Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - April 05, 2017

Businesses Hit by More W-2 Fraud as Cybercriminals Shift Tax Season Targets

Cybercriminals often collect W-2 data by pretending to be a company exec and emailing HR or payroll for employee information, which is used to file fraudulent returns and collect refunds. In addition, they may also request a wire transfer to a specific bank account. Attackers who are more technically inclined may bypass the fake emails and breach an organization's servers to steal data directly, says Kessem. In addition to using W-2 data for their own scams, fraudsters will sell it on the dark web, the report states. The most valuable bundles of information are called "Fullz" and contain the victim's address, contact info, Social Security and driver's license numbers, plus all W-2 and W-9 information. Each record runs for $40-$50 in Bitcoin on the Dark Web.

What home products are most susceptible to cyber burglars?

Just like the lock on your front door to keep out burglars, you should protect your high-tech devices from cyber threats. Start by choosing different passwords for your internet router and each of your smart devices. It is also important to use multi-factor authentication as an added protection to prevent a hacker who guesses your password from breaking into your home. You should regularly install manufacturer updates to make sure you are running the most current security system in your home. Ovum's "Smart Home Devices Forecast: 2016–21" found that the largest smart home markets will be China and the US, because of high availability of devices and greater consumer interest in smart home services and products. Device sales will grow to more than 1.4 billion units by 2021, up from 224 million in 2016, driven particularly by sales of security devices, such as cameras, door locks, and sensors, and by utilities devices, such as connected light bulbs and smart thermostats.

You are not very incognito in incognito mode

Basically, incognito mode just means that the browser doesn't save cookies, temporary internet files or your browsing history when you are in incognito mode. The main thing it does is hide your browsing history from other people who use the same computer. Not all of reasons someone might want to do this are nefarious; I used incognito mode when I was shopping for Christmas presents on a shared computer this past year, and successfully managed to keep the gifts I searched for and purchased a secret. There are other uses for incognito mode apart from keeping your browsing history secure from prying eyes. For example, you can be logged into your main Google account, then open an Incognito Window and use it log into a separate or secondary Google account at the same time.

NASA official warns of 'the internet of dangerous things'

The reason why software security is weak, Davis said, is because industry is "all about speed to market." Plus, there are "not enough people out there who can actually build these things the correct way," he said. Exacerbating the concerns about the internet of things, Davis said, is that the information-sharing systems currently in place are "just completely broken." Even though security groups share the same mission to protect users, Davis pointed to shareholder issues and concerns about attribution and embarrassment as reasons why both public and private groups are reluctant to share. To keep up with the emerging security problems, Davis said that industry and government alike must work to foster security skill sets. Both government and industry have to navigate the shortage of cybersecurity specialists, but government is at a disadvantage because of its protracted hiring process and inability to compete with top private-sector compensation, Davis said.

IT leaders share how they quell cybersecurity attacks

"God forbid someone drop a cyber nuke or DDOS from malware -- they can take down a whole environment," Belfiore says. "If we're down it doesn't really matter how secure we are -- we have a problem." Even so, security chiefs have to protect their data. Aon is a heavy consumer of Tanium, whose endpoint security software monitors IT operations and detects malware, among other threats. Belfiore says the software covers anything from kernel operations of a server processor to the application portfolio that is operating on it. “Think of it as an agent, almost like a spy to every asset on environment to give you real-time status on any attribute related to operations and security,” says Belfiore who joined Tanium’s board of directors this year. “It's almost like a central management system on steroids for security and operations.”

Notorious IoS Spyware Has An Android Sibling

The spyware was uncovered when a human rights activist in the United Arab Emirates was found infected by it. His phone had received an SMS text message, which contained a malicious link to the spyware. Apple quickly issued a patch. But Lookout had also been investigating into whether NSO Group developed an Android version. To find out, the security firm compared how the iOS version compromises an iPhone and matched those signatures with suspicious behavior from a select group of Android apps. Those findings were then shared with Google, which managed to identify who was affected. However, unlike the iOS version, the Android variant doesn’t actually exploit any unknown vulnerabilities. Instead, it taps known flaws in older Android versions. Chrysaor was never available on Google Play, and the small number of infected devices found suggests that most users will never encounter it, the search giant said.

