January 29, 2014

VPN bypass vulnerability affects Android Jelly Bean and KitKat
A malicious app can exploit the newly identified Android vulnerability to bypass an active VPN connection and route all data communications from the device to a network address controlled by an attacker, the Ben-Gurion University researchers said Monday in a blog post. "These communications are captured in CLEAR TEXT (no encryption), leaving the information completely exposed. This redirection can take place while leaving the user completely oblivious, believing the data is encrypted and secure."


Crafting a data lifecycle management strategy to control capacity
As with data being classified, ILM also requires storage to be classified. Storage arrays offering specialty features such as fast access or slower access but low cost per-GB, or that offer special data protection services such as mirroring, replication or continuous data protection, can be given their own target classification, thereby providing discrete destinations for data writes and data moves.


When Design Best Practices Become Performance Worst Practices
It conforms to known design and usability best practices, and your testers loved it in the lab. You push the design to your live site and the results are … well, a little disappointing. Not terrible, but your conversion rate hasn’t made the leap you expected. Why? You’ve done everything by the book, but perhaps the book is missing a chapter or two. Chances are, you’ve accidentally made one of three common design mistakes, and these mistakes have affected how your pages load, which ultimately hurts page views, bounce rate, conversions, and pretty much every business metric you care about.


India Ranked 7th in Attacks by Trojans in Banking
The Internet among many things has made our daily activities very convenient, especially when it is percolated to mobile devices. Among other activities consumers now prefer ‘armchair banking’ where banking transactions are carried out easily. However, attackers who are financially motivated, target these online banking services and financial institutions by leveraging advanced Trojans to commit large scale financial fraud.


Leading by Taking a Step Back
We aspire to do more, dream more, learn more, and become more, and for better or worse, the traditional wisdom has been that we need to accomplish more in order to get more. But for many, experience, trial and error says differently. We pile on more projects, goals and objectives and lose sight of the one unifying vision that defines us as a company and as leaders. So how can leaders learn to step back and only move forward by putting one foot in front of the other at a time? How do we avoid becoming task managers and get back to being leaders? When everyone is “leaning in” to get ahead, does it make sense to “lean out” for a change?


Big Data's Opportunity for Information Optimization
Businesses are always looking for ways to grow and to streamline their operations. These two goals can come into conflict because as organizations become larger it becomes more complicated to be agile and efficient. To help them understand and modify their processes, businesses can derive insights from analytics applied to their data. Today that data is available not only in the enterprise and cloud computing environments but also from the Internet. To collect, process and analyze it all is a challenge, one that an increasing number of organizations are meeting through the use of big data technologies.


BYOD and the Internet of Things bring unique challenges for hospital CIOs
Both of these trends offer special security and interoperability challenges for hospitals. Developers are still working on how to merge this data with the various electronic medical records (EMRs) in use, but that’s the easy part. Data security is the more difficult issue. Not only do you need to ensure that unauthorized people do not access the network via any of these devices, you need to ensure security in transmission of the data. Again, this is a scenario that would (or at least should) create a high level of concern for any CIO.


Executives debate need for the CIO title
When it comes to appointing an organization's IT strategy leader, how important is it to dub that person the CIO? In the absence of a CIO title, does the title of IT director carry the same weight? Technology experts debated these questions and more during the recent "CEO/CIO Marriage Proposal" panel at the American Society of Association Executives (ASAE) Technology Conference in Washington, D.C.


Kanban’s service orientation agenda
Service orientation with Kanban starts with viewing the organization through the Kanban “lens” of service delivery, work flow and knowledge discovery. Typically, this begins with the identification of customer needs, expectations and frustrations, matched to the corresponding capabilities and frustrations of internal systems. The tools of the sustainability agenda (visualization, WIP controls, feedback loops, and so on) are then applied with a deliberate end-to-end emphasis, extending to the customer both upstream and downstream.


Get Ready, It's the Year for Big Data Heists
These security breaches were all different but had a common cause: negligence. Although the technology and techniques to protect data, or at least to make life more difficult for hackers, have been around for years, companies and their customers mostly assumed that data theft was something that happened to other people. They need to start getting wise. The U.S. retail attacks are part of a recent trend, reported by the cybersecurity firm CrowdStrike, in which the hackers (or "adversaries," as the company describes them) target point-of-sale devices in which physical credit cards are swiped.



