Daily Tech Digest by Kannan Subbiah

September 16, 2016

5 security practices hackers say make their lives harder

It's easy to fall into the trap of thinking of privileged accounts in terms of the human users who have them. But privileged accounts are also extended to machines and systems to allow them to interact. Organizations typically have two to three times more privileged accounts than they have employees. Carson notes that every system that gets deployed comes with a default account, and those systems get connected to service accounts to maintain them. Each virtual machine that gets deployed also receives privileges that don't expire when the machine they're associated with get spun down. And if a VM is cloned, those privileges get cloned along with them. As a result, organizations often wind up with large numbers of rogue privileged accounts with access to their environment.

Polymorphism of MVC-esque Web Architecture: Classification

Arguably, the model has experienced the most significant changes since the inception of the MVC almost forty years ago. For this discussion, the model is defined liberally to include the in-memory model object (such as record set), the source data/document/file/signal of system of record (SoR) behind the object, and all the processes synchronizing and bringing them together. The type of data repository of the model has evolved from a small floppy disk to RDBMS, and to MMDBMS (multi-model database management system). The repository has gone from co-locating with the in-memory model object isolated on the user’s desktop to locating remotely from the domain object as broadband-connected, distributed and/or cloud-based systems.

5 Things You Should Know About Nigerian 'Digital Check Washing' Rings

WWG1 uses a simple tool to crawl the Internet and scrape employee email addresses from corporate websites. Those employees are then bombarded with viral emails (the kind with a virus, not the kind that gets Internet-famous). The goal is to infect one machine, and then use that as a foothold to ultimately secure privileged access to the company's Web email server. Once they gain control of the email server, they begin daily monitoring for purchase order communiques. They also prepare lookalike emails, as well as arrangements to wire funds into bank accounts set up to launder stolen payments. None of this requires any special hacking expertise; the necessary software and tutorials are widely available online.

How blockchain is transforming business models

To put it simply, multiple distributed ledgers are just a method of recording data digitally, and can be applied to anything that needs to be independently recorded and verified as having happened e.g. transactions, agreements, contracts, ownership, etc. According to a SWIFT Institute Working Paper, it is the robustness and relative simplicity of the Bitcoin blockchain that has sparked the interest of similar technology to be applied to wholesale markets’ securities settlement as this can potentially reduce costs and risks. And according to a White and Case report, a similar blockchain can also be used to improve and enhance currency exchange, supply chain management, trade execution and settlement, remittance, peer-to-peer transfers, micropayments, asset registration, correspondent banking and regulatory reporting

What Airbnb can teach HR about trust

You may be thinking, sharing a car with someone and then rating them on their driving skills is nowhere near equivalent to the relationships that form in the workplace. In reality, with websites like Glassdoor and Indeed, companies are already developing their own online reputations based on employee reviews. The potential impact of these reviews can be explained by the similarity bias. Job seekers are going to be much more apt to believe in the reviews of current employees than in company recruitment efforts or statements by the CEO. Creating trust between employees and managers should therefore be at the top of every HR department’s agenda. Using best practices from the sharing economy can be easier than you think.Essentially, what Airbnb and other companies have proven is that opening yourself up to feedback will increase trust in the eyes of others.

Cognitive Computing: Five “I wish I would haves” to Avoid

Computing capabilities are unbelievably strong today. There’s a greater discipline in algorithms than we’ve ever seen. Data storage costs, what, around 3 cents to store a gig of data today? Put it all together, and you realize that whatever we’ve done in cognitive computing today will soon be considered quaint early indicators of the seismic changes that follow. We are heading down an exponential change curve. Because cognitive computing is already a burgeoning reality among the businesses I work with every day, I’ve already observed a few serious risky views on it. Why are they risky? Because if they take hold, they’re likely to lead many to say, “I wish I would have” in the not-so-distant future. And in this case, the implications of getting it wrong, or simply not getting on board fast enough, could be serious.