McAfee Returns to Its Roots After Intel Spin-Out

Now, McAfee is embarking on yet another chapter: It has officially been spun out of Intel and is a standalone security player, yet again. Its new overlords? Well, Intel’s still in the mix, with 49% equity in the now-independent McAfee. The majority backer, however, is private equity firm TPG Capital, which has a 51% share in the company. (Another PE firm, Thoma Bravo, has also joined as a minority investor through an agreement with TPG.) As for the price tag? McAfee was valued at $4.2 billion in this most recent deal, a far cry from its former valuation. The decreased price isn’t the only thing that’s different at the newly-free McAfee. The company also has a new chief executive officer: former Intel Security head Chris Young. The CEO, a long-time security exec, has an ambitious to-do list.

The best laptops of 2017: Ultrabooks, budget PCs, 2-in-1s, and more

Dell might be sticking to the adage of “If it ain’t broke, don’t fix it” when it comes to the XPS 13, but that strategy keeps producing the best ultrabook of the bunch. The Kaby Lake XPS 13 shares the same design as its predecessors: a quality aluminium exterior and carbon-fiber top, and that wonderfully compact, bezel-free 13-inch screen. Dell actually released two updates to the XPS 13 in 2016: The one at the start of the year swapped in a Skylake CPU, added a USB Type-C port that served as an alternative charging port, and offered upgraded storage options. The most recent refresh—and our new pick for Best Ultrabook—keeps the same chassis changes as the Skylake XPS 13, features a jump to Intel’s new Kaby Lake processor, and sports a slightly larger battery. You get improved performance across the board, with a nice bump of an extra half-hour of battery life during video playback.

Why Android's ongoing domination actually matters

The better Android does in the big picture, the more app developers will be motivated to invest in it and make it a priority. The more people who use Android, the more hardware manufacturers will be driven to make standout devices and accessories. The companies that don't will miss out on reaching the overwhelming majority of internet-using consumers -- an increasingly difficult position to justify from a common-sense business perspective. ... The bottom line is this: When it comes to something like market share, no single statistic or study is as important as it may initially appear. But taken together as a whole, ongoing trends absolutely are meaningful -- in a way that has an indirect though very practical impact on users.

Enhance Your Testing Skills with Mindset Tools

Quite a lot of testers often miss out on the mindset that’s needed for testing and delivery of quality products. Sometimes it seems that quality consciousness is missing. Little wonder why some testers only find obvious bugs and why quality is far-fetched from the PUT (Program under test), despite the presence of testers on the project. Adding up to this is the overwhelming and unnecessary challenges that awaits a project where individuals in each role (programmer, project manager, test lead, testers), lack proper understanding and appropriation of the level of test mindset that is needed for each role, in order to enhance successful release of quality products. This article is about how I discovered a way to grow my test mindset and how my discovery has been useful in enhancing my testing skills.

Quote for the day:

"The machine does not isolate man from the great problems of nature but plunges him more deeply into them." -- Antoine de Saint

Daily Tech Digest - April 04, 2017

Augmented, Virtual, and Mixed Reality: the Outlook for Tomorrow

Augmented reality can be described as an additional layer to our reality. It does not replace the real world, it just adds something, you can still see or hear the environment around you, whereas VR completely puts you in a different reality with total immersion. AR can’t change people’s imagination of the world and its representation, but complements the real world with artificial objects and new information. There are various types of AR. The key differences between them are the objectives and use of applications. ... Of all the three ‘realities’, this one is the least known, but ironically, perhaps, has the easiest path to consumers. The easiest way to explain MR is to say it combines the best aspects of VR and AR. MR mixes with virtuality, adds believable virtual elements to the world. The aim of MR is to unite the best characteristic of virtual reality and AR.