Quote for the day:

"An inventor is simply a fellow who doesn't take his education too seriously" -- C. Kettering

January 28, 2014

The Internet of Things might not be what you're hoping for
The problem that we now face is that the internet into which IoT is being born is philosophically very different to the internet into which the web was born. The internet of twenty-plus years ago and prior was a place of free love and open standards. It all came from academia where commercial pressures were low. As we moved into the era where internet connectivity onto PCs was the norm -- I usually take this to be related to the introduction of Windows 95 -- what we as a society has done with the internet has had an uneasy relationship with this "free love", uncommercial philosophy.


Measuring the Impact of Social, Economic, and Technological Factors on Cybersecurity
Interestingly, the model found a paradox that stems from the modernization of information and communications technology. While increased Internet access and more mature technological development is correlated with improvement in cybersecurity at the global level, it has the opposite effect among countries with developing economies and lower levels of technological development. For example, as Broadband Penetration increases, Maximizers (countries that are more technologically mature) experience a decrease in malware, while Seeker countries (that are less technologically mature) experience an increase in malware.


Data-driven troubles
"Some time ago the company I work in decided to change one system with another. We wrote the new system and it was time for testing. In general at the first stage the new system must do the same things as the old one. We had a lot of tests for old system, so we decided to reuse these tests. The point was that the same test should be executed for both systems."


How and why to check port 32764 on your router
There are roughly 64,000 ports that are not tested by ShieldsUP. One of them is 32764. On a LAN, testing all 65,535 ports is a more do-able thing. Recently Eloi Vanderbecken did just that on his home network and turned up something interesting. His Linksys WAG 200G router responded to the virtual knock on the front door for port 32,764. The port was open and the router itself (not a computer on his LAN) was processing data sent to it.


Service Complexity And the Perils of Productization
Complexity can be a good thing. But when it comes to servicing customers, it is generally accepted that complexity reduces satisfaction. In other words, the proliferation of products in many service-based organizations prevents them from staying true to who they are—a service company. Service vision becomes clouded and the overall strategy is no longer clear to employees or customers. Modern banks simply have too many products and services for front-line staff to understand and properly explain to a customer.


Cisco aims to be cloud connector in hybrid data centers
Strategically, InterCloud may be the most interesting item for Cisco. If successful, InterCloud puts Cisco in the middle of the network and cloud connections on a software basis. Licensing models are still being worked out. If Cisco can make InterCloud a dominant software defined networking platform it'll have more licensing revenue and the profit margins that go with it. Meanwhile, InterCloud is designed to work with any server or switch, said Gori. Naturally, there will be more features enabled with Cisco's software and hardware combined.


Security testing basics: QA professionals take the lead
Having test professionals assume some responsibility for security testing basics is important for two reasons. First, application security is a growing concern for all software and test organizations as security breaches continue to make headline news. Second, getting testers involved can help solve a problem that plagues most software development organizations today, said Payne. "Where in the application lifecycle does security testing fit?"


Suspected email hackers for hire charged in four countries
Three other U.S. residents were charged with misdemeanor offenses for hiring email hackers from foreign countries. John Ross Jesensky, 30, of Northridge, Calif., is believed to have paid $21,675 to a Chinese website to get e-mail account passwords. Laith Nona, 31, of Troy, Michigan, and Arthur Drake, 55, of Bronx, N.Y., are suspected to have paid $1,081 and $1,011 respectively for similar services. The five defendants are expected to plead guilty in the coming weeks, the U.S. Attorney's Office said.


Big Data Influences More Long-Term Storage
The pursuit of big data has led to an increase of companies keeping older files they would have previously discarded, confirms Scott Gillespie, expert on regulations and compliance and senior VP of business analysis at Quadron Data Solutions. There is a six-year retention requirement of client account data, he explains. Account records, trades, holdings, profile information, goals and objectives and so on fall into this category. There are three reasons these records, which have historically been discarded with regularity, are now starting to stick around.


Agile with Guts - A pragmatic guide to value-driven development
You want to deliver valuable software with iterative delivery. There might be dozens of stakeholders with dozens of definition of value. How do you ensure you are both “building the right thing” and “building the thing right”? Suppose you are increasing your productivity, you might be building the wrong product faster. This book describes how a large organization uses techniques to focus on the right product and to deeply anchor the idea that less output can deliver more outcomes.