It’s time to practice what we preach in cloud security

Most hackers are after a quick and easy payday. And any savvy hacker knows there’s loot to be had from cloud services. Given today's consumer / corporate crossover world we live in, things like Dropbox are a prime target as they’re a vast cache of IP and corporate databases – and probably a fair amount of personal information that can exploited. At the same time, apps like OneLogin are designed to increase security and anyone looking to procure a few passwords would do well to try their luck here. The cloud industry has been hard at work dragging people over the line in the security debate for some time. We have worked hard to tackle the issue head on and incidents like these don't help assuage the doubts that many still have.

For regulators, cybersecurity must be more than just site visits and questionnaires

One has to do with the fact that regulatory bodies still rely on a rather old-fashioned technique for assessing compliance in cybersecurity (and really any area): having an examiner visit an organization's site and ask questions, or require the organization to fill out questionnaires. This kind of "point-in-time" monitoring certainly has its value, but too easily can be a once-a-year bureaucratic exercise that provides only a snapshot of an enterprise's cybersecurity health. These exercises are quite financially burdensome for the regulated entities to comply with, and budget-strapped agencies are also hard-pressed to stay on schedule with the assessments. Regulatory agencies, fortunately, are looking at new commercially available technologies that provide critical cybersecurity performance data in a continuous fashion.

Pros and Cons of Cross-Platform Mobile App Development

Since the User Interface (UI) and User Experience Design (UXD) of iOS and Android are quite different from each other, it’s not an easy task to create a uniform GUI wrapper on top of it. Though Xamarin and others have put in significant work on this front, it is far from perfect. It works well if you design your application to live within the framework’s limitation, however, if you need anything that doesn’t fit with the framework’s vision, it requires a lot of work to implement and requires writing platform specific code. To give you an example, in Xamarin Forms, it takes a lot more work if your designer chooses to give custom colored borders to text fields. As this is not obvious to the designer, once you have settled in on the design, the programming team needs to put in a lot of efforts to pull off this seemingly simple design.

Risk Management Best Practices For CISOs

There are a few basic steps that CISOs should take after establishing their resiliency baseline in order to start improving it. We suggest that CISOs perform a value-chain mapping exercise, which will result in a much more detailed pictorial view of the security landscape. The X-axis of this map is “Evolution of Resiliency” and the Y-axis is the “Invisible to Visible Value Chain”—meaning, what solutions currently exist and what can be implemented over the evolution timeline to increase the visibility of security, which has a direct positive effect on resiliency. This exercise will also flesh out any duplicative efforts, which decrease efficiency. After the initial map has been created, it can be used as part of a continuous resiliency improvement process.

Quote for the day:

"As we look ahead into the next century, leaders will be those who empower others." -- @BillGates

September 15, 2016

If an Infosec policy falls in the forest

If you don’t have a proper governance structure in place it can cause you some angst. As an example, how can you remove an employee who is surfing porn on the Internet if you have no framework in place to deal with such an action? That is the simplest example that comes to mind. To spin it differently, there was a shop that I worked for at which I was told that I could not use a certain piece of software. It was a fairly benign software application so, I couldn’t help but to ask why. Now, bearing in mind I had no argument with being told no. I was just interested in knowing what the rationale was for that decision. The answer I received was, “because $group said no."

Chief Data Officer Barney Krucoff Drives Washington, D.C.’s Data Strategy

My impression is that D.C. has a tremendous technology infrastructure. We are more unified in our technology than many large cities or states. There’s a city-owned network backbone that connects us all, and there’s a centralized security team, so not everybody’s got their own firewall group and you’re not necessarily negotiating that across multiple agencies. The IT department is fairly operational, not just a policy shop. We run all the email, we run many applications, we run the centralized web team. So there’s a lot of infrastructure in D.C., and there’s a reasonable amount of resources for the amount of government we have. We weren’t necessarily as efficient as we’d like to be, and I think that’s part of my job, to try to align these pieces.

How can we address the Insecurity of Things?

