI in the organization.

Differential Privacy and Federated Learning for Medical Data

Federated learning is a key strategy to build that trust backed up by the technology, not only on contracts and faith in ethics of particular employees and partners of the organizations forming consortia. First of all, the data remains at the source, never leaves the hospital, and is not being centralized in a single, potentially vulnerable location. Federated approach means there aren’t any external copies of the data that may be hard to remove after the research is completed. The technology blocks access to raw data because of multiple techniques that follow defense in depth principle. Each of them is minimizing the risk of data exposure and patient re-identification by tens or thousands of times. Everything to make it economically unviable to discover nor reconstruct raw level data. Data is minimized first to expose only the necessary properties to machine learning agents running locally, PII data is stripped, and we also use anonymization techniques. Then local nodes protect local data against the so-called too curious data scientist threat by allowing only the code and operations accepted by local data owners to run against their data.

CIO risk-taking 101: Playing it safe isn’t safe

As CIO, you’re in the risk business. Or rather, every part of your responsibilities entails risk, whether you’re paying attention to it or not. And in spite of the spate of books that extol risk-taking as the only smart path, it’s worth remembering that their authors don’t face what might be the biggest risk CIOs have to deal with every day: executive teams adept at preaching risk-taking without actually supporting it. ... ut the staff members and sponsor who annoy you the most in charge of these initiatives. Worst case they succeed, and people you don’t like now owe you a favor or two. Best case they fail and will be held accountable. You can’t lose. ... Those who encourage risk-taking often ignore its polysemy. One meaning: initiatives that, as outlined above, have potential benefit but a high probability of failure. The other: structural risks — situations that might become real and would cause serious damage to the IT organization and its business collaborators if they do. You can choose to not charter a risky initiative, ignoring and eschewing its potential benefits. When it comes to structural risks you can ignore them as well, but you can’t make them go away by doing so and will be blamed if they’re “realized”

Digital Personal Data Protection Act, 2023 - Impact on Banking Sector Outsourced Services

Regulated Entities must design their own privacy compliance program for application-based services – and not solely rely on a package provided by the SP. While the SP may add value and save costs, any solution it provides will likely be optimized for its own efficiency. Customer data management practices can differentiate a business from competitors, enhance customer trust, and provide a competitive advantage. Also, financial penalties under the DPDP are high, extending up to INR 250 crores (on the Regulated Entity as the ‘data fiduciary’ and not on the processor), apart from the reputational damage a breach or prosecution can cause, making it critical to have thorough oversight over the SP vis-à-vis privacy protection. ... For consumer facing services, in addition to security, SPs must technically ensure that the client can comply with its DPDP obligations such as data access requests, erasure, correction and updating personal data, consent withdrawal. Also, the platform should be capable of integrating with consent managers.

Why Is a Data-Driven Culture Important?

Trust and commitment are two important features in a data-driven culture. Trust in the data is exceptionally important, but trust in other staff, for purposes of collaboration and teamwork, is also quite important. Dealing with internal conflicts and misinformation disrupts the smooth flow of doing business. There are a number of issues to consider when creating a data-driven culture. ... In a data-driven culture, everyone should be involved, and this should be communicated to staff and management (exceptions are allowed, for example, the janitor). Everyone using data in doing their job should understand they are also creating data that can be used later for research. When people understand their roles, they can work together as an efficient team to find and eliminate sources of bad data. The process of locating and repairing sources of poor-quality data acts as an educational process for staff and empowers them to be proactive, taking responsibility when they notice a data flow problem. Shifting to a data-driven culture may result in having to hire a few specialists – individuals who are skilled in Data Management, data visualization, and data analysis.

Harnessing the Collective Ignorance of Solution Architects

One key benefit of adopting an architecture platform, and having different development teams contribute and maintain their designs in a shared model, is that higher levels of abstraction can gain a wide-angled view of the resulting picture. At the context level, the view becomes enterprise-wide, with an abstracted map of the entire application landscape, and how it is joined up, both from an IT perspective, and to its consuming organizational units, revealing its contribution to business products and services, value streams and business capabilities. ... by combining the abstracting power of a modern EA platform with the consistency and integrity of the C4 model approach, I have removed from their workload the Sysyphean task of hand-crafting an enterprise IT model and replaced it with the “collective ignorance” of an army of supporters who will construct and maintain that enterprise view out of their own interest. Guidance and encouragement are all that is required. The model will remain consistent with the aggregated truth of all solution designs because they are one and the same model, viewed from different angles with different degrees of “selective ignorance”.

5 Hard Truths About the State of Cloud Security 2024

"There's a fundamental misunderstanding of the cloud that somehow there's more security natively built into it, that you're more secure by going to the cloud just by the act of going to the cloud," he says. The problem is that while hyperscale cloud providers may be very good at protecting infrastructure, the control and responsibility over their customer's security posture they have is very limited. "A lot of people think they're outsourcing security to the cloud provider. They think they're transferring the risk," he says. "In cybersecurity, you can never transfer the risk. If you are the custodian of that data, you are always the custodian of the data, no matter who's holding it for you." ... "So much of the zero trust narrative is about identity, identity, identity," Kindervag says. "Identity is important, but we consume identity in policy in zero trust. It's not the end-all, be-all. It doesn't solve all the problems." What Kindervag means is that with a zero trust model, credentials don't automatically give users access to anything under the sun within a given cloud or network. The policy limits exactly what and when access is given to specific assets.

Quote for the day:

"Great achievers are driven, not so much by the pursuit of success, but by the fear of failure." -- Larry Ellison

Daily Tech Digest - April 23, 2024

Confronting the ethical issues of human-like AI

Regrettably, innovation leaders confronting the thorny ethical questions currently have little in the way of authoritative guidance to turn to. Unlike other technical professions such as civil and electrical engineering, computer science and software engineering currently lack established codes of ethics backed by professional licensing requirements. There is no widely adopted certification or set of standards dictating the ethical use of pseudoanthropic AI techniques. However, by integrating ethical reflection into their development process from the outset and drawing on lessons learned by other fields, technologists working on human-like AI can help ensure these powerful tools remain consistent with our values. ... Tech leaders must recognize that developing human-like AI capabilities is practicing ethics by another means. When it comes to human-like AI, every design decision has moral implications that must be proactively evaluated. Something as seemingly innocuous as using a human-like avatar creates an ethical burden. The approach can no longer be reactive, tacking on ethical guidelines once public backlash hits.