Quote for the day:

"The supreme quality for leadership is unquestionable integrity." -- Dwight D. Eisenhower

January 27, 2014

NSA surveillance revelations could lead to data collection policy
What one hopes it won't do is impede innovation. Sure, the data collection we see every day in things like targeted coupons and targeted advertisements can have a rather high creepiness quotient. But there's much good that big data collection can do. Examples abound -- from analyzing Tweets to understand smoking habits to collecting meter data to optimize the grid to improving automation. That's as long as the analytics end of the equations are sound.


The ROI of Data Governance
Many organizations have found success by “thinking globally and acting locally.” Sometimes referred to as guerilla governance, this may not be the fast path, but is likely the pragmatic path to enterprise data governance. This is not a shortcut – there’s no substitute for the broad-based communication, collaboration, coordination, executive sponsorship and investment required to obtain sustainable governance. It’s merely a way to align with the principles and practices of data governance and obtain some small, quick wins cheaply to build the evidence and confidence required to support greater investment.


Would NFC smartphones have helped at Target?
The answer is complicated and political, primarily because there are questions over who is liable for a data breach -- the retailers or the financial institutions and their associated card processing companies such as Visa and MasterCard. It is also expensive to install point-of-sale (POS) terminals in millions of retail locations and at ATMs that can read chips on the newer contactless cards, as well an NFC signal from a smartphone. It also doesn't help that Apple hasn't included NFC chips in its popular iPhones. "Apple's refusal to integrate NFC functionality is a blatant roadblock, there's no other way to put it,"


Hands-on with Knoppix Linux 7.2.0: A well-established and very stable Linux distribution
Over the years, Knoppix has evolved and expanded. In about 2005 a Live DVD version was added, with loads of additional applications, utilities and packages included. Rather than drop the Live CD version, however, both formats have been maintained since then, with the CD version as a "small/fast/easy" alternative, and the DVD version as an "everything including the kitchen sink" alternative. My first use of Knoppix came at SANS training classes, where they were using the Live CD version as a convenient way for course participants to gain access to Linux tools.


Wipro's CEO maps out a future for IT Services firms
The world continues to change rapidly for Indian IT Services firms. Here’s a recent interview with Wipro CEO T.K. Kurien with all the usual stuff about firms in transition, the trauma of effecting change and other such things. However, embedded in there are three observations that give us a glimpse into a brave new world for software services firms.


How Xerox Evolved From Copier Company To Creative Powerhouse
There’s one other thing that’s crucial to getting the best, most innovative work out of Xerox employees. “Having fun is one of the principles I always talk with new hires about,” says Vandebroek. “Unless you have fun, you can’t truly bring your intellect, your skills, and your deep knowledge to push the boundaries of the unknown, to invent and create.” She goes on: “Being innovative to me is being both creative and entrepreneurial. And you can’t be creative and entrepreneurial unless you truly bring your heart to work, and have fun at work. Having fun is really essential. You need to have fun every day.”


As security woes bedevil IT, guess who’ll shoulder more of the load?
So what’s the solution? One increasingly prevalent view is that end-users be enlisted to the cause, first by educating them about safe practices, about corporate security policies and regulations (and the penalties for breaking them) and finally by enforcing those policies. Let’s face it, if you are a knowledge worker, you need to collaborate with others, sometimes contractors, partners outside the firewall — and should have a good idea of who is to be trusted with documents and work product.


Myths and Misconceptions about Transaction Isolation Levels
In every discussed Isolation Level so far, you are also always able to get so-called Phantom Records – records that can appear and disappear in your result set. If you want to get rid of these phantom records, you have to use the Isolation Level Serializable, which is the most restrictive one. In Serializable SQL Server uses a so-called Key Range Locking to eliminate phantom records: you are locking complete ranges of data, so that no other concurrent transactions can insert other records to prevent phantom records.


Fiberlink president talks IBM MobileFirst plans, EMM consolidation
Candidly, what we were not good at was global marketing and global sales. We did not have the scale and we did not spend the money. We could, but we chose not to go that route to just try to buy market share. Over the course of the last couple of years, we continued to get close to IBM in terms of packaging some of their stuff for the laptop side, but also uniquely developing the whole mobile side of the house. It was becoming more and more obvious to us that the market in mobile management still has not found vendor loyalty…


Interview with Ole Jepsen on Leadership in Agile
Good leaders create an environment where self-organizing teams can thrive and create great products and services to delight their customers: that is what Ole Jepsen explained in this interview. At the XP Days Benelux conference he talked about truly leading people and the subtle but important differences between taking and giving control. InfoQ interviewed Ole on leadership in agile, self organizing teams and focusing on people



Quote for the day:

"You can't improve and still be the same" -- John C. Maxwell

January 26, 2014

Enough PaaS vs. IaaS: The cloud is really about Services as a Platform
Two things have happened since that definition was first put forth. The first is that IaaS providers, especially Amazon Web Services and Microsoft, have delivered services that blur the lines between platform and infrastructure. In Amazon’s case, it evolved a set of a services from the infrastructure up to include middleware services (RDS and Elastic Beanstalk, for instance), as well as deployment and ongoing operations services such as Autoscaling and Opsworks.