“With IoT, it's only a question of time that with regards to privacy and physical security issues, governments will have to enforce regulations and standards,” said Sayag. “It's a two way process. One is from the regulatory authorities, to come up with really strong steps, to encourage development of security of IoT nodes and devices; and on the side of users, they should be more aware of the kind of things that can be hacked,” said Chattopadhyay. “I think we are too passive about these new challenges, we think that they will be sorted out by themselves, maybe by market forces. We should work faster, and we should encourage more innovative technologies and products with built-in security in mind. That is something the security community, researchers and the industry, should consider right now. I think this is a problem we should solve altogether,” emphasized Sayag.

Security Think Tank: Brexit – An opportunity for infosec pros to take the lead

The main negative point is the uncertainty, but as the EU will deny access to its marketplaces to any company not up to code, certainty comes back into the picture again as we realise the regulations have to be implemented anyway. Not quite incidentally, when considering international data regulations in this context, those responsible in a risk and compliance role should keep keen eyes on the progression of the Safe Harbour and Privacy Shield saga in the Irish courts. Opting for private model contracts to cover international data exchanges in the absence of Safe Harbour is a legally uncertain decision, and their use could cause major international disruption if ruled inadequate.

8 Culture Change Secrets Most Leaders Don’t Understand

Results will actually precede the cultural change. This important insight runs counter to arguments from some leaders that think they don’t have time for culture since they need results now and culture change takes a long time. Focusing the work on a top mission or performance priority will actually increase the likelihood of seeing results in a meaningful area AND supporting the targeted cultural shift. Behaviors that lead to positive results will spread. Schein said these behaviors will not be spreading because employees were “told to” but because “they work”. I love his explanation: “if it’s successful, and people like it, and it becomes a norm then you can say it’s become a culture change.” So, what’s a norm? That question brings us to our next secret.

Cybersecurity Is Every Executive’s Job

While the CISO will identify risks and prioritize security protocols, it is incumbent on senior executives to understand and carry out the procedures across the business — to the most-vulnerable points of entry for cyber criminals. Executives must sponsor the CISO’s threat assessments and review the results together. The CISO should be included on new business initiatives early on so that security is baked in rather than bolted on afterward. In fact, the best practice is to have the CISO work with each team to determine ways to reach goals in the most secure fashion, and then executives must hold their people accountable for risks and flaws identified by the CISO. What’s more, executives should help promote the importance of security within the organization, starting with better education and training.

Cyber risk in financial firms is a key concern – Central Bank Guidance

The Central Bank’s concerns are being driven by the potential impact of inadequate cybersecurity controls on the firms themselves, their customers and the risks for financial stability. Given that Information technology is now at the heart of the supply of financial services and that the incidence of cyber-attacks and business interruptions is on the increase, the Central Bank is saying that firms should assume that they will be successfully targeted. Its view is that the security and resilience of IT systems, their governance and management must improve to reflect this reality. ... The Central Bank is demanding increased effectiveness in this area. We are undertaking considerable work to require improved IT risk management and cyber resilience across regulated firms. This includes enhanced supervisory capabilities and increased focus on these risk areas.

Emerging technologies are poking holes in security

Automation affects change management and security because there may not be an understanding of how to support the new information security requirements of automation as change occurs. This can make the enterprise susceptible to intrusion and unable to adequately respond when disaster recovery plans must execute, Davison says. As for information technology service partnering, when partner employees don’t follow the enterprise change management process, information security risks rise, says Walker. In cloud computing environments, simply adding errors in the process of coordinating change among different cloud environments to the already precarious task of implementing federated security across these clouds can add significant risk.

Commodities may be a sweet spot for blockchain

Over-the-counter commodity derivatives are another potential sweet spot for blockchain. Banks such as Barclays have explored the use of smart contracts for interest rate and equity derivatives. They might consider trying them out in OTC commodity derivatives, which are largely not yet subject to regulatory central clearing mandates. The lack of potential resistance from clearing houses, as well as the smaller size of the markets overall, might make it easier to roll out smart contracts in OTC commodities than in other asset classes. Some might question whether commodities – the oldest asset class around – will really be the sector where blockchain takes off. I would advise such sceptics to look at a little company called Ice.