AI in Platform Engineering: Concerns Grow Alongside Advantages

AI algorithms can automatically analyze past usage patterns, real-time demands and resource availability to allocate resources like servers, storage and databases. AI-powered platforms can ensure reliable infrastructure, eliminating the need for manual configuration and provisioning and saving platform engineers valuable time and effort. Since these platforms have been trained on vast data models that enable them to understand individual developer needs and preferences, they can provide resources when necessary. As a result, they can be used to customize development environments and generate configurations with minimal manual effort. Organizations gather an increasing amount of data daily. As a result, businesses must handle and manage a large amount of data and personal information, ensuring it remains secure and protected. Now teams can reduce the risk of noncompliance and associated penalties by automating crucial processes like records management and ensuring that tasks are carried out in compliance with industry governance protocols and standards, a plus in high-regulated markets.

Secrets of business-driven IT orgs

“The bottom line is that in today’s era of rapid technological innovation, IT teams are critical partners that teams all across the organization must rely on in order to meet and exceed their business goals,” says Mindy Lieberman, CIO of tech firm MongoDB. “A truly business-driven IT team shouldn’t just be aligned with business strategy, it should have a seat at the leadership table, have a hand in directing business strategy, and be brought in on any major transformational initiatives from the get-go.” To get that hand in directing business strategy, Lieberman created a base with “the right people and the right roadmap, [as well as] the right processes and technology to ensure agility and transparency.” She views IT’s agenda and the business agenda as one and the same. She has modernized operations and internal application infrastructure to ensure her tech team can be responsive to business and customer-facing needs. “Being a business-driven IT team means aligning the tools, processes, technology, and success metrics across an organization to ensure that we are aligned on the outcomes we are looking for and the strategy to deliver those outcomes,” Lieberman says.

Simplifying Intelligent Automation Adoption for Businesses of All Sizes

To maximize success, it's essential to prioritize high-impact processes and streamline repetitive tasks for instant efficiency boosts. When selecting processes for automation, assess their digitization level, stability, and exceptions to gauge implementation feasibility. It's also a must to collaborate with automation service providers to tailor solutions and ensure seamless integration. There must be transparency in the communication of automation goals and benefits across the organization, addressing concerns and fostering open dialogue for unified commitment and understanding. While the potential of intelligent automation is undeniable, the journey toward its successful implementation is a collaborative effort. By understanding the unique challenges faced by businesses of various sizes and actively addressing them, we can unlock the immense potential of this technology. Aligning automation initiatives with strategic goals ensures that efforts contribute directly to the organization's success and growth. Engaging stakeholders early in the process and demonstrating the potential benefits of selected processes can lead to greater acceptance and collaboration.

Preventing Cyber Attacks Outweighs Cure

"A belief, that it is ok to compromise security for perceived convenience, is counter intuitive. There are few things more inconvenient than having to rebuild a person's identity or try to run a hospital or airport without the systems on which we now depend. Governments must invest resources to roll out defence grade preventive mechanisms and build the cyber security infrastructures that underpin zero trust networks. Indeed, it is widely accepted that identity centric security is the bedrock to Zero Trust Architecture. "It is important to acknowledge the release of the Australian Government's Cyber Strategy, efforts to uplift critical infrastructure standards and progress coordinating a Country wide digital identity framework. I also welcome the ambitious target to embed a zero-trust culture across the Australian Public Service to become a global cyber leader by 2030. "It is also intended to achieve a consistency in cyber security standards across government, industry, and jurisdictions. I commend the Australian Government for taking the initial steps to strengthen legislation and mandate the reporting of incidents.

Here's why RISC-V is so important

RISC-V is quietly enabling a divergence in custom hardware for domain-specific applications, by providing an easy (or at least easier) pathway for businesses and academics to build their own versions of hardware when off-the-shelf options aren't suitable. This works in tandem with the wide range of full open-source RISC-V implementations on the market. Businesses may be able to take an existing open-source implementation of RISC-V (effectively a design for a complete processor core, usually written in a dedicated language like Verilog/SystemVerilog) and make modifications to suit their specific use case. This can involve dropping aspects that aren't needed, and adding pre-bundled supporting elements to the core which may even be off-the-shelf elements. This means that where previously it wouldn't have been practical or affordable to build specific hardware for a feature, it's now more broadly possible. Companies small and large are already utilizing this technology. It's difficult to understand if companies are designing cores from the ground up or using pre-constructed designs, but custom RISC-V silicon has already made its way into the market.

Can Generative AI Help With Quicker Threat Detections?

ChatGPT can help to some extent with security operations. Microsoft Security Copilot can reduce the load on SOCs. Tools such as Dropzone - an autonomous SOC analysis platform - can look at a phishing alert and take responsive action, with no code, and you don't have to write any playbooks for this. It just analyzes [the threat] and takes the required action. That class of tool is where organizations are going to be able to scale. From a people standpoint, organizations are having trouble hiring or retaining SOC personnel. These tools are going to take a lot of that load off the people and allow them to focus on more important things. ... Organizations are crafting generative-AI-acceptable use policies. All their employees have to read and sign it. Some organizations are taking it a step further and trying to provide training, just as companies have an annual, basic cyber awareness course. When I ask vendors about training, they either make generative AI training part of cyber training or have separate training. People take the policy, they read it and then they have the training so they understand what's expected of it.

The Importance Of Proactive & Empathetic Leadership Amidst A Changing Talent

LandscapeEmpathetic leadership demonstrates the company’s mission and values in action. It starts with the authenticity of who you are as a leader and sharing your own vulnerability. In vulnerability, you are able to empathize to get on someone’s level. You can’t do that if you’re leading by force or in a top-down manner. Empathetic leaders see their employees as people with lives. They trust they will do their jobs. They acknowledge that sometimes people have a tough year or two. These two attributes can—and must—coexist! For leaders, a clear place to start is being proactive in how you develop and implement policies. It’s about creating policies for the company you want to be, not just where you are now. When I took on a leadership position at a startup, I became the first pregnant person at the company. There were no parental leave policies or maternal care benefits in place – these policies needed to be created retroactively around me.