Top 10 InfoSec Careers Influencers
Each of these Influencers has a substantial impact on InfoSec careers. Their influence ranges from education and training to recruitment, research and management. Our selections include some of the nation's most recognized leaders in promoting information security careers. But they also include a few individuals who focus on growing the profession behind the scenes. How did we choose the Influencers? We queried our board of advisers and other information security thought-leaders to identify candidates, with the editors making the final decision.


Internet of Things: What Strange Things Can Happen
IDC anticipates that more than 200 billion connected devices will be in use by 2021, with more than 30 billion being autonomous devices. Cisco’s Internet Business Solutions Group (IBSG) predicts some 25 billion devices will be connected by 2015, and 50 billion by 2020. How will having lots of things connected change everything? Find the answer in the infographic. With all this, Internet of Things is coming and will be here to stay soon. Whether we, the humans are ready to take on this evolution remains to be seen.


Judge Partially Dismisses Oracle Lawsuit Against Solaris Support Providers
"While a customer may choose to engage a third party instead of Oracle to provide support services on Oracle hardware, under such circumstances neither the third party nor the customer may access or use Oracle's support website," Oracle said. "In particular, neither the third party nor the customer may use official, Oracle-authored Solaris updates to support the Oracle software running the hardware."


Best Value BI Trends: BI Embedded into Business Processes and Decision Making
The key to business value from BI is that it is “actionable” -- meaning based on her analysis the business person can do something meaningful with the data. Embedding BI into business processes means the business and IT understand that the workflow needs to include analytics not as the end result of BI, but as the fuel that drives business activity. The goal is managing and improving business performance, not analyzing reports.


Information Security Management at HDFC Bank: Contribution of Seven Enablers
As an early adopter of COBIT 4.1, HDFC Bank’s IT governance journey started almost six years ago, when COBIT 4.1 was just introduced. Almost all of the 34 IT processes defined in COBIT 4.1 were adopted by the bank. Following COBIT 5’s introduction in April 2012, HDFC Bank took some time to consider a migration. Because the bank has successfully implemented COBIT 4.1 to great benefit, it will not immediately migrate to COBIT 5. However, the seven enablers introduced by COBIT 5 were intuitively adopted by HDFC Bank even before these were popularised in COBIT 5.


Think you need Hadoop? Think again
In the big data buzz, Hadoop has been the big data solution of choice leaving many feeling like Hadoop is their only option for harnessing big data. However, there are many other big data options out there that offer different features than Hadoop, and may actually fit your business needs better. Flash array storage, in particular, has made it easier to create fast, affordable storage options, so check out these other big data solutions before settling on Hadoop.


Interview: The Need for Big Data Governance
The right approach to all these problems is to have a data quality “firewall” that filters data rather like internet traffic. And you can’t create that firewall unless you first have a definition of what “good data” looks like. IT will have technical definitions of good data – no characters in a number field, for example. But ultimately, only the business knows what defines business-ready data, therefore IT has to collaborate with them to create the business rules. And those business rules need to be in place before any new big data project, not after.


Agile testing is not about automation
If you buy into the premise of the Agile testing quadrant, only roughly half of the mentioned testing practices are applicable for automation – and these are primarily technology-facing tests. Aren’t the business-facing tests just as important? I would definitely argue that they are, especially for assessing if you are actually building the right thing for your users. It doesn’t matter if the smallest pieces of your system work well if they haven’t been assembled into something your users want or need.


Top Architecture & Governance Principles for 2014
Following are some of the key architecture and governance principles that you could adopt for your project for this year 2014. The architecture principles could be seen as “guiding principles” based on which team would want to design, develop and test the applications. ... Sooner than later, it may be good idea to create a software quality metrics to measure some of the non-functional software code quality characteristics



Quote for the day:

"To have long term success as a coach or in any position of leadership, you have to be obsessed in some way." -- Pat Riley

January 25, 2014

Scientific Thinking in Business
While data is essential for scientific decision making, theory, intuition, and imagination remain important as well—to generate hypotheses in the first place, to devise creative tests of the hypotheses that we have, and to interpret the data that we collect. Data and theory, in other words, are the yin and yang of the scientific method—theory frames the right questions, while data answers the questions that have been asked. Emphasizing either at the expense of the other can lead to serious mistakes.