The 2 Biggest Cybersecurity Fears of NASDAQ's Chief Information Security Officer

I recently spoke with Lou Modano, Chief Information Security Officer of NASDAQ, and asked him what his greatest fears are right now when it comes to keeping NASDAQ cyber-safe. Of course, there are many threats facing NASDAQ - from criminals to hacktivists to nation states - and the stock exchange obviously has an army of highly skilled information-security professionals, intensive information-security-related training, and a robust information-security technological infrastructure, so my question went beyond the usual technological and human issues, and, instead focused on what risks are hardest to correct even with significant cybersecurity resources. As such, CISO Modano's observations provide insight into the big-picture problems that businesses, cybersecurity professionals, and policymakers should be thinking about.

Fortify IoT infrastructure now, even for simple deployments

"A lot of the current deployments really don't need that much bandwidth," Stolarski said. Latency is not a concern for these IT pros, and they typically view data on dashboards, rather than use real-time analytics or decision-making at the edge, Stolarski said. Kevin Roberts, director of platform technology at FinancialForce, a cloud-based software startup in San Francisco, is building out the financial back end to support a growing number of IoT deployments in the enterprise. Roberts said he's seen a turnaround in terms of the acceptance of cloud computing in recent years, which has shifted from mistrust of the cloud to widespread acceptance. Right now, it's unclear what sort of backbone enterprises will use to support their IoT efforts, Roberts said. There will continue to be a shakeout to decide who will buy, own and manage IoT infrastructure.

Chinese hacking group targeted firms though IT MSPs

The espionage campaign has targeted managed MSPs, potentially allowing the APT10 group unprecedented access to the intellectual property and sensitive data of those MSPs and their clients around the world. This campaign provides a useful reminder that an organisation’s entire supply chain needs to be managed and that organisations cannot outsource their risk, said the NCSC, adding that MSPs are particularly attractive to attackers because they often have highly privileged access to systems and data. “As part of your procurement, you should have ensured that your service providers all manage their security to a level broadly equivalent to that you would expect from your internal functions. This incident provides a useful impetus to revisit those discussions,” the NCSC said.

Cybercriminals Seized Control of Brazilian Bank for 5 Hours

The operation actually began at least five months prior to the actual hijack on Saturday, Oct. 22. Bestuzhev says it's unclear just how the attackers were able to compromise the DNS provider, but notes that Registro.br in January of this year patched a cross-site request forgery flaw on its website. "Maybe they [the attackers] exploited the vulnerability on that website and got control. Or … We found several phishing emails targeting employees of that registrar, so they could have spear-phished them," he says. "We don't know how exactly they originally compromised" the DNS provider, he says. The bank didn't deploy the two-factor authentication option offered by Registro.br, which left the financial institution vulnerable to an authentication-type attack as well as authentication-type flaws such as CSRF, Fabio Assolini, a Kaspersky Lab researcher said here today during a presentation about the bank hijack discovered by Kaspersky.

A Comprehensive Look at F# 4.1

At the top of the list are Struct Tuples. Tuples are very important to idiomatic code in F# and other functional programming languages. A major criticism of F#’s implementation, known as System.Tuple, was that it is a reference type. This means potentially expensive memory allocation is needed each and every time a tuple is created. Being immutable objects, that can happen quite frequently. This was solved in .NET by the introduction of the ValueTuple type. Also used by VB and C#, this value type will improve performance in scenarios where memory pressure and GC cycles are an issue. Care has to be used, however, as repeatedly copying ValueTuples more than 16 bytes in size may introduce other performance penalties. In F#, you can use the struct annotation to declare a struct tuple instead of a normal tuple. The resulting type works similarly to a normal tuple, but is not compatible so switching is a breaking change.

Data Deduplication: It’s Not Just About Storage Savings Anymore

The data backup and deduplication solution should allow discovery of how content propagates across the organization. It should not obscure the trail that shows where a piece of content originated. And it’s important to remember that dark data doesn’t just comprise files but also the metadata associated with each file, which tells what devices contain the content, when the file was created, when modifications were made and other key data points. Endpoint data is incredibly vulnerable to theft and loss since the devices that contain it are more likely to be lost or stolen. And the dangers are growing since there is a huge profit motive to gain access to that data. Ransomware attacks, for example, are growing at an alarming pace. And data breach costs in general are rising.