European police chiefs target E2EE in latest demand for ‘lawful access’

“Tech companies are putting a lot of the information on end-to-end encryption. We have no problem with encryption; I’ve got a responsibility to try and protect the public from cybercrime, too — so strong encryption is a good thing — but what we need is for the companies to still be able to pass us the information we need to keep the public safe.” Currently, as a result of being able to scan messages that aren’t encrypted, platforms are sending tens of millions of child safety-related reports a year to police forces around the world, Biggar said — adding a further claim that “on the back of that information, we typically safeguard 1,200 children a month and arrest 800 people.” The implication here is that those reports will dry up if Meta continues expanding its use of E2EE to Instagram. Pointing out that Meta-owned WhatsApp has had the gold standard encryption as its default for years, Robinson wondered if this wasn’t a case of the crime agency trying to close the stable door after the horse has bolted. He got no straight answer to that — just more head-scratching equivocation.

The dawn of intelligent and automated data orchestration

Moving the data from one vendor’s storage type to another, or to a different location or cloud, involves creating a new copy of both the file system metadata and the actual file essence. This proliferation of file copies and the complexity needed to initiate copy management across silos interrupts user access and inhibits IT modernization and consolidation use cases. This reality also impacts data protection, which may become fragmented across the silos. ... It also creates economic inefficiencies when multiple redundant copies of data are created, or when idle data gets stuck on expensive high-performance storage systems when it would be better managed elsewhere. What is needed is a way to provide users and applications with seamless multi-protocol access to all their data, which is often fragmented across multiple vendor storage silos, including across multiple sites and cloud providers. In addition to global user access, IT administrators need to be able to automate cross-platform data services for workflow management, data protection, tiering, etc., but do so without interrupting users or applications.

Quote for the day:

"The ability to summon positive emotions during periods of intense stress lies at the heart of effective leadership." -- Jim Loehr

Daily Tech Digest - April 22, 2024

AI governance for cloud cost optimisation: Best practices in managing expenses in general AI deployment

AI-enabled cost optimization solutions, in contrast to static, threshold-based tools can actively detect and eliminate idle and underused resources, resulting in significant cost reductions. In addition, they are equipped to foresee and avert possible problems like lack of resources and performance difficulties, guaranteeing continuous and seamless operations. They can also recognize cost anomalies, swiftly respond to them, and even carry out pre-planned actions. This method eliminates the need for continual manual intervention while ensuring effective operations. ... Cloud misconfiguration or improper utilization of cloud resources are frequently the cause of computing surges. One possible scenario is when a worker uses a resource more frequently than necessary. By determining the root cause, organizations can contribute to reducing unnecessary cloud resource utilization. By employing AI-enabled cost optimization tools, businesses can improve consumption and identify irregularities to minimize overspending. Moreover, these tools reduce the time-consuming effort of manually screening and evaluating behavior.

The first steps of establishing your cloud security strategy

The purpose of CIS Control 3 is to help you create processes for protecting your data in the cloud. Consumers don’t always know that they’re responsible for cloud data security, which means they might not have adequate controls in place. For instance, without proper visibility, cloud consumers might be unaware that they’re leaking their data for weeks, months, or even years. CIS Control 3 walks you through how to close this gap by identifying, classifying, securely handling, retaining, and disposing of your cloud-based data, as shown in the screenshot below. ... In addition to protecting your cloud-based data, you need to manage your cloud application security in accordance with CIS Control 16. Your responsibility in this area applies to applications developed by your in-house teams and acquired from external product vendors. To prevent, detect, and remediate vulnerabilities in your cloud-based applications, you need a comprehensive program that brings together people, processes, and technology. Continuous Vulnerability Management, as discussed in CIS Control 7, sits at the heart of this program.

Want to become a successful data professional? Do these 5 things

"I think tech can be quite scary from the outside, but no one knows everything in technology," she says. Young professionals will quickly learn everyone has gaps in their digital knowledge base -- and that's a good thing because people in IT want to learn more. "That's the brilliant thing about it. Even if you're an expert in one thing, you'll know next to nothing in a different part." Whitcomb says the key to success for new graduates is seeing every obstacle as an opportunity. "Going in from square one is quite intimidating," she says. "But if you have that mindset of, 'I want to learn, I'm willing to learn, and I can think logically' then you'll be great. So, don't be put off because you don't know how to code at the start." ... The prevalence of data across modern business processes means interest in technology has peaked during the past few years. However, some young people might still see technology as a dry and stuffy career -- and Whitcomb says that's a misconception. "That always bugs me a little bit. I think IT is incredibly creative. The things you can do with tech are amazing," she says.

Is Scotland emerging as the next big data center market?

From a sustainability perspective, Scotland is second to none. While the weather may have a miserable reputation, it is nonetheless ideal for data centers. A cooler climate means we can rely more on nature to keep equipment at optimum temperatures, with less of a need for energy-intensive air conditioning. Scotland’s energy mix also consists of a much higher than average share of renewables. The carbon intensity – a measure of how clean electricity is – of Scotland’s grid is well ahead of the other European countries and even compares favorably against other parts of the UK. Relocating a data center from Warsaw to Glasgow could cut the carbon intensity of its energy by as much as 99 percent. Scotland’s carbon intensity is one-quarter of London’s, meaning moving a 200-rack facility could save more than six million kilograms of CO2 equivalent, equal to over 14 million miles traveled by the average mid-sized car. ... There is a strong cost imperative too. Relocating to Scotland could save up to 70 percent in operational costs compared to other markets, partially thanks to the cooler climate. The cost of land is another major factor – data center-ready land in Glasgow can cost up to 90 percent less than Slough, Greater London.

Winning Gen AI Race with Your Custom Data Strategy

Essentially, the Data Fabric Strategy involves a comprehensive plan to seamlessly integrate diverse data sources, processing capabilities, and AI algorithms to enable the creation, training, and deployment of generative AI models. It provides a unified platform approach for the Collection of Data, Organizing the data, and Allowing good Governance over data, facilitating the development of winning AI Products. The Product Manager establishes the North Star Metrics (NSM) for the product according to the business context, with the most prevalent and crucial NSM being User Experience, contingent upon three pivotal factors. ... Embarking on the journey of implementing a Data Fabric Strategy, the pinnacle stage lies in sculpting the Solution Architecture tailored for Gen AI product. While the accountability rests with the Product Manager, the creation of this vital blueprint falls under the purview of the Architect. In dissecting the intricacies of Data Fabric solutions, we encounter two fundamental components: the user-facing interactions and the robust Data Processing Pipeline.