FTC focuses on combating ransomware

"The spate of ransomware incidents are escalating at an alarming rate," Ramirez says, citing an estimate from the Department of Justice that incidents of ransomware, now averaging some 4,000 a day, have increased 300 percent in the past year. "The financial motivation for ransomware attacks suggests that the threat is unlikely to go away any time soon," she says, warning businesses to step up their own defenses to ensure that they are protecting their users from online scammers. The agency has already brought dozens of enforcement actions against companies for failing to adopt what it considers reasonable security protections. Ramirez and some industry experts see ransomware as the latest evolution of malware, but with a notable twist.

Quote for the day:

"If you can't laugh at yourself life is going to seem a whole lot longer than you'd like." -- Sam, Garden State

September 14, 2016

Six shifts that define enterprise digitization in 2020

Before company leadership teams get dragged into conversations about specific technologies or start speculating about how they can be the "Uber of their industry," they first need a common perspective on the business, consumer and technology trends that are driving enterprise digitization, and consensus on which are most important for their context and which can be safely ignored. This creates the starting point for a business-led strategy that will yield much better results than chasing after the latest buzzwords. Often, CIOs find themselves leading the way in creating this shared understanding. So to help, CEB has conducted a comprehensive analysis of the business model, consumer and workforce changes that will have the greatest impact on the digital enterprise by 2020. The trends point to six shifts that apply broadly across industries, geographies, customer types and operating models.

The structure of Blockchain Technology and How it works.

Every block within the blockchain is recognized by a harsh, created with the SHA256 cryptographic hash algorithm on the block header. Every block also references a preceding block, referred to as the parent block. In other words, every block has the hash of its parent in its own header. The series of hashes connecting each block to its parent makes a chain going back to the first block, referred to as the genesis block. Although a block has one parent, it can momentarily have many children. Each child refers to the same block as its parents and has the same parent harsh. Many children appear when there is a blockchain “fork,” a short-term situation that happens when different blocks are found nearly concurrently by different miners. Ultimately, only s single child block becomes the blockchain part and the “fork” is resolved.

Digital government isn’t about user needs – it’s more fundamental than that

It’s not hard to conjecture that exposing the value chains of government services to the public, so that we can all see and compare and improve on them on a daily basis – akin to tinkering with a giant Meccano set made of lots of standard components – would amount to nothing less than a democratic revolution. An early example of an exposed value chain is DVLA’s road tax renewal service, where we watch government join up our registration, insurance and MOT databases, and take our money, in real-time. Instead of stale, self-legitimising talk by public administrators about how they are building stuff to “meet user needs”, the function of public administrators becomes increasingly about providing us with the building blocks to, for example, assemble, innovate, combine, question and contract for our public services.

Montreal cops hunting data thieves

The curious question that comes to mind is how long has this been going on at Concorida? Or even more to the point, where else has this activity been taking place? I would be curious to see if other universities have discovered similar instances. ... This serves as a great lesson to have a strong monitoring regime in place in your organization. Do you have alerting in place to fire in the even someone inserts a USB device into a server in your datacenter? Do you have access controls in place to alert you as to who is coming and going from your data center? This might seem rather basic on the face of it but, I have seen many instances over the years where companies would have all these great biometric controls, man traps, cameras and the like but, then they would prop open the back door so that the security guard could sneak out for a smoke break.

AI Can Recognize Your Face Even If You’re Pixelated

The researchers were able to defeat three privacy protection technologies, starting with YouTube’s proprietary blur tool. YouTube allows uploaders to select objects or figures that they want to blur, but the team used their attack to identify obfuscated faces in videos. In another example of their method, the researchers attacked pixelation (also called mosaicing). To generate different levels of pixelation, they used their own implementation of a standard mosaicing technique that the researchers say is found in Photoshop and other commons programs. And finally, they attacked a tool called Privacy Preserving Photo Sharing (P3), which encrypts identifying data in JPEG photos so humans can’t see the overall image, while leaving other data components in the clear so computers can still do things with the files like compress them.

Future of Banking: IoT, Retail & Mobile Banking Industry Trends

As we move forward, banks are turning toward new IoT technologies to enhance the user experience and reduce costs. Some banks have started using beacons, for example, to send customized offers right to customers' smartphones as soon as they enter the branch. And some ATMs now have live stream video support that allows customers to speak to tellers if they need additional assistance. Financial executives are pouring significant money into these technological changes to help stave off competition from tech companies that are sticking their hands into the financial services industry. A recent PwC survey revealed that these executives expect their digital investments to increase their revenues and enhance the customer experience above all else.

Business and IT alignment gets physical at Avnet

We take business and IT alignment very seriously at Avnet. For example, my senior IT leaders are part of the lines of business unit teams, and they sit in those executive teams. Their variable compensation is tied to business performance and not just IT performance. We take that very seriously. What we find is happening in business, in general, is just the rate of innovation, the rate of change is accelerating. So at Avnet, we're introducing agile methodologies to help move faster and be more nimble. What we're finding is key to that increased rate of innovation is really that we need colocation, so we're colocating our IT teams with our business teams. It helps to really bring the groups together and follow a term that we have in IT, which we call 'place business at the center of IT.'

Hired guns: The rise of the virtual CISO

There’s no set universal standard for hiring a virtual CISO. You can set up a retainer for a certain number of hours, you can hire someone on a project basis, and/or you can even buy a chunk of support hours and use them when you need them. It's a way of getting the cream of security talent without buying the whole cow.Contracting a virtual CISO can be far more cost effective than hiring a full-timer. They can fill in where you need it the most, helping your CIO pull together your security policies, guidelines and standards. That could entail anything from coming to grips with HIPAA or PCI compliance to staying on top of vendor risk assessments. A qualified virtual CISO is going to be fully up to speed on the latest best practices, they have experience dealing with a wide variety of scenarios, and they are well-positioned to train your internal security staff.

Empower your employees by embracing shadow IT

Embracing shadow IT can actually benefit your company and your employees, but according to Martin Johnson, senior director of Cloud Product Marketing at Blue Coat, attitudes around shadow IT will likely change depending on who you talk to. Employees at smaller business units don't necessarily consider the negatives of adopting new software without IT's knowledge. Rather, they see it as a faster and more efficient way to increase productivity and alleviate redundant tasks. For example, your workers might opt for a third-party cloud service over an internal network, so they can access files across devices or on the go, which leaves IT largely out of the loop, but makes their work lives easier. IT, on the other hand, views it as a "security risk," according to Johnson, but notes that IT departments also understand the importance of remaining on top of the latest technology trends.

Digital Transformation Boosts Captive Offshore Center Growth

Cultural differences and alignment with business objectives historically have been the biggest challenges for captive offshore centers. But as they have taken on higher-level deliverables like digital services, these GICs must also rethink their talent acquisition models. “The GICs are undergoing fundamental shifts in their operating models… from being centered around arbitrage to skill-centric, functional orientation,” says Kala. “This shift is significantly impacting the relative emphasis on talent attributes required for success.” Domain, functional, and technical knowledge are now table takes; digital services require skills in the areas of collaboration, analysis, creativity and innovation.

Quote for the day:

"First ask yourself: What is the worst that can happen? Then prepare to accept it. Then proceed to improve on the worst." -- Dale Carnegie

September 13, 2016

Indian-origin scientist's tech to let you read closed books

Terahertz frequency profiles can distinguish between ink and blank paper, in a way that X-rays can not, and has much better depth resolution than ultrasound. The system exploits the fact that between the pages of a book tiny air pockets are trapped about 20 micrometres deep. The difference in refractive index - the degree to which they bend light - between the air and the paper means that the boundary between the two will reflect terahertz radiation back to a detector. In the new system, a standard terahertz camera emits ultrashort bursts of radiation, and the camera's built-in sensor detects their reflections. From the reflections' time of arrival, the algorithm can gauge the distance to the individual pages of the book.

CIOs, CTOs playing greater role in technology decisions

"What we found is that, in the past, CIOs and CTOs reported to the COO or CFO, and they weren't getting as much of a seat at the table as far as strategy and more tactical initiatives go. Their role was just to make sure IT departments and technology spending were kept under control and overhead was low -- but with the cloud and digital, tech leaders are seen as more than just a cost center, they've become increasingly strategic and their voices are louder," says Steve Keathley, national technology leader, Deloitte Growth Enterprise Services and Partner Deloitte Consulting, LLP. Mid-market organizations are increasingly seeing productivity gains and a faster time-to-value as a result of technology investment, which is driving a willingness to see technology as a solid investment, Keathley says.

Blockchain can not only transform insurers, but also benefit customers; here’s how

A shared ledger can reduce the instances of fraud as companies can ensure that there are no subsequent claims on the same product. But the real application of the technology comes in the form of new niche insurance products it ceates when combined with internet of things (IoT). For instance, the black box in a car can generate data on driving habits of the user based on which blockchain can help create personalised insurance covers for each kind of user. ... One of the pain points of insurance for consumers is the claim approval process. Blockchain can ensure validation of data faster and quicker disbursement. Also, with IoT systems and better tracking of consumers, this process can get even faster. For instance, a home security system with cloud connectivity can allow companies to track information real-time and help process claims.

5 Ways Blockchain will Transform Financial Services

Financial institutions across the world are responsible for complying and reporting on a number of requirements from their local regulator. Know Your Customer (KYC) is a key requirement here but the process can be incredibly time consuming and lack the automated customer identification technology and integration needed by teams to efficiently carry out their work. Blockchain technology could provide a digital single source of ID information allowing for the seamless exchange of documents between banks and external agencies. This would likely result in automated account opening, reduced resource and cost, all whilst maintaining the privacy of data that is legally required.

The IoT and Cloud security measures — not as well developed as needed

“Cloud security continues to be a challenge for companies, especially in dealing with the complexity of privacy and data protection regulations,” said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. “To ensure compliance, it is important for companies to consider deploying such technologies as encryption, tokenization or other cryptographic solutions to secure sensitive data transferred and stored in the cloud.” Agreed Jason Hart, Vice President and Chief Technology Officer for Data Protection at Gemalto, a leader in digital security, “It’s quite obvious security measures are not keeping pace because the cloud challenges traditional approaches of protecting data when it was just stored on the network.

Startup maps journey to automate US freight trucking

“It’s too simplistic to say this is Uber for trucking,” he says. “The Uber problem is one of ‘I need a car now and give me the closest car’; the shipping one is ‘I need a truck at a certain time with a certain load going in a certain direction, plus there are contractual relationships’. Then there’s the Big Data element of understanding traffic patterns, predicting where you need capacity and optimising routes.” Kropp and CFO Jan Gildemeister each have over 10 years’ experience in trucking and logistics and say they want to create the “next evolution of trucking technology”. Kropp says that truck fleet operators have tended to focus on improving fuel economy, aerodynamics and other elements but believes that, by taking a fresh look at the logistics of the industry, much bigger savings are to be had.

5 tips to successfully pitch your IT project

There are many statistics about how many IT projects fail and many internet posts suggesting why. After hearing the above story from a friend, I have been wondering how many worthwhile IT projects never even get greenlighted and why? I suppose accurate statistics would be hard to find, after all, what doesn't get started rarely gets documented and measured. As a guide, though, multiply the number of projects that you yourself have not successfully pitched by the number of project teams that you imagine there are on the planet (Project Management Institute estimates that there are 16.5 million project managers in the world) and you probably have a very big number indeed floating across your mind. These can't all have been terrible projects, can they?

Designing with Exceptions in .NET

If you read early literature on .NET design patterns, you’ll often come across the phrase “pit of success”. The basic concept is this: make the code easy to use correctly, hard to use incorrectly, and ensure the exceptions tell you what you did wrong. This philosophy of API design guides the developer into writing correct code almost by default. This is why a naked NullReferenceException is so bad. Other than the stack trace, which may be quite deep into the library code, there is no information to help the developer figure out what they did wrong. ArgumentNullException and InvalidOperationException, on the other hand, give the library author a way to explain to the application developer how to fix the problem.

CIO skills: The right stuff for executive-board, CEO positions

CIOs are definitely becoming CEOs. We've seen a couple of interesting statistics, and things in the market evolved over the last couple of years. Within the Fortune 500 today, for example, CIOs are now reporting to CEOs 56% of the time. That's up about 12% over the last five years. And depending upon the environment, the CIO touches the enterprise across the entire technology function, likely the platform, becoming much more comfortable with being front and center with clients and customers. And so the CIO is actually very well positioned to take even a greater stride towards becoming CEO in the future.

Is your security awareness training program working?

Training in and of itself is not enough. A successful awareness program will have training in conjunction with the testing. "Do the training to know what’s going on and the testing to keep it activated in people’s minds. Who falls for the bait?" Weber said. "Each person in the organization should be tested monthly. It could be more frequent than that, but not to the point of annoying people. That’s measurable," Weber said. Because so many breaches are the result of human error, "Sometimes it’s easier to block access to it all and then grant access by request. Then anybody who requests access needs to install some type of device management software to help organizations keep track and monitor and have a little bit more control over the resources," Weber said.

Quote for the day:

"Distilling truth from overwhelming amounts of information is the essence of leadership." -- Carly Fiorina

September 12, 2016

Thousands Of Seagate NAS Boxes Host Cryptocurrency Mining Malware

The researchers used an internet scanning engine called Censys to identify public FTP servers that allow anonymous access with write privileges. They found 7,263 such servers and determined that 5,137 of them had been contaminated with Mal/Miner-C. Another interesting discovery was that many of those FTP servers were running on Seagate Central NAS devices. While this malware threat does not specifically target such devices, it turns out that Seagate Central's configuration makes it easier for users to expose insecure FTP servers to the Internet. By default, the Seagate Central NAS system provides a public folder for sharing data, the Sophos researchers said in a paper published Friday.

Microservices Imply a Distributed System

When you split up your systems landscape into small components, testing is required at a lot of different levels. First of all, inside your components unit tests will likely cover the component’s internals. Next, the service interface needs to be tested whether it produces the right output or document, such as JSON objects or PDF’s. Next applications or other components consuming services offered by components need to test whether these components still offer the right output. As the services in a microservices architecture are loosely coupled, usually via REST and JSON over HTTP, a change to a service interface is not always picked up immediately by the teams. Having automated tests run at every change of a component, the pipeline signals breaking changes as fast as possible.

5 Tips for How to Work Safely Beyond the Corporate Firewall

Some people tell me we should focus on flexibility and forget about control. Others say we have to control information and forget about flexibility. I say you can and should have both. The only real way to maintain an acceptable level of control is to also offer your workforce flexibility. This is more important than ever in this age of working beyond corporate walls and firewalls. You may have the best information management system and internal governance on the planet, but if you don’t accommodate distributed and mobile staff, you will lose control. People will find a way around your firewall if you don’t provide it for them. Basement email servers, unauthorized cloud drives, and personal smartphones, oh my! To safely work beyond corporate firewalls, follow the “cloud first, Web first, mobile first” principles of solution design for flexibility and control

What You Must Know to Evaluate Unified Communications-as-a-Service

Thus, an all-in-one Unified Communications-as-a-Service (UCaaS) platform is pretty appealing. An extension of Unified Communications (UC), UCaaS wraps a host of business communication and collaboration applications and services into a single experience delivered via the cloud. That encompasses everything from enterprise social messaging and chat apps to online videoconferencing and meeting software to business voice-over-IP (VoIP) services. UCaaS platforms come in all shapes and sizes. There are different types of cloud and on-premises distributions, complicated security protocols, and vendors on all sides of the market—from VoIP and telecom providers to major cloud and enterprise players—pushing their own solution. Here are a few key considerations to help your CISO choose the UCaaS platform that best suits your organization.

Why Security Performance Will be Key in NFV

Think of this as some sort of security microcosm, where as we go from cellular to molecular level, there is the need to drive security deep into the data center, so that it becomes deeply embedded in a system that is analyzing the activity of every packet and application traversing the network. The central nature of the SDN paradigm make this a better security model, in general. Rather than managing security policies on individual devices or proprietary hardware system, a centralized SDN controller could analyze and supervise security across an entire data center. Pursuing a zero-trust, stateful security model – in which all applications are monitored in real-time — can provide enhanced security for east-west traffic within the data center, implemented closest to VMs and containers.

The Malware Battle Is Mostly Silent

For security researchers, the fact that malware authors include abusive messages in their code comes as an acknowledgement of their work. Thus, researchers will continue to report on new and updated malware, regardless of whether developers are dissatisfied with how their malware is portrayed or are unhappy that they made it to the headline. “We believe it’s crucial to inform Internet users, whether home users or people involved in companies, of emerging cyber threats. It’s not only about building awareness, but it’s also an essential tool to help people learn how to get protected,” Andra Zaharia said. “We believe that spreading correct and relevant information about new and improved malware is an important part of helping people become more aware of the issue and its potential impact.”

The Right Time and Place: Data’s Enabling Role in Enterprise IoT

The key to making the most of any operational or service-based enterprise IoT application is to act on data at its peak point of value: the moment it is created. If your vehicle operating system learns about an imminent traffic hazard, you’ll need it to notify the driver immediately, not minutes later. That means enterprises will need to increase the velocity of data processing. The traditional process, where data is collected in one place, and then processed and analyzed in multiple separate phases, slows things down and is not a sustainable model for the volume and velocity of IoT-produced data. Instead, data refinement, processing and analysis must move closer to the connected device. Sensor manufacturers are already developing compute capabilities that happen on the device, breaking analytics out of the data center and putting it into the real world.

Trouble Spotted On The Network

When you work for a smaller organization, you don’t have the luxury of a 24/7 SOC. In my company, we compensate by building automation into the monitoring of our logs and cherry-picking events that will generate email notifications. Other events get our attention when we can carve out time to monitor the threat logs generated by our advanced firewalls and the security logs produced by a multitude of other devices: web and database servers, load balancers, proxies, file integrity monitoring software, etc. We collect the logs in a centralized server, and a few filters help identify logs that meet certain criteria. I and a couple of analysts take turns monitoring the filtered logs. We don’t get 24/7 coverage, but it’s pretty close.

How a loud noise brought a data center to its knees

In a peculiar and rare phenomenon, the loud noise created by inert gas being released during a planned test of fire extinguisher systems not only forced the bank's main data center in Bucharest, Romania, offline, but also managed to destroy dozens of hard drives in the process, causing serious and irrevocable damage. Inergen is a kind of fire extinguishing system which relies on gas rather than traditional foam or liquid. Suitable for enclosed spaces, Inergen, stored in cylinders as compressed gas, is dispersed through hoses and nozzles evenly across a small space to wipe out fires. Usually, this kind of fire protection would be best suited for data centers -- especially as foam and liquid would damage valuable and delicate equipment -- but in this case, something went horribly wrong.

Why automating software testing without restraints reduces benefits

Automation gives you a lot of confidence that things are working. It empowers your QA testers to go off and do the most valuable tasks. We've been using TestPlant [eggPlant Functional] to automate routine tasks, for example. This frees up time for exploratory testing or destructive testing, where testers sit down and really pull the product apart, and try and do weird and wonderful things with it. A lot of QA teams spend way too much time doing regression tests, and that's where automation really does help. Without automation, your scope of your testing is incomplete, because you're only going to do regression testing for what you can remember, which is probably three or four sprints back. And then, things drop off.

Quote for the day:

"Trust because you are willing to accept the risk, not because it’s safe or certain.” -- Anonymous