Why Enterprises Are Upgrading To Windows 10 Faster Than Expected

One reason the pilots and deployments are going so smoothly is that, in many cases, enterprises are rolling out Windows 10 as if it were Windows 7, says Kleynhans. “It's pretty much as a direct replacement; they're not necessarily making much use of the new features.” Instead they’re using the pilots and early deployments to gain familiarity with the new OS, starting with an experimental pilot in one division (or even one country) that then expands across the organization. “They're turning on maybe one or two new features but they're not really rushing forward with all the new enterprise features,” he says. The features enterprises do adopt are the security enhancements in Windows 10. “They’re really intrigued by the new security capabilities; they're looking forward to those. That's one of the things driving Windows 10 adoption,” says Kleynhans.

Application support and maintenance add up to operational ALM

To achieve true software-enabled automation of application support and maintenance -- the holy grail -- the operations team must implement the complete state-event description of an application's operational lifecycle in DevOps tooling. Continuous delivery and application availability management becomes a reality when development and change management tasks, implemented through ALM practices and tools, are integrated with DevOps-based operational application maintenance and support. With more cloud and virtualization adoption, the imperative to manage operational lifecycles grows. These same forces demand the use of software automation to improve efficiency and reduce configuration errors. Without an effective way of managing the operational lifecycle of applications, much of the effort put into traditional ALM will go to waste.

Analytics, internet of things to drive data volumes to 163ZB by 2025

According to the study, we are transitioning from a period in which information has been transformed from analog to digital to one in which digital information will increasingly be a critical part of systems required for everyday life-critical systems that use analytics, machine learning and the internet of things (IoT). According to the study, Data Age 2025: The evolution of data to life critical, nearly 20% of the world’s data will be critical to our daily lives by 2025, and nearly 10% of that will be “hypercritical”. A large portion of this will be created by embedded systems and the IoT. By 2025, an average connected person anywhere in the world will interact with connected devices nearly 4,800 times per day. That’s one interaction every 18 seconds. The amount of data subject to analysis is estimated to grow by a factor of 50 to 5.2 ZB in 2025.

Quote for the day:

"If you're not prepared to be wrong, you'll never come up with anything original." -- @SirKenRobinson

Daily Tech Digest - March 30, 2017

Toward new possibilities in threat management

Many organizations are proactively adopting or updating key technologies that are essential to gathering and analyzing threat intelligence. Few capabilities are more fundamental to proactive threat intelligence than real-time monitoring and analytics. This year, more than half of respondents say they actively monitor and analyze threat intelligence to help detect risks and incidents. These technologies provide contextual awareness of threats and an understanding of the tactics, techniques and procedures of adversaries. When analytics and threat intelligence are synthesized in the cloud, it becomes possible to create a single source of enterprise-wide data. Another trend lies in adaptive authentication. As IT systems capture increasingly more information, businesses are starting to leverage additional data points to identify suspicious behaviors and patterns.

Data breaches through wearables put target squarely on IoT in 2017

Mike Kelly, CTO of Blue Medora, agrees, stating that, “the inability to quickly update something, such as your home thermostat, is where we will see the risk. It’s not about malware getting on the devices, the focus will need to be on the ability to remediate the issue. Like we saw with Windows, there will be a slew of vulnerabilities, but unlike with a computer, patching won’t be as easy with IoT devices,” he says. More connected devices will create more data, which has to be securely shared, stored, managed and analyzed. As a result, databases will become more complex and the management burden will increase. Those organizations that can most effectively monitor their database layer to optimize peak performance and resolve bottlenecks will be in a better position to exploit the opportunities the IoT will bring, he says.

Building Stakeholder Confidence in Cyber Risk Management

Regulatory scrutiny of cyber risk management, meanwhile, shows no signs of abating and could grow with time. Although the Trump administration is still taking shape, the president’s nominee to lead the Securities and Exchange Commission, Jay Clayton, notably co-authored a 2015 article underscoring the need to proactively manage cyber risks. Further, the new cybersecurity regulation for New York’s financial industry, which went into effect this month, requires identification and documentation of material deficiencies, remediation plans and annual certifications of regulatory compliance. Corporate leaders might wonder how they can begin to assess their conformance with voluntary standards, further strengthen risk management and demonstrate progress in cybersecurity.