7 ways to transform into a connected leader
According to Delight Leadership Inc., a ‘connected leader’ is one who holds him/herself in high regard. These leaders take their personal care and growth seriously, and understand that in order to develop as a person and to lead thousands in a transformational way; they must first do the work – the inner work that lets them evolve into a better version of themselves (that can in turn profoundly captivate and influence others). Here are 7 Ways to begin to transform into a Connected Leader:


CIOs need a System of Engagement with the CMOs
CIOs are being asked to fast-track the implementation of Systems of Engagement. What options does the CIO have? Moore explains that the demand for Systems of Engagement is driven by the need to collaborate in the disaggregated ecosystem we find ourselves in today. Compelling technologies are easily accessible in the social media that control our personal lives. We get so used to (and spoiled by) these technologies that we expect the same experience at work.


Can problem solving be taught?
“Good innovative problem solving has to be collaborative,” he says. “You can do it on your own, but group conversations can spark new thoughts and solutions much quicker than individuals will. It will also, usually, be a much richer experience and, if you’re going to teach someone problemsolving techniques, then they, at least in part, have to be able to run a team of problem solvers.” The trick, it seems, is for leaders to design and empower teams to break problems down and design solutions.


Location-based services: Controversy at every level
Overall, location-based services use three different levels of accuracy -- vicinity to within a block or two (derived from GPS coordinates), presence (establishing that you are inside a given building or store) and department (pinpointing your location within a given store). Shopkick makes use of the presence level, primarily; it's also the level that's demonstrating the most commercial success and producing the most fears about Big Brother-style surveillance.


Dueling R and Python, Contest 1A
The Python and R code in this admittedly simple example is remarkably similar. Indeed, driven by the numpy/pandas libraries, Python reads more like R than it does core Python. Python/pandas is the performance winner with this exercise on my 16G Wintel notebook. In the early morning with plenty of wifi bandwidth, both download/unzips complete in about 10 minutes. The data frame creations, though, are much faster in Python-pandas than they are in R – 2.5 minutes vs 14 minutes – probably to some extent reflecting the R kluge for column selection.


7 Principles to Enable Agile Projects Through Enterprise Architecture
The strategy, governance and co-ordination of this changing landscape is often referred to as Enterprise Architecture. At this point you might be wondering there is a way to join Agile projects with EA in perfectharmony. If there is, I haven’t discovered it. What I can offer you is some principles, based upon what has worked in organisations that I have worked with.


Using Auto-Classification to Improve Your Information Governance Practices
Governance is still lacking in many organizations as around 85% of users still manually identify records, but are not clear which content is valuable and not valuable, and as a result, there is considerable fear towards the regulatory impact of deleting information. New auto-classification technologies can take the burden off the end user by eliminating the need for them to manually identify records, by providing automatic identification, classification, retrieval, archival, and disposal capabilities for electronic business records according to governance policies.


Sizing Up the Changing IAM Market
"The cloud versus enterprise divide to IAM was never a comfortable situation, but had become quite clear cut," says Andy Kellett. That's why Salesforce's move to offer an IAM that can be applied to both cloud and on-premises applications "breaks the mold," he says. ... Despite the moves by Salesforce and Microsoft, many organizations will still choose to work with separate IAM providers if their systems' features and capabilities match their needs, Gartner's Iverson says. However, the pressure is on these IAM providers to demonstrate why their technology is worth the extra investment, he says.


Highly-Available Load Balancing of Apache Tomcat using HAProxy, stunnel and keepalived
This article will describe the process required to set up a highly-available SSL-enabled load balancer using HAProxy, stunnel and keepalived to front a pair of Apache Tomcat instances. The configuration will start off simple, and extend and grow as more functionality is added. First, a session-aware HAProxy load balancer is configured. Next, Tomcat clustering is configured with session replication and the responsibility for maintaining session state is moved to Tomcat. Then, keepalived is added – providing a failover IP between HAProxy instances running on two nodes.



Quote for the day:

"Courage is doing what you're afraid to do. There can be no courage unless you're scared." -- Eddie Rickenbacker