Disciplined entrepreneurship: 6 questions for startup success

Identify key assumptions to be tested before you begin to make heavy investments in product development. It will be faster and much less costly now to test the assumptions and allow you to preserve valuable resources and adjust as needed. Test each of the individual assumptions you have identified. This scientific approach will allow you to understand which assumptions are valid and which ones are not and then adjust when the cost of doing so is much lower and can be done much faster. Define the minimal product you can use to start the iterative customer feedback loop —where the customer gets value from the product and pays for it. You must reduce the variables in the equation to get the customer feedback loop started with the highest possibility of success with simultaneously the most efficient use of your scarce resources. ... Calculate the annual revenues from the top follow-on markets after you are successful in your beachhead market. It shows the potential that can come from winning your beachhead and motivates you to do so quickly and effectively.

7 innovative ways to use low-code tools and platforms

One of the 7 Rs of cloud app modernization is to replatform components rather than lift and shift entire applications. One replatforming approach is maintaining back-end databases and services while using low-code platforms to rebuild front-end user experiences. This strategy can also enable the development of multiple user experiences for different business purposes, a common practice performed by independent software vendors (ISVs) who build one capability and tailor it to multiple customers. Deepak Anupalli, cofounder and CTO of WaveMaker, says, “ISVs recast their product UX while retaining all their past investment in infrastructure, back-end microservices, and APIs. ... Another area of innovation to consider is when low-code components can replace in-house commodity components. Building a rudimentary register, login, and password reset capability is simple, but today’s security requirements and user expectations demand more robust implementations. Low-code is one way to upgrade these non-differentiating capabilities without investing in engineering efforts to get the required experience, security, and scalability.

Beyond 24/7: How Smart CISOs are Rethinking Threat Hunting

To combat this phenomenon, CISOs are rethinking their approach as the model of 24/7 in-house threat hunting is no longer sustainable for many businesses. Instead, we see an increasing focus on value-driven security solutions that make their own tools work better, harder, and more harmoniously together. This means prioritizing tools that leverage telemetry, deliver actionable insights and integrate into existing stacks seamlessly – and don’t just create another source of noise. This is where Managed Detection and Response (MDR) services come in. Managed Detection and Response (MDR) services offer a strategic solution to these challenges. MDR providers employ experienced security analysts who monitor your environment 24/7, leveraging advanced threat detection and analysis tools and techniques. ... Start by evaluating your current security posture. Identify your organization’s specific security needs and vulnerabilities. This helps you understand how MDR can benefit you and what features are most important. Don’t be swayed by brand recognition alone. While established players offer strong solutions, smaller MDR providers can be equally adept, often with greater flexibility and potentially lower costs.

A time to act: Why Indian businesses need to adopt AI agents now

Currently, the conversational AI chatbots in the market listen to what businesses want and deliver exactly that. This is only one aspect of what generative AI can do. AI Agents take it a step further by performing the same functions as conversational AI bots but with the added capability of acting intuitively. For example, while planning a vacation it can complete an expense report without being asked or plan a travel itinerary, book tickets and more. However, there is more than just one use case and these assistants can be used across industries. ... Imagine a scenario where an AI Agent is deployed in tandem with the IoT device monitoring signals that indicate when a machine needs to replace parts. AI Agents can be used to automatically order parts, and have them shipped to specific locations along with recommended times for the technician to arrive for the maintenance work. All of this with no downtime. This is merely scratching the surface of what AI Agents can do. Built on Large Actions Models, AI Agents can automate a wide range of tasks across various industries.

6 security items that should be in every AI acceptable use policy

Corporate policies need to include a security item that deals with protecting the sensitive data that the AI system uses. By including a security item that addresses how the AI system uses sensitive data, organizations can promote transparency, accountability, and trust in their AI practices while safeguarding individuals’ privacy and rights. “So if an AI system is being used to assess whether somebody is going to be getting insurance, or healthcare, or a job, that information needs to be used carefully,” says Nader Henein, research vice president, privacy and data protection at Gartner. Companies need to ask what information is going to be given to those AI systems, and what kind of care is going to be taken when they use that data to make sensitive decisions, Henein says. The AI AUP needs to establish protocols for handling sensitive data to safeguard privacy, comply with regulations, manage risks, and maintain trust with users and others. These protocols ensure that sensitive data, such as personal information or proprietary business data, is protected from unauthorized access or misuse.

Quote for the day:

''Your most unhappy customers are your greatest source of learning.'' -- Bill Gates

Daily Tech Digest - April 19, 2024

Cloud cost management is not working

The Forrester report illuminates significant visibility challenges when using existing CCMO tools. Tracking expenses across different cloud activities, such as data management, egress charges, and application integration, remains a challenge. Finops is normally on the radar, but these enterprises have yet to adopt useful finops practices, with most programs either nonexistent or not yet off the ground, even if funded. Then there’s the fact that enterprises are not good at using these tools yet, and they seem to add more cost with little benefit. The assumption is that they will get better and costs will get under control. However, given the additional resource needs for AI deployments, improvements are not likely to occur for years. At the same time, there is no plan to provide IT with additional funding, and many companies are attempting to hold the line on spending. Despite these challenges, getting cloud spending under control continues to be a priority, even if results do not show that. This means major fixing needs to be done at the architecture and integration level, which most in IT view as overly complex and too expensive to fix.

Why Selecting the Appropriate Data Governance Operating Model Is Crucial

When deciding on the data governance operating model, you cannot simply pick one approach without evaluating the benefits each one offers. You need to weigh the potential benefits of centralized and decentralized governance models before making a decision. If you find that the benefits of centralizing your governance operations exceed those of a decentralized model by at least 20%, then it’s best to centralize. With a centralized governance model, you can bridge the skills gap, enjoy consistent outcomes across all business units, easily report on operations, ensure executive buy-in at the C-level, and plan for effectiveness in continuous feedback elicitation, improvements, and change management. However, the downside is that it often leads to operation rigidity, which reduces motivation among mid-level managers, and bureaucracy often outweighs the benefits. It’s important to consider socio-cultural aspects when formulating your operating model, as they can significantly influence the success of your organization.

5 Steps Toward Military-Grade API Security

When evaluating client security, you must address environment-specific threats. In the browser, military grade starts with ensuring the best protections against token theft, where malicious JavaScript threats, also known as cross-site scripting (XSS), are the biggest concern. To reduce the impact of an XSS exploit, it is recommended to use the latest and most secure HTTP-only SameSite cookies to transport OAuth tokens to your APIs. Use a backend-for-frontend (BFF) component to issue cookies to JavaScript apps. The BFF should also use a client credential when getting access tokens. ... A utility API then does the cookie issuing on behalf of its SPA without adversely affecting your web architecture. In an OAuth architecture, clients obtain access tokens by running an OAuth flow. To authenticate users, a client uses the OpenID Connect standard and runs a code flow. The client sends request parameters to the authorization server and receives response parameters. However, these parameters can potentially be tampered with. For example, an attacker might replay a request and change the scope value in an attempt to escalate privileges.

Break Security Burnout: Combining Leadership With Neuroscience

The problem for cybersecurity pros is that they often get stuck in a constant state of psychological fight-or-flight response pattern due to the constant stress cycle of their jobs, Coroneos explains. iRest is a training that helps them switch out of this cycle to bring them to a deeper state of relaxation to reset that fight-or-flight response. This will help the brain switch off, so it is not constantly creating stress not only in the workplace but throughout their everyday lives, thus creating burnout, he says. "We need to get them into a position where they can come into a proper relationship into their subconscious," Coroneos says, adding that so far cybersecurity professionals who have experienced the training — which Cybermindz is currently piloting— report they are sleeping better and making clearer decisions after only a few sessions of the program. Indeed, while burnout remains a serious problem, the message Coroneos and Williams ultimately want to convey is one of hope that there are solutions to solve the burnout problem currently facing cybersecurity professionals, and that the enormous pressures these dedicated professionals face is not being overlooked.

Unlocking Customer Experience: The Critical Role of Your Supply Chain

It is crucial to find a partner that understands that digital transformation alone is not enough. Unlike point solution vendors who solve isolated problems, prioritize a partner that focuses on three main areas: people, processes, and systems. A good partner will begin its approach by understanding what is actually happening with mission-critical processes in the supply chain like inbound and outbound logistics, supplier management, customer service, help desk, and financial processes. Understanding these root causes helps identify opportunities for improvement and automation. Analyzing data and feedback reveals pain points, bottlenecks, and inefficiencies within each process. Utilizing process mapping and performance metrics helps pinpoint areas ripe for enhancement. Automation technologies, like AI and machine learning, streamline repetitive tasks, reducing errors and enhancing efficiency. By continuously assessing and optimizing these processes, businesses can improve responsiveness, reduce costs, and enhance overall supply chain performance, ultimately driving customer satisfaction and competitive advantage.

AI migration woes: Brain drain threatens India’s tech future

To address the challenge of talent migration, the biggest companies in India must work together to democratise access to resources and opportunities within its tech ecosystem. One key aspect of this approach involves fostering a culture of open collaboration among key stakeholders, including top-tier venture capitalists (VCs), corporates, academia and leading startups because no single entity can drive AI innovation in isolation. By creating a collaborative ecosystem where information is freely shared and resources are pooled, can level the playing field and provide equal opportunities for aspiring AI professionals across the nation. This could involve the establishment of platforms dedicated to knowledge exchange, networking events and cross-sector partnerships aimed towards accelerating innovation. ... In addition to these fundamental elements, the tech ecosystem in India must also prioritise accessibility and affordability in the adoption of AI-integrated technologies. The future-ready benefits of AI should be democratised, reaching not only large brands but also small and medium-sized enterprises (SMEs), startups and grassroots organisations.

Are you a toxic cybersecurity boss? How to be a better CISO

Though most CISOs treat their employees fairly, CISOs are human beings — with all the frailties, quirks, and imperfections of the human condition. But CISOs behaving badly expose their own organizations to huge risks. ... One of the thorniest challenges of a toxic CISO is that the person causing the problem is also the one in charge, making them susceptible to blind spots about their own behavior. Nicole L. Turner, a specialist in workplace culture and leadership coaching, got a close-up look at this type of myopia when a top exec (in a non-security role) recently hired her to deliver leadership training to the department heads at his company. “He felt like they needed training because he could tell some things were going on with them, that they were burned out and overwhelmed. But as I’m training them, I notice these sidebar conversations [among his staff] that he was the problem, more so than the work itself. It was just such an ironic thing and he didn’t know,” recounts Turner, owner and chief culture officer at Nicole L. Turner Consulting in Washington, D.C. There’s also some truth to the adage that it’s lonely at the top, especially in a hypercompetitive corporate environment.

Who owns customer identity?

Onboarding users securely but still seamlessly is a constant conflict in many types of businesses, from retail, insurance, to fintech. ... If you are from a regulated industry, MFA becomes important. Make it a risk-based MFA, however, to reduce undue friction. If your business offers a D2C or B2C product or service, seamless onboarding is your number one priority. If user friction is the primary reason for your CIAM initiative, the product team or engineering team should take the lead and bring other teams along. If MFA is the main use case, the CISO should lead the discussions and then bring other teams along. ... If testing or piloting is possible, do so. Experimentation is very valuable in a CIAM context. Whether you are moving to a new CIAM solution, trying a new auth method, or changing your onboarding process in any other way, run a pilot or an A/B test first. Starting small, measuring the results, and taking longer-term decisions accordingly is a healthy cycle to follow when it comes to customer identity processes.

GenAI: A New Headache for SaaS Security Teams

The GenAI revolution, whose risks remain in the realm of the unknown unknown, comes at a time when the focus on perimeter protection is becoming increasingly outdated. Threat actors today are increasingly focused on the weakest links within organizations, such as human identities, non-human identities, and misconfigurations in SaaS applications. Nation-state threat actors have recently used tactics such as brute-force password sprays and phishing to successfully deliver malware and ransomware, as well as carry out other malicious attacks on SaaS applications. Complicating efforts to secure SaaS applications, the lines between work and personal life are now blurred when it comes to the use of devices in the hybrid work model. With the temptations that come with the power of GenAI, it will become impossible to stop employees from using the technology, whether sanctioned or not. The rapid uptake of GenAI in the workforce should, therefore, be a wake-up call for organizations to reevaluate whether they have the security tools to handle the next generation of SaaS security threats.

What CIOs Can Learn from an Attempted Deepfake Call

Defending against deepfake threats takes a multifaceted strategy. “There's a three-pronged approach where there's education, there's culture, and there's technology,” says Kosak. NINJIO focuses on educating people on cybersecurity risks, like deepfakes, with short, engaging videos. “If you can deepfake a voice and a face or an image based on just a little bit of information or maybe three to four seconds of that voice tone, that's sending us down a path that is going to require a ton of verification and discipline from the individual’s perspective,” says McAlmont. He argues that an hour or two of annual training is insufficient as threats continue to escalate. More frequent training can help increase employee vigilance and build that culture of talking about cybersecurity concerns. When it comes to training around deepfakes, awareness is key. These threats will continue to come. What does a deepfake sound or look like? (Pretty convincing in many cases.) What are some of the common signs that the person you hear or see isn’t who they say they are?

Quote for the day:

“A real entrepreneur is somebody who has no safety net underneath them.” -- Henry Kravis

Daily Tech Digest - April 17, 2024

Are You Delivering on Developer Experience?

A critical concept in modern developer experience is the “inner loop” of feedback on code changes. When a developer has a quick and familiar system to get feedback on their code, it encourages multiple cycles of testing and experimentation before code is deployed to a final test environment or production. The “outer loop” of feedback involves a more formal process of proposing tests, merging changes, running integration and then end-to-end tests. When problems are found on the outer loop, the result is larger, slower deployments with developers receiving feedback hours or days after they write code. Outer loop testing can still be testing that is automated and kicked off by the original developer, but another common issue with feedback that comes later in the release cycle is that it comes from human testers or others in the release process. This often results in feedback that is symptomatic rather than identifying root causes. When feedback isn’t clear, it’s as bad or worse than unclear requirements: Developers can’t work quickly on problems they haven’t diagnosed, and they’ve often moved on to other projects in the time between deployment and finding an issue.

The digital tapestry: Safeguarding our future in a hyper-connected world

Data centers, acting as the computational hearts, power grids as the electrical circulatory system, and communication networks as the interconnected neural pathways – these elements form the infrastructure that facilitates the flow of information, the very essence of modern life. But like any complex biological system, they have vulnerabilities. A sophisticated cyberattack can infiltrate a data center, disrupting critical services. A natural disaster can sever communication links, isolating entire regions. These vulnerabilities highlight the paramount importance of resilience. We must design and maintain infrastructure that can withstand these disruptions, adapt to changing demands, and recover swiftly from setbacks. This intricate dance becomes even more critical as we attempt to seamlessly integrate revolutionary technologies like artificial intelligence (AI) into the fabric of our critical infrastructure. As we know, AI offers incredible potential, functioning like a highly sophisticated adaptive learning algorithm within the data center and critical infrastructure network.

5 Strategies To Get People To Listen To You At Work

Credibility is currency at work. It is built over time, not by title or position but through displays of integrity, expertise, and knowledge. To be considered credible we need to have something valuable to say, and we can hone that by investing in continuous learning, staying abreast of industry trends, and demonstrating an ability to contribute to the success of the team through our actions and contributions. ... Tailor your message to resonate with the concerns, interests, and communication preferences of those you’re addressing. Speaking to executives, for instance, demands clarity, brevity, and alignment with strategic goals. Anticipate their probing questions about risks and opportunities and emphasize the impact on the bottom line. ... When people come to speak with you, silence your phone and computer and give them your full attention. Ask them follow-up questions, take notes, and adopt a mindset of learning. By demonstrating genuine interest and appreciation for your team members’ viewpoints, you will foster a culture of collaboration and mutual respect that encourages others to listen to you in turn.

Thinking outside the code: How the hacker mindset drives innovation

The hacker mindset has a healthy disrespect for limitations. It enjoys challenging the status quo and looking at problems with a “what if” mentality: “what if a malicious actor did this?” or “what if we look at data security from a different angle? This pushes tech teams to think outside the code, and explore more unconventional solutions. In its essence, hacking is about creating new technologies or using existing technologies in unexpected ways. It’s about curiosity, the pursuit for knowledge, wondering “what else can this do?” I can relate this to movies like The Matrix; it’s about not accepting reality as a “read-only” situation. It’s about changing your technical reality, learning which software elements can be manipulated, changed or re-written completely. ... Curiosity is one of the most important elements to fuel growth. Organizations with a “question everything” attitude will be the first to adapt to new threats; first to seize opportunities; and last to become obsolete. For me, ideal organizations are tech-driven playgrounds that encourage experimentation and celebrate failure as progress.

SAS Viya and the pursuit of trustworthy AI

Ensuring ethical use of AI starts before a model is deployed—in fact, even before a line of code is written. A focus on ethics must be present from the time an idea is conceived and persist through the research and development process, testing, and deployment, and must include comprehensive monitoring once models are deployed. Ethics should be as essential to AI as high-quality data. It can start with educating organizations and their technology leaders about responsible AI practices. So many of the negative outcomes outlined here arise simply from a lack of awareness of the risks involved. If IT professionals regularly employed the techniques of ethical inquiry, the unintended harm that some models cause could be dramatically reduced. ... Because building a trustworthy AI model requires a robust set of training data, SAS Viya is equipped with strong data processing, preparation, integration, governance, visualization, and reporting capabilities. Product development is guided by the SAS Data Ethics Practice (DEP), a cross-functional team that coordinates efforts to promote the ideals of ethical development—including human centricity and equity—in data-driven systems.

From skepticism to strength: The evolution of Zero Trust

The core concepts are the same. The principle of least privilege and assume breach mentality are still key. For example, backup management systems must be isolated on the network so that no unauthenticated users can access it. Likewise, the backup storage system itself must be isolated. Immutability is also key. Having backup data that cannot be changed or tampered with means if repositories are reached by attacks like ransomware, they cannot be affected by its malware. Assuming a breach also means businesses should not implicitly ‘trust’ their backups after an attack. Having processes to properly validate the backup or ‘clean’ it before attempting system recovery is vital to ensure you are not simply restoring a still-compromised environment. The final layer of distrust is to have multiple copies of your backups – fail-safes in case one (or more) are compromised. The best practice is to have three copies of your backup, two stored on different media types, one stored onsite, and one kept offline. With these layers of resilience, you can start to consider your backup as Zero Trust. With Zero Trust Data Resilience, just like zero trust, it is a journey. You cannot implement it all at once.

Where in the world is your AI? Identify and secure AI across a hybrid environment“

Your AI strategy is as good as your data strategy,” says Brad Arkin, chief trust officer at Salesforce. “Organizations adopting AI must balance trust with innovation. Tactically, that means companies need to do their diligence — for example, taking the time to classify data and implement specific policies for AI use cases.” ... Threat vectors like the DNS or APIs connecting to backend or cloud-based data lakes or repositories, particularly over IoT (internet of things), constitute two major vulnerabilities to sensitive data, adds Julie Saslow Schroeder, a chief legal officer and pioneer in AI and data privacy laws and SaaS platforms. “By putting up insecure chatbots connecting to vulnerable systems, and allowing them access to your sensitive data, you could break every global privacy regulation that exists without understanding and addressing all the threat vectors.” ... Arkin says security is a shared responsibility between cloud/SaaS provider and enterprise customers, emphasizing optional detection controls like event monitoring and audit trails that help customers gain insights into who’s accessing their data, for what purpose, and the type of processing being done.

Where Are You on the Cybersecurity Readiness Index? Cisco Thinks You’re Probably Overconfident

As we noted, cybersecurity readiness is alarmingly low across the board. However, that’s not reflected in the confidence of the companies that responded to the Cisco study. Some 80% of respondents, down slightly from last year, say they’re moderate to very confident in their ability to stay resilient. Cisco believes their confidence is misplaced and that they have not assessed the scale of their challenges. I agree that confidence will only get companies in trouble. With cyber security, it’s best to maintain a healthy paranoia and plan for the worst. No one thinks they’ll get in a car accident from texting on their phones until it happens. That’s when people change their behavior. There are many other revealing takeaways in this nearly 30-page report. But there’s nothing more alarming that—even after decades of having it driven home and having boardrooms and c-suites supposedly buy in—cyber threats are still taken too lightly. There are gaps in maturity, coverage, talent, and self-awareness. The underlying cause of these gaps is hard to pin down. But it likely comes from how we can all hold contradictory beliefs in our heads simultaneously. We can all freely acknowledge that cybersecurity is a significant threat.

The Global Menace of the Russian Sandworm Hacking Team

The group's ambitions have long been global: "The group’s readiness to conduct cyber operations in furtherance of the Kremlin’s wider strategic objectives globally is ingrained in its mandate." Past attacks include a 2016 hack against the Democratic National Committee, the 2017 NotPetya wave of encrypting software and the 2018 unleashing of malware known as Olympic Destroyer that disrupted the winter Olympics being held in South Korea. The group has recently turned to mobile devices and networks including a 2023 attempt to deploy malware programmed to spy on Ukrainian battlefield management apps. According to Mandiant, the group is directing and influencing the development of "hacktivist" identities in a bid to augment the psychological effects of its operations. Especially following the February 2022 invasion, Sandworm has used a series of pro-Russian Telegram channels including XakNet Team and Solntsepek to claim responsibility for hacks and leak stolen information. Sandworm also appears to have a close relationship with CyberArmyofRussia_Reborn.

How AI is Transforming Traditional Code Review Practices

The most effective use of AI in software development marries its strengths with the irreplaceable intuition, creativity, and experience of human developers. This synergistic approach leverages AI for what it does best — speed, consistency, and automation — while relying on humans for strategic decision-making and nuanced understanding that AI (currently) cannot replicate. AI can now be used to address the challenges of traditionally human-centric process of code reviews. For example, AI can scan entire code repositories and workflow systems to understand the context in which the codebase runs. ... Future advancements will see AI evolve into the role of a collaborator, capable of more complex reasoning, offering design suggestions, best practices, and even predicting or simulating the impact of code changes on software functionality and performance. AI can provide deeper insights into code quality, offer personalized feedback, and play a key role in installing a culture of learning and improvement within development teams.

Quote for the day:

"It is in your moments of decision that your destiny is shaped." -- Tony Robbins

Daily Tech Digest - April 16, 2024

How to Build a Successful AI Strategy for Your Business in 2024

With a solid understanding of AI technology and your organization’s priorities, the next step is to define clear objectives and goals for your AI strategy. Focus on identifying the problems that AI can solve most effectively within your organization. These objectives should be specific, measurable, achievable, relevant, and time-bound (SMART). ... By setting well-defined objectives, you can create a targeted AI strategy that delivers tangible results and aligns with your overall business priorities. An AI implementation strategy often requires specialized expertise and tools that may not be available in-house. To bridge this gap, identify potential partners and vendors who can provide the necessary support for your AI strategy.Start by researching AI and machine learning companies that have a proven track record of working in your industry. When evaluating potential partners, consider factors such as their technical capabilities, the quality of their tools and platforms, and their ability to scale as your AI needs grow. Look for vendors who offer comprehensive solutions that cover the entire AI lifecycle, from data preparation and model development to deployment and monitoring.

Internet can achieve quantum speed with light saved as sound

When transferring information between two quantum computers over a distance—or among many in a quantum internet—the signal will quickly be drowned out by noise. The amount of noise in a fiber-optic cable increases exponentially the longer the cable is. Eventually, data can no longer be decoded. The classical Internet and other major computer networks solve this noise problem by amplifying signals in small stations along transmission routes. But for quantum computers to apply an analogous method, they must first translate the data into ordinary binary number systems, such as those used by an ordinary computer. This won't do. Doing so would slow the network and make it vulnerable to cyberattacks, as the odds of classical data protection being effective in a quantum computer future are very bad. "Instead, we hope that the quantum drum will be able to assume this task. It has shown great promise as it is incredibly well-suited for receiving and resending signals from a quantum computer. So, the goal is to extend the connection between quantum computers through stations where quantum drums receive and retransmit signals, and in so doing, avoid noise while keeping data in a quantum state," says Kristensen.

Better application networking and security with CAKES

A major challenge in enterprises today is keeping up with the networking needs of modern architectures while also keeping existing technology investments running smoothly. Large organizations have multiple IT teams responsible for these needs, but at times, the information sharing and communication between these teams is less than ideal. Those responsible for connectivity, security, and compliance typically live across networking operations, information security, platform/cloud infrastructure, and/or API management. These teams often make decisions in silos, which causes duplication and integration friction with other parts of the organization. Oftentimes, “integration” between these teams is through ticketing systems. ... Technology alone won’t solve some of the organizational challenges discussed above. More recently, the practices that have formed around platform engineering appear to give us a path forward. Organizations that invest in platform engineering teams to automate and abstract away the complexity around networking, security, and compliance enable their application teams to go faster.

AI set to enhance cybersecurity roles, not replace them

Ready or not, though, AI is coming. That being the case, I’d caution companies, regardless of where they are on their AI journey, to understand that they will encounter challenges, whether from integrating this technology into current processes or ensuring that staff are properly trained in using this revolutionary technology, and that’s to be expected. As a cloud security community, we will all be learning together how we can best use this technology to further cybersecurity. ... First, companies need to treat AI with the same consideration as they would a person in a given position, emphasizing best practices. They will also need to determine the AI’s function — if it merely supplies supporting data in customer chats, then the risk is minimal. But if it integrates and performs operations with access to internal and customer data, it’s imperative that they prioritize strict access control and separate roles. ... We’ve been talking about a skills gap in the security industry for years now and AI will deepen that in the immediate future. We’re at the beginning stages of learning, and understandably, training hasn’t caught up yet.

Why employee recognition doesn't work: The dark side of boosting team morale

Despite the importance of appreciation, many workplaces prioritise performance-based recognition, inadvertently overlooking the profound impact of genuine appreciation. This preference for recognition over appreciation can lead to detrimental outcomes, including conditionality and scarcity. Conditionality in recognition arises from its link to past achievements and performance outcomes. Employees often feel pressured to outperform their peers and surpass their past accomplishments to receive recognition, fostering a hypercompetitive work environment that undermines collaboration and teamwork. Furthermore, the scarcity of recognition exacerbates this issue, as tangible rewards such as bonuses or promotions are limited. In this competitive landscape, employees may feel undervalued, leading to disengagement and disillusionment. To foster an inclusive and supportive workplace culture, organisations must recognise the intrinsic value of appreciation alongside performance-based recognition. Embracing appreciation cultivates a culture of gratitude, empathy, and mutual respect, strengthening interpersonal connections and boosting employee morale.

Improving decision-making in LLMs: Two contemporary approaches

Training LLMs in context-appropriate decision-making demands a delicate touch. Currently, two sophisticated approaches posited by contemporary academic machine learning research suggest alternate ways of enhancing the decision-making process of LLMs to parallel those of humans. The first, AutoGPT, uses a self-reflexive mechanism to plan and validate the output; the second, Tree of Thoughts (ToT), encourages effective decision-making by disrupting traditional, sequential reasoning. AutoGPT represents a cutting-edge approach in AI development, designed to autonomously create, assess and enhance its models to achieve specific objectives. Academics have since improved the AutoGPT system by incorporating an “additional opinions” strategy involving the integration of expert models. This presents a novel integration framework that harnesses expert models, such as analyses from different financial models, and presents it to the LLM during the decision-making process. In a nutshell, the strategy revolves around increasing the model’s information base using relevant information.

Unpacking the Executive Order on Data Privacy: A Deeper Dive for Industry Professionals

For privacy professionals, the order underscores the ongoing challenge of protecting sensitive information against increasingly sophisticated threats. That’s important, and shouldn’t be overlooked. Yet the White House has admitted that this order isn’t a silver bullet for all the nation’s data privacy challenges. That candor is striking. It echoes a sentiment familiar to many of us in the industry: the complexities of protecting personal information in the digital age cannot be fully addressed through singular measures against external threats. Instead, this task requires a long-term, thoughtful, multi-faceted approach – one that also confronts the internal challenges to data privacy posed by Big Tech, domestic data brokers, and foreign governments that exist outside of the designated “countries of concern” category. ... The extensive collection, usage, and sale of personal data by domestic entities—including but not limited to Big Tech companies, data brokers, and third-party vendors—poses significant risks. These practices often lack transparency and accountability, fueling privacy breaches, identity theft, and eroding public trust and individual autonomy.

10 tips to keep IP safe

CSOs who have been protecting IP for years recommend doing a risk and cost-benefit analysis. Make a map of your company’s assets and determine what information, if lost, would hurt your company the most. Then consider which of those assets are most at risk of being stolen. Putting those two factors together should help you figure out where to best spend your protective efforts (and money). If information is confidential to your company, put a banner or label on it that says so. If your company data is proprietary, put a note to that effect on every log-in screen. This seems trivial, but if you wind up in court trying to prove someone took information they weren’t authorized to take, your argument won’t stand up if you can’t demonstrate that you made it clear that the information was protected. ... Awareness training can be effective for plugging and preventing IP leaks, but only if it’s targeted to the information that a specific group of employees needs to guard. When you talk in specific terms about something that engineers or scientists have invested a lot of time in, they’re very attentive. As is often the case, humans are often the weakest link in the defensive chain.

Types of Data Integrity

Here are a few data integrity issues and risks many organizations face: Compromised hardware: Power outages, fire sprinklers, or a clumsy person knocking a computer to the floor are examples of situations that can cause the loss of vital data or its corruption. Security considers compromised hardware to be hardware that has been hacked. Cyber threats: Cyber security attacks – phishing attacks, malware – present a serious threat to data integrity. Malicious software can corrupt or alter critical data within a database. Additionally, hackers gaining unauthorized access can manipulate or delete data. If changes are made as a result of unauthorized access, it may be a failure in data security. ... Human error: A significant source of data integrity problems is human error. Mistakes that are made during manual entries can produce inaccurate or inconsistent data that then gets stored in the database. Data transfer errors: During the transfer of data, data integrity can be compromised. Transfer errors can damage data integrity, especially when moving massive amounts of data during extract, transform, and load processes, or when moving the organization’s data to a different database system.

Sisense Breach Highlights Rise in Major Supply Chain Attacks

Many of the details of the attack are not yet clear, but the breach may have exposed hundreds of Sisense's prominent customers to a supply chain attack that gave hackers a backdoor into the company's customer networks, a CISA official told Information Security Media Group. Experts said the attack suggests trusted companies are still failing to implement proactive defensive measures to spot supply chain attacks - such as robust access controls, real-time threat intelligence and regular security assessments - at a time when organizations are increasingly reliant on interconnected ecosystems. "These types of software supply chain attacks are only possible through compromised developer credentials and account information from an employee or contractor," said Jim Routh, chief trust officer for the software security company Saviynt. The breach highlights the need for enterprises to improve their identity access management capabilities for cloud-based services and other third parties, he said. Security intelligence platform Censys published insights into the Sisense breach Friday.

Quote for the day:

"Success is the progressive realization of predetermined, worthwhile, personal goals." -- Paul J. Meyer