Why the endgame for fintech isn't all rosy collaboration

First, circumventing established parts of the financial system’s “plumbing” such as Visa and MasterCard is hard. Indeed, several fintech businesses use MasterCard (like Monzo, Revolut, Tide, DiPocket, Loot and Starling). But for the newest startups, this is a ladder to kick away at the earliest convenience. Cryptocurrencies (and other innovations) will start making a dent in the payments infrastructure – but it will take years. ... Second, the major players in the established financial ecosystem try to take care of many of their clients’ needs. Fintech companies could try to replicate this by becoming technologically more integrated with each other, thus enabling users to frictionlessly purchase additional products from alternative fintech providers.

FinTech and the Digital Strategy

In the finance sector, too many processes remain tedious and time consuming without needing to. Take electronic invoicing as an example of the automation of a task that removes huge amounts of friction. The exchange and handling of almost any data, and particularly things like invoices, purchase enquiries, and requests of financing, are not only more efficiently done digitally, they also greatly reduce errors and delays. Every day, businesses waste time and energy by manually checking invoice documents received from a growing global supply chain. Technology exists that would ensure incorrect invoices are rejected before they even arrive. Additional time is wasted calling and emailing to check on invoices statuses, instead of accessing the information online.

Executive Guide to Artificial Intelligence

Broadly two classes of AI systems exist. First category called Artificial General Intelligence systems also called as strong AI are supposed to mimic human beings on most aspects. Few systems that fall, attempting to rather, in this class are IBM Watson, Google Assistant and Apple Siri. These systems are not just complex to develop, their usage within an enterprise as well to general public are questionable and limited at best. Obviously these systems are still in research stage and the progress has been comparatively slow. Other class of AI systems called Artificial Narrow Intelligence are supposed to solve a specific problem or useful in a specific kind of scenario. These systems are also called weak AI although an unfair nomenclature and doesn’t justify the complexity, practicality and usefulness involved.

Government must avoid post-Brexit ‘tech talent cliff edge’, says techUK

“UK tech must continue to be underpinned by talent that is attracted to, and able to work in, the UK,” she said. “The government has repeatedly voiced support for tech in its recent industrial strategy and digital strategy. Now that Article 50 has been triggered, it is time to back up that approach with concrete details on how the sector will be able to access the talent it needs.” The report also called on the government to undertake a review of how “new technologies can be deployed to ensure frictionless migration systems, including visa applications and movement of people across borders”. It said a smart migration working group should be established to create and evolve a “data-driven, real-time smart migration system”.

Report reveals new all-time high in mobile device infections

While Android-based smartphones and tablets continued to be the primary targets, reflecting the prevalence of the operating system worldwide, iOS-based devices also suffered attacks in the second half of the year, primarily by Spyphone surveillance software that tracks users' calls, text messages, social media applications, web searches, GPS locations and other activities. The Threat Intelligence Report also exposed major vulnerabilities in the rapidly expanding universe of IoT devices, underscoring the need for the industry to re-evaluate its IoT deployment strategies to ensure these devices are securely configured, managed and monitored. ... “The Mirai botnet attacks last year demonstrated how thousands of unsecured IoT devices could easily be hijacked to launch crippling DDoS attacks. As the number and types of IoT devices continue to proliferate, the risks will only increase."

New Mirai IoT variant launched 54-hour DDoS attack against a U.S. college

During the 54-hour DDoS attack on the college, researchers observed a pool of attacking devices normally associated with Mirai such as CCTV cameras, DVRs and routers. Attack traffic originated from 9,793 IPs worldwide, but 70% of the botnet traffic came from 10 countries. The U.S. topped the list by having 18.4 percent of the botnet IPs. Israel was next with 11.3 percent, followed by Taiwan with 10.8 percent. The remaining seven countries of the top 10 were India with 8.7 percent, Turkey with 6 percent, Russia with 3.8 percent, Italy and Mexico both with 3.2 percent, Colombia with 3 percent and Bulgaria with 2.2 percent of the botnet traffic. ... Incapsula said, “This–and the size of the attack itself–led us to believe that we might be dealing with a new variant, which was modified to launch more elaborate application layer attacks.”

3 Ways Technology Influences Generational Divides at Work

What do an iOS developer, a social media intern, a UX designer and a big-data architect have in common? As recently as 10 years ago, their job titles were rare (or didn't exist at all). Today, these titles are a dime a dozen for young professionals. In 2008, there were zero big-data architects on LinkedIn. In 2013, there were 3,440. (It might not come as a surprise that nearly 70 percent of parents admit they don't have a clear understanding of their children's jobs). Technology's rapid evolution has led to a surge of digital tools in the workplace. In some cases, it's created entirely new industries. But it's also created a gap between generations. If companies hope to address the challenges of a multigenerational workforce, it's critical for leaders to embrace these differences as opportunities.

Quote for the day:

"The best minute I spend is the one I invest in people." -- Ken Blanchard

Daily Tech Digest - March 29, 2017

5 reasons your company can't hire a cybersecurity professional

The shortage in skilled cybersecurity professionals is only growing worse, with the projected talent gap reaching 1.8 million jobs by 2022. "It's definitely a seller's market," said Forrester analyst Jeff Pollard. "If you have security skills, there are plenty of opportunities available for you. If you have an interest in security and perhaps have a nontraditional background but are willing to learn, opportunities are certainly open from that perspective as well." However, the shortage has left many companies stuck: A recent report from ISACA found that 55% of organizations reported that open cyber positions take at least three months to fill, while 32% said they take six months or more. And, 27% of US companies said they are unable to fill cybersecurity positions at all.

6 Soft Skills Employers Should Be Looking For In Tech Talent

Forget experience and hard skills -- tomorrow's best talent will need soft skills, and it's fact that sourcing and recruiting pros need to be prepared to address. "From our own LinkedIn research last May, we know that, of 291 hiring managers we surveyed, their employers struggle to find candidates with the right soft skills for 59 percent of their open jobs, and 58 percent said the lack of soft skills among candidates was 'limiting their company's productivity,'" says Jennifer Shappley, senior director of talent acquisition at LinkedIn at a presentation at SourceCon, held earlier this month in Anaheim, Calif. ... The differentiator will be soft skills like adaptability, leadership, communication and others, she says. Here, Shappley shares six of the top soft skills she's looking for at LinkedIn and how to go about finding those.

Android VPN apps: How to address privacy and security issues

Armed with knowledge regarding these Android VPN apps, what can IT security professionals do about the situation? Whether this falls under your company's BYOD strategy, acceptable usage policies or some other aspect of its security program, such as security information and event management or malware protection, it needs to be addressed starting today. Obviously, you want to steer clear of any of the apps researched for the paper that might create risks in your particular environment. You might need to do your own vetting of these mobile apps, and may need to standardize on a handful of them. Tools by vendors such as NowSecure and Checkmarx, combined with network analyzers and other tools, can provide good insight to complement and even validate these new mobile VPN app research findings.

Why the internet of things isn't as vulnerable as it looks

Use of connected devices has exploded across critical infrastructure industries, resident in everything from industrial controls to financial systems, where the devices generate loads of data. That data, said Robert Griffin, lures attackers but also serves to boost security for infrastructure protectors. "For homeland security operators, IoT is now a component of critical infrastructure, where security is viewed as a common good for protecting each of our different 16 critical infrastructure sectors," said Griffin in a March 20 blog post, one of his first as acting undersecretary at S&T. He assumed that position in January, after Reginald Brothers moved to the private sector. Griffin said connected sensors provide data analytics that can be shared among security operators, helping improve performance, reduce costs and enhance security measures.

Automate DevOps so you can focus on a security-first culture

Organisations commonly feel like they have to trade off between security and productivity. That’s absolutely not the case but it needs the people shipping code and the security specialists to do some collaborative work up front. Sadly research by Gartner last year found that only 20% of enterprise security architects had properly engaged with DevOps initiatives and the majority of IT professionals felt information security was slowing down the ability of the IT department to respond to the needs of business. While working at HM Revenue & Customs I saw first hand how a great security team, willing to help redesign processes up