Daily Tech Digest - March 01, 2017

The ugly truth behind Android's upgrade problem

The underlying problem with Android upgrades isn't anything technical. It's the fact that the companies making and selling Android phones have no real motivation to care about high-quality post-sales support and to make timely, ongoing upgrades a priority. It's a harsh reality to consider, I realize. But stick with me for a minute, and you'll see what I mean. Most phone manufacturers make their money by selling phones -- right? And so not surprisingly, selling phones remains their primary focus. Providing timely updates takes a fair amount of effort and doesn't directly put dollars into the company coffers.  Google, on the other hand, makes its money by encouraging you to spend time using the internet and thus its various web-based services.


Laid-Off IT Workers Worry US Is Losing Tech Jobs To Outsourcing

The laid-off workers say this isn't the case. Before they left their positions, some trained their incoming replacements from HCL, which they suspect are on H-1B visas and will work at the school. “Once you send out the manufacturing jobs, once you send out the service jobs, once you send out the research jobs, what’s left? There’s nothing left,” said Tan, who’s 55 and now looking for a new job.  ... “In two years, I could be at another company, and I could be facing the same thing,” he said. Thirteen of the workers are thinking about suing the school, claiming the way their jobs were eliminated amounted to discrimination. But filing a lawsuit will mean receiving no severance pay. The workers will likely file the lawsuit in 30 to 60 days, a lawyer for them said.


5G Digital Services Platform

Reliance Jio Infocomm Ltd. (“Jio”) is collaborating with Cisco to further expand Jio’s existing multi-terabit capacity, first All-IP converged network. With this network, Jio offers a combination of high-speed data, mobile video, VoLTE, digital commerce, media, cloud, and payment services. It is the first network of its kind globally with the fastest growth to 100 million broadband and VoLTE customers, reaching the milestone within six months of launch. With the Cisco All-IP network, Jio will help deliver the vision of Digital India and transform the delivery of citizen services from transportation, utilities and financial inclusion to entertainment, agriculture, education, and healthcare in the country. Cisco forecasts that mobile data traffic will grow 7-fold from 2016 to 2021. Technology has become the biggest driver of economic development in India.


Optimization among the key benefits of converged infrastructure

Converged infrastructure (CI) and hyper-converged infrastructure (HCI) are seen by many as far superior to the heterogeneous structure of most data centers. In the traditional process, infrastructure requires configuration work whenever something is added or changed, and the management duties never seem to let up. But when a product's subsystems are tested and optimized beforehand, complexity is all but eliminated. Despite some clear benefits of converged infrastructure, adoption is a significant change for an IT organization, and one that deserves careful consideration. Not only is CI a different way of running a data center, it's a costly investment.


Blockchain won’t kill currencies: RBI deputy governor R. Gandhi

According to the deputy governor, virtual currencies pose financial, operational, legal, customer protection and security-related risks. “They are prone to losses arising out of hacking, loss of passwords, compromise of access credentials, malware attacks etc.,” Gandhi said. Moreover, virtual currencies also do not have any feasible customer grievance, customer problem or charge-back mechanism, he added. While speaking about currencies, the central banker pointed out that to be effective, a currency needs to uphold concepts of confidence and anonymity at all times. However, after the initial rounds of usage, these concepts cannot be sustained in virtual currencies.


Cyber Security and Social Engineering: A Big Low Tech Problem

The consequences of computer network penetration through social engineering have been dire for victims, as the recent hack of the Clinton presidential campaign organization illustrates. There, the campaign chair received what appeared to be a genuine email from Google’s “Gmail Team” informing him that a Ukrainian computer had just used his password to try to sign in to his Gmail account. The email went on to say that Google had stopped the attempt, advised the chair to change his password immediately, and provided a “Change Password” link. Believing the email to be authentic, the chair clicked on the link and changed his password. But as the world now knows, the change went to hackers who downloaded the 30,000-plus emails in the account and sent them to WikiLeaks for publication.


In Cybersecurity, Language Is a Source of Misunderstandings

There is a fairly recent concept that warrants particular attention to ensure government, industry, and academia are speaking the same language, ... Active defense is a term that captures a spectrum of proactive cybersecurity measures that fall between traditional passive defense and offense, according to the George Washington University Center for Cyber & Homeland Security. There is a plethora of detail on this concept in a recent GWU report, but at its essence, active defense identifies a list of 11 techniques that private entities can employ to interdict cyber exploitations and attacks in a "gray zone." This zone falls between passive defense, which typically features basic internal security controls, and offensive cyber, which features more proactive activities security organizations can undertake, such as "hacking back."


Cognitive computing targets problem of physician burnout

“We’re excited about the vision and promise of cognitive computing,” says William Morris, MD, the Cleveland Clinic’s associate chief information officer. “We feel like it has a strong potential to address the problem of physician burnout and the challenge of being mired in data and not actually having synthesized knowledge.” IBM’s Watson Health, the first commercially available cognitive computing capability delivered through the cloud to provide actionable insights from large amounts of unstructured data, has been “working very hard on mastering the complexity of the medical lexicon and actually getting it from a bench-top research project into a clinical workflow,” according to Morris. ... At the same time, Morris emphasizes that the “physician will always be the physician” and Watson “is there to augment the clinical thought process, not to replace it.”


Game theory says publicly shaming cyberattackers could backfire

“If there’s no effective way to strike back, it’d be embarrassing to blame the perpetrator,” says Steven Bellovin, a computer scientist at Columbia University in New York. In some cases, it may even benefit an attacker if you name them, because this could bolster their reputation as a cybersecurity threat. “There’s a saying in chess: A threat is always stronger than an actual attack,” says Bellovin. “Once you actually launch the attack, the enemy sees what’s coming and can figure out how to respond. If they know you have capabilities but don’t know what you’re going to do, they have to defend everything.” Edwards and his colleagues use the 2016 Democratic National Committee email leak as an example of how the blame game can play out. Following investigations by intelligence agencies, the US government eventually responded to mounting public pressure and blamed Russia for the hacking.


The ineffectiveness of siloed cyber security thinking

While almost three quarters (73%) of respondents admit they aren’t using threat data very effectively to pinpoint cyber threats. Here lies the importance of threat intelligence. Organisations are too often just collating data. The context and value of it is what’s most important. It must be simple to understand, relevant and actionable, and ultimately help to illuminate risk blind spots and empower organisations to make informed decisions. This can best be achieved with a mix of human-powered intelligence and automation. Alongside this is the importance of sharing this information across the business – ensuring that all employees are abreast of any risks coming in and preventing any intellectual property going out (i.e. not using work credentials for non-work sites, or even physical security concerns).



Quote for the day:


"Programmers are tools for converting caffeine into code." -- Unknown


Daily Tech Digest - February 28, 2017

FinTech unleashed: Why banks and FinTech have a love-hate relationship

Banks, asset managers, wealth advisors and insurance companies once competed only in their silos. While they still do today, they also face competition from non-traditional market players with new skills, funding sources, and approaches. In the prolonged low-interest rate environment, many have been driven to use cost containment as the key to success in a more complex regulatory environment. Others are scrambling for top line growth (both organically and through acquisition) in a search for new revenue opportunities. Getting back to technology, the nature of the FinTech narrative over the past few years has been evolving. As well, the pace of technology change continues to accelerate. Rapidly evolving advances in artificial intelligence across chatbots, robo-advisors, claims, underwriting, IoT and soon blockchain, add another layer of potential to further shake-up the traditional business model.


Ransomware Getting More Targeted, Expensive

“Actors engaging in this targeting strategy are also charging ransoms based on the number of host (or servers) infected,” the FBI warned. “Additionally, recent victims who have been infected with these types of ransomware variants have not been provided the decryption keys for all their files after paying the ransom, and some have been extorted for even more money after payment.” According to the FBI, this recent technique of targeting host servers and systems “could translate into victims paying more to get their decryption keys, a prolonged recovery time, and the possibility that victims will not obtain full decryption of their files.” ... “People behind these scams seem to be setting different rates for different countries,” Abrams said. “Victims in the U.S. generally pay more than people in, say, Spain.


Digitization inches towards the mainstream

Most CIOs joke that their transformations are never truly complete as they embrace emerging technologies, including internet of things, artificial intelligence and blockchain, but some sectors are further along than others. Media and entertainment (62 percent), along with retail (55 percent) and high-tech (54 percent) tend to be ahead in their digitization efforts compared to sectors such as consumer packaged goods (31 percent), automotive (32 percent) and financial services (39 percent). Industries hovering in the digital media include healthcare (51 percent), telecom (44 percent) and professional services (42 percent). McKinsey also found that digitization levels vary by business operations. For example, 49 percent of survey respondents say customer-focused areas such as marketing and distribution are primary focuses of their digital strategies.


Stanford experts urge healthcare professionals to harness power of people’s mindsets

“It should be about designing a formal curriculum for medical school that weaves all of this throughout the training,” Leibowitz said. “So it’s not just mentioned in one or two classes or taught for one semester and then forgotten about.” The experts also called for a reform of standard randomized trials in the healthcare system. When examining the effects of a new drug, researchers should include natural conditions, which don’t use placebos, alongside conditions that include altered social context and mindset. This, Crum said, will help researchers understand how beliefs, labels and context can help magnify or reduce the effects of the drug and treatment. These reforms, however, would require additional rigorous research that builds more scientific evidence for the importance of the effects of social context and mindsets, they said.


IT orgs enlist startups to address container security concerns

Startups have begun to make a name for themselves with IT organizations, as their products address container security concerns. Network-based attacks and exploits on IT infrastructure aren't new, but container technology, popularized by Docker, demands a new way to address time-honored problems. For example, containers spin up and disappear far faster and more often than VMs, so container security policies must follow an ever-changing infrastructure. Containers also tend to rely on overlay networks, which can be difficult to visualize with traditional network monitoring tools. ... It's not uncommon for startups to pop up around new technologies, according to analysts, but there are pros and cons to trusting a startup's product as part of an IT infrastructure. A big pro for many large IT organizations is that they can play a part in shaping the roadmap of an early-stage vendor, and possibly an entire market space.


Artificial Intelligence: Removing The Human From Fintech

If and when AI becomes more prevalent in the fintech industry, the same will happen. This is the thing with technology, as sometimes it can seem as if the new system has taken again, years or decades in fact, to create, but for customers to adopt and more importantly, trust, the technology, it could take even longer. Alongside this, with films like Ex Machina coming out and showing society what could potentially happen, as Pesenti alluded to, the negativity surrounding AI could result in the service taking even longer to be adopted. On the other hand, the millennial generation seem to welcome and encourage new technology - cellphone apps are a perfect example of how quickly new systems can enter the marketplace, so it could be said that this is the area in which AI could potentially blossom.


Google Shifts On Email Encryption Tool Leaving Its Fate Unclear

The tool is designed to work as an extension to Google's Chrome browser that uses the OpenPGP standard to encrypt emails, ensuring that only the recipient can read them -- and not the email provider or a government. The main goal of Google's project was to make OpenPGP easier to use. It was announced amid growing scrutiny over U.S. surveillance efforts following disclosures from noted leaker Edward Snowden. However, the search giant hasn't made the extension officially available on its Chrome Web Store. Instead, the project's source code has only been made available on GitHub, a software collaboration site, making the extension harder to install, especially for non-technical users.


20 Cybersecurity Startups To Watch In 2017

In spite of a slowdown in the overall funding activity from venture capital firms in 2016, the cybersecurity market continued to raise money at full steam. Last year saw the market break records in terms of funding deals, with Q3 tallying up to be the most active quarter for deals in cybersecurity in the last five years, according to CBInsights. That influx of money is driving innovation in a number of areas. Particularly notable market segments targeted by these firms include security for data centers and public cloud infrastructure, security orchestration and incident response tools, and third-party risk assessment tools. The following 20 firms are primarily early- to middle-stage startups, with a few more mature start-ups that have courted growth equity to change course or expand into a particularly hot new market segment. We believe these firms are worth watching due to several factors.


Are You Over-Confident on Cyber Security Risks?

"Consumers vastly underestimate cybersecurity threats and don't know how to identify, respond or protect themselves from future attacks," said David Blumberg, founder and managing partner of Blumberg Capital. "Naiveté and arrogance are a really dangerous combination. The cybersecurity landscape is complex and ever-evolving. Bad actors are constantly finding new ways to bypass security measures to infiltrate confidential systems and steal information or sabotage infrastructure. Even experts can miscalculate how to mitigate risks and existing security solutions are no longer enough, especially in areas such as IoT or cloud security. At Blumberg Capital, we support companies at the forefront of innovation in cybersecurity. We partner with innovative startups creating new ways to minimize cybersecurity threats and protect personal, business and government information."


A Tale Of Two User Experiences

Although the products and software are of undoubted quality, what’s remarkable is the fit and finish of the process the user goes through. The selection cycle and the actual purchase steps are streamlined, taking into account how busy I am.  Then there’s the initial product experience, which is the box. Apple’s process dictates that I feel it and appreciate it before I open it. Really. But the fact that they want me to go through this tactile experience is an indication of how seriously they take the first impressions of their product, and the implied quality of every part of the product experience. In subsequent steps, they want me to touch the product and use the UI in low-risk interactions that provide the most non-threatening training experience. Even though migrating the old phone’s data and configuration had built-in complexity and potential for blind alleys, it didn’t feel like it.



Quote for the day:


"Encourage the small steps in order to see the big steps achieved." -- Gordon Tredgold


Daily Tech Digest - February 27, 2017

Android Struggling In Tablets As Windows 10 2-in-1's Come On Strong

Where Android has faltered, Windows is now taking over. Many people are replacing tablets with multipurpose Windows 2-in-1 PCs. Phablets are also taking over for tablets, especially in Asian countries. Many device makers are cutting Android tablet offerings. Dell has dropped Android tablets, while other PC makers like HP, Acer and Asus have fewer Android offerings than previous years. The PC makers are instead pushing out higher-priced Windows 10 2-in-1s. Over the last five years, analyst firms made bold predictions that tablets would overtake PC shipments, but that hasn't happened. In 2014, Gartner predicted that tablet shipments would overtake PC shipments in 2015.


What Exactly The Heck Are Prescriptive Analytics?

Prescriptive analytics is about using data and analytics to improve decisions and therefore the effectiveness of actions. Isn’t that what all analytics should be about? A hearty “yes” to that because, if analytics does not lead to more informed decisions and more effective actions, then why do it at all? Many wrongly and incompletely define prescriptive analytics as the what comes after predictive analytics. Our research indicates that prescriptive analytics is not a specific type of analytics, but rather an umbrella term for many types of analytics that can improve decisions. Think of the term “prescriptive” as the goal of all these analytics — to make more effective decisions — rather than a specific analytical technique.


BIS Report: DLT 'Promising' But 'A Long Way Off'

Though the report seeks to cast a wide net in its exploration of the tech, its most notable aspects relate to the as-yet unanswered questions around blockchain's use for market infrastructure. Those behind the report appear to be in two minds on if current distributed ledger designs may ultimately help any transparency boosts the tech could bring. The BIS talks about the trade-offs inherent in limiting the number of participants in a ledger, while also suggesting that a more open and resilient financial system may provide benefits. "One possible benefit of DLT in an interconnected system is that data shared across key entities may lead to greater market transparency and more effective risk management across systems," the report reads.


How IoT is Changing the World: Cases from Visa, Airbus, Bosch & SNCF

The Internet of Things (IoT) is changing our world. This may seem like a bold statement, but consider the impact this revolutionary technology has already had on communications, education, manufacturing, science, business, and many other fields of life. Clearly, the IoT is moving really fast from concept to reality and transforming how industries operate and create value.  As the IoT creeps towards mass adoption, IT giants experiment and innovate with the technology to explore new opportunities and create new revenue streams. I was invited to Genius of Things Summit as a Futurist by Watson IoT and WIRED Insider and attended the long-awaited grand opening of IBM’s headquarters for Watson Internet of Things in Munich. The two-day event provided me an insight into what IBM’s doing to constantly push the boundaries of what’s possible with the IoT.


IT project success rates finally improving

"Digital convergence is collapsing the gap between business and IT. For so many years, we talked about how to better align IT with strategic business goals, and now it's just a fact of life. That forces IT -- and companies' PMO [project management office] -- to emphasize planning and prioritization, which helps them succeed with the projects that are truly important," Tickle says. "It's a bit anecdotal, but the buzz around planning and prioritization has increased just in the last couple years, and I see that when I talk to clients and customers -- both those who are using our products and those that are using other suites; another thing I'm seeing is that organizations are slashing the number of projects they're taking on, to focus more intently on those that will have the greatest impact and ROI," Tickle says.


Watch List 2017, Special Report N°3 | 24 February 2017

Whether unprecedented or not, the challenges currently facing our global security are immense and cause for considerable alarm. It is difficult to think of a time in recent history when there has been such a confluence of destabilising factors – local, regional and global – hindering collective capacity to better manage violence. These overlapping risks, unchecked, could coalesce into a major crisis – indeed we are currently experiencing a spike in global conflict violence – without the safety net of solid structures to deal with it. When Crisis Group was founded, its premise was that bringing field-based expert analysis to the attention of (principally) Western policymakers could effect positive change in both preventing and ending situations of deadly conflict. Much of that premise still holds, but for us, as for others, it is no longer sufficient: the West can no longer be viewed either as homogenous or an oasis of tranquility.


Microsoft Adds Network Performance Monitor to Management Suite

As a standalone solution, it supports several use cases, including monitoring the health of the network connections between on-premises networks and public clouds like Amazon Web Services (AWS), and of course, Microsoft's own Azure cloud computing platform. It can also be used by businesses to monitor the links between multiple data centers and offices, whether they're connected via public or private networks. Prior to its official launch this week, early testers have been putting Network Performance Monitor through its paces since July 2016 as part of a public preview release. According to Microsoft, their feedback has helped the company ship Network Performance Monitor with several new features and enhancements that help IT professionals find and fix issues faster.


Don't let continuous software delivery automate the publishing of bugs

Changing the pace of iteration does not mean that you can suddenly code faster. A better word might be sooner. Let's do a new version sooner, see what works, see what doesn't and then iterate from there. ... DevOps is on a good path. The original DevOps and Agile people should be proud. It reminds me of the 1990s with open source. These were idealists who did not understand the concept of corporate production. With Linux, and even Microsoft today, it is a victory for open source. The same thing is taking place with development methodologies. We used to have long release cycle -- often years. The Agile guys in early 2000s didn't understand what critical software meant to operating critical apps in production. Today, if you're not doing Agile and DevOps, you're late. Every company has been good at producing business value from software.


Pass on the JSON, and choose binary encoding formats instead

Text-based encodings are typically 10x slower than the less efficient binary codecs such as GBP. There are binary encodings that are 10x to 100x more efficient such as FlatBuffers, Cap'n Proto and SBE (Simple Binary Encoding). ... This increase in efficiency results in direct reductions in latency, increases in throughput, and efficiency gains. We can also see bandwidth reduction due to more compact encodings. One of the biggest wins can be on mobile devices where the battery usage is significantly reduced. If you profile the typical business application you will likely be shocked how much CPU time and memory is dedicated to protocols and codecs relative to the business logic. It seems our applications are mostly doing protocol handling and encoding and as a side effect do a little business logic.


Processing Streaming Human Trajectories with WSO2 CEP

Extracting useful information from an uncertain data stream is a significant issue in data stream processing with a wide variety of applications. In this article we will demonstrate one such application which involves the synthesis of useful information from an uncertain data stream in the domain of transportation and logistics. It is essential to filter the sensor data collected from sensor networks since most of such data are inaccurate due to multiple issues such as sensor malfunctions, environmental noise, etc. Specifically we describe the use of Kalman filters on WSO2 CEP (complex event processing) for smoothing human trajectory information gathered from an iBeacon sensor network. We demonstrate the effectiveness of our solution by comparing an example raw human trajectory against the Kalman filtered results.



Quote for the day:


“Whatever you do in life, surround yourself with smart people who’ll argue with you.” -- John Wooden


Daily Tech Digest - February 26, 2017

Post-Quantum Crypto: Don't Do Anything

So far, however, the sky is not falling. "I wouldn't lose too much sleep over quantum computers," said Boneh's co-panelist, Israeli cryptographer Adi Shamir - the "S" in the RSA asymmetric cryptographic algorithm. "Quantum computers are not at the top of my list of worries," added Shamir, who's also the Borman Professor of Computer Science at Israel's Weizmann Institute. "I think there is a higher chance that RSA could be broken by a mathematical attack." Shamir also expects there to be plenty of warning if powerful quantum computers become a reality. "The big question everyone should be trying to answer is when we should start worrying," he said. "Is it something that's likely to happen in only one location, deep in a basement in Maryland?" he asked, in reference to the National Security Agency, which is known to be conducting related research.


Data Integrity in the Era of Fake News

An analysis of integrity - a core foundation of cybersecurity - in the era of fake news leads the latest edition of the ISMG Security Report. In this Security Report, you'll hear: DataBreachToday Editor Mathew Schwartz analyze comments by leading IT security experts on the threats posed to information integrity; Excerpts from HealthcareInfoSecurity Editor Marianne Kolbasuk McGee's interview, from the HIMSS17 health IT conference in Orlando with Medical Device Innovation, Safety and Security Consortium's Dale Nordenberg on a new initiative to help ensure the security of medical devices; and ISMG Security and Technology Editor Jeremy Kirk report on new cybersecurity regulations in New York state governing financial institutions.


RPA Proving Its Transformational Value At Deutsche Bank

“By teaching a machine that set of tasks—having that knowledge encoded through robotics and cognitive computing—that knowledge is available to humans to augment their skills and accelerate the onboarding process,” Mazboudi says. The automated system can guide employees through their day-to-day work. “We really look at it as augmenting our workforce by making this encoded intelligence available to them,” says Mazboudi. “I don’t think robots will ever replace humans. But robots will make humans more efficient and smarter.” They could make employees happier as well. Automating more of the monotonous tasks can increase employee satisfaction, Mazboudi says. But RPA is not a quick fix. It oftentimes requires rethinking existing business processes. “Very seldom can we take a process as it exists today and just automate it,” Mazboudi says.


Cyber Espionage Seen Expanding to Grasp Trump Policy Changes

Nations regularly spy on one another but with President Donald Trump espousing unconventional approaches to foreign policy, there is an heightened urgency to know what shifts may occur, according to John Hultquist, FireEye’s manager of cyber espionage analysis. “We can anticipate worldwide a surge in cyber espionage because of the changing administration, because of America’s rapidly changing foreign policy, military policy, diplomatic policy," Hultquist said in an interview in San Francisco. “We have created a lot of uncertainty that foreign countries or foreign adversaries are going to try to unravel with these tools.” Organizations under threat include the State Department, political parties and research institutes that provide insights on how the U.S. posture is developing, Hultquist said.


Connecting the Big Data Dots to Optimize Health and Manage Disease

As we enter 2017, we will begin to move from a "Quantified Self" era, where the data has generally remained siloed on the devices and apps of the individual and not integrated into clinical care, to the emergence of "Quantified Health,” where the data from common consumers' wearables, scales, BP cuffs, glucometers and even home lab data, will flow through consumer's smartphones (via Apple's HealthKit and more recently via Google Fit and Samsung's S-Health) and integrate into electronic medical records (EMRs) of the clinician. This will bring feedback loops which can communicate back to individual patients, engaging and empowering patients along the way.As of early 2016, with a single iPhone authorization, my HealthKit data could flow into my Stanford Hospital electronic medical record and MyStanford app to be tracked and visualized.


Storage-class memory supporters may heed lessons learned from the 1970s

Unfortunately, the available memory options at that time were not as advanced as today. The System/38 wound up using IBM's then-standard semiconductor memory, and it's best known in historical circles as one of the early systems to rely on object storage rather than straightforward files and blocks. This is a lesson for the modern IBM and other industry titans, such as Hewlett-Packard, Intel, and Microsoft, as they and others all try to figure out storage-class memory. "Essentially the applications were brand new and people rewrote them for that," Soltis said. It will happen again in the 2020s, he predicted. This was not insurmountable in the 1980s because of the limited number of applications and because many of the System/38's customers were new users in general, without much of a legacy systems burden.


Four ways banks are turning the tables on cybercriminals

They “can’t afford any more hacks to occur or for adversaries to spend months undetected in corporate networks, databases and applications … only to find out after a breach occurred and after data has been exposed or transactions have been meddled with or Social Security numbers have been stolen,” Schulze said. Still, banks cannot go on the attack — their own lawyers, regulators and law enforcement won’t allow it. In the U.S. and most other countries, it would be illegal to hack back at a cyberattacker. Witty compares this situation to being a Samurai warrior who may not fight. “You have beautiful armor and a beautiful helmet but you don’t have a sword, and if you do have a sword you can never use it,” he said. “You can only block, parry, duck, jump or run.” That said, banks are finding ways to block and parry more assertively. Here are four of them:


SHA-1 Has Fallen

The writing has been on the wall for SHA-1 for some time. In 2005, cryptographer Bruce Schneier, responding to the first-ever theoretical collision attack that was demonstrated against SHA-1 by three Chinese researchers, showing how SHA-1 might one day be cracked, said that "we need to get to work replacing SHA." There are two risks. "One-way hash functions are supposed to have two properties," Schneier wrote at the time. "One, they're one-way. This means that it is easy to take a message and compute the hash value, but it's impossible to take a hash value and recreate the original message. (By 'impossible' I mean 'can't be done in any reasonable amount of time.') Two, they're collision-free. This means that it is impossible to find two messages that hash to the same hash value."


Manage Today's IT Complexities with an Enterprise Architecture Practice

One solution is an enterprise architecture (EA). It's a relatively new practice in higher education IT, but one that continues to gain importance.3 An EA provides an overarching strategic and design perspective on IT activities, clarifying how systems, services, and data flows work together in support of business processes and institutional mission. It helps to integrate new technologies and services, and their data streams seamlessly into an institution's IT environment. But EA also serves as an important institutional planning tool, as a means for getting the right people involved in solving the right problem. "Quite often we start off by saying we need to buy a CRM for the campus rather than thinking about the problem we are trying to solve and who should be involved in the conversation," explained Jim Phelps


Eight essential enterprise architecture artifacts

Even though both TRMs and guidelines describe some implementation-level technical rules relevant to IT projects, they are complementary to each other because TRMs provide lists of technologies to be used, while guidelines define more narrow prescriptions regarding their usage. .... Business capability models (BCMs) (sometimes also called business capability maps) provide structured views (‘maps’) of all organisational business capabilities on a single page, sometimes together with other supporting information like business strategy, objectives, main customers, partners, etc. BCMs are typically developed collaboratively by architects and senior business leaders and then ‘heatmapped’ to identify best investment opportunities, prioritise future IT spending and ensure the alignment between IT investments and desirable business outcomes. BCMs are often considered as ‘entry points’ into IT for business executives.



Quote for the day:


"The size of your success is measured by the strength of your desire; the size of your dream; and how you handle disappointment along the way" -- @InspowerBooks


Daily Tech Digest - February 25, 2017

EFF: Half of web traffic is now encrypted

Google played a significant role, having put pressure on websites to adopt HTTPS by beginning to use HTTPS as a signal in its search ranking algorithms. This year, it also ramped up the push towards HTTPS by marking websites that use HTTP connections for transmitting passwords and credit data as insecure. HTTPS, which encrypts data in transit and helps prevent a site from being modified by a malicious user on the network, has gained increased attention in recent years as users have woken up to how much of their web usage is tracked, and even spied on by their own government. Large-scale hacks have also generally made people more security-minded as well. A number of larger players on the web also switched on HTTPS in 2016, like WordPress.com which added support for HTTPS for all its custom domains, meaning the security and performance of the encryption technology became available every blog and website it hosted.


AI and Robotics Trends: Experts Predict

Many people fear losing their jobs to robots, but more than likely you will have a robot for a co-worker. Then again, if you've been in the workforce long enough, you've probably already had a robot for a co-worker, just in human form. "In 2017, we are seeing a growing emergence of robots designed to operate alongside people in everyday human environments. Autonomous service robots that assist workers in warehouses, deliver supplies in hospitals, and maintain inventory of items in grocery stores are emerging onto the market," said Sonia Chernova, assistant professor at Georgia Tech College of Computing. These systems need humans because one thing robotics researchers are still struggling with is robotic arms. There's no substitute for the human arm to pick things up and manipulate objects.


IT unbounded: The business potential of IT transformation

Creating an unbounded IT organization will require that CIOs think beyond their own experiences and domain expertise and begin viewing IT through a different operational and strategic lens. For example, they can take a look at the efficiency and effectiveness of current budgeting, portfolio planning, and vendor selection processes and try to identify procedural, administrative, and other constraints that can be eliminated. ... Likewise, they can help streamline their development processes by coming up with fresh approaches to testing, releasing, and monitoring newly deployed solutions. Important to development, IT organizations can work to replace bloated, inefficient skillset silos with nimble, multiskill teams that work in tandem with the business to drive rapid development of products from ideation all the way through to deployment.


Machine Learning-driven Firewall

A few days ago, I happened to come across a website called ZENEDGE which is offering AI driven web application firewall. I liked the concept and thought of making something similar and sharing it with the community. So, lets make one. The first thing to do was to find labelled data but the data I could find was quite old (2010). There is a website called SecRepo that has a lot of security related datasets. One of them was of http logs containing millions of queries. That was the dataset I wanted but it was not labelled. I used some heuristics and my previous knowledge of security to label the data set by writing a few scripts. After pruning the data, I wanted to collect some more malicious queries. Therefore, I went on for payloads and found some famous GitHub repositories containing Xss, SQL and other attack payloads and used all of them in my malicious queries dataset.


Bleeding clouds: Cloudflare server errors blamed for leaked customer data

According to Cloudflare, the problem could have started five months ago, on September 22, 2016. "The greatest period of impact was from February 13 and February 18 with around 1 in every 3,300,000 HTTP requests through Cloudflare potentially resulting in memory leakage (that’s about 0.00003% of requests)," a blog post by Cloudflare's CTO, John Graham-Cumming, explains. In an email exchange, Cloudflare pointed Ormandy to the company bug bounty, which offers a reward of a t-shirt instead of financial compensation, leading Ormandy to speculate the company doesn't take the program seriously. As the disclosure deadline quickly approached, Cloudflare engineers worked around the clock to resolve the problem. Google has started removing cached copies of the leaked data, but other search engines are still holding some copies.


Is Your Industry at High Risk of Insider Threat?

In the movies, data theft is usually the work of outsiders. You’ve witnessed the scene a million times: A cyber thief breaks into a business, avoiding security measures, dodging guards and employees, and making off with a USB stick of valuable data seconds before he or she would have been spotted. But in the real world, data theft is much more mundane. Most cyberattacks are carried out by someone within the company or someone posing as such. Sometimes they take data that’s essentially harmless, like personal files they feel entitled to keep. Other times, what they take is potentially much more harmful. According to a 2016 report from Deloitte, 59 percent of employees who leave an organization say they take sensitive data with them! With IP making up 80 percent of a company’s value, insider threat is something that every company should take seriously.


Smart cities must be people-centered, equitable cities

The development of smart cities builds upon this strong historical foundation with a digital foundation that allows cities to function more efficiently, be more responsive to community members and ultimately create better, more equitable urban environments where people thrive. Cities are beginning to, and will continue to, integrate technological dynamism into municipal operations, from transportation to infrastructure repair and more. The back ends of these systems are not always apparent to the end user — but, as the integration of smart-city technology becomes more visible in our everyday lives, we will continue to see positive changes in our cities.


Report: Why the big challenges in AI aren't close to being solved

For most companies, the initial investment in AI comes in the form of a digital assistant or chat bot. These tools are often being offered free of charge, or folded into other core products, in order to generate and collect the data needed to strengthen the AI behind them. Digital assistant are "a good first yardstick of each ecosystem's competence in AI," the report said. AI is built on data, as is another product many people use everyday: Search engines. As such, it makes sense that companies like Google, Baidu, and Russia's Yandex are growing leaders in the AI space due to their focus on data-powered search. Under these leader, companies like Microsoft, Apple, and Amazon are also investing heavily in their own AI efforts as well.


What Will Tomorrow's Engineers Look Like?

To be sure, a good engineer is someone who has received solid scientific and technical training that allows him or her to devise a pertinent response to a problem, sometimes in a very short amount of time. An engineer must study a situation seriously, go out into the field to understand the facts and listen carefully to analyze phenomena and make improvements. An engineer is also someone who is not afraid of hard work, for more than ever, nothing is granted to anyone without effort. Work provides the opportunity to play a role and make a meaningful contribution to the community. However, as the digital revolution shows, in today's very open and rapidly changing world, an engineer also needs to demonstrate persistence, boldness, team spirit and leadership.


Doing Scrum with Multiple Teams: Comparing Scaling Frameworks

According to Craig Larman and Bass Vodde (the creators of LeSS) the primary rule of scaling agile is: don’t do it! If you have problems with: Cross team dependencies; Risks that affect several teams; and Scheduling of (coordinated) deliveries, you might need a scaling framework. If you can deal with these problems by re-arranging your teams and product structure, you are better off without one. If you can’t, please continue reading. All three frameworks start with cross-functional, self-organizing Scrum teams. The teams vertically slice requirements into the smallest possible increments that can be deployed independently. Teams are also expected to focus on technical excellence such as doing continuous integration and automated regression testing.



Quote for the day:


“Capital isn’t scarce; vision is.” -- Sam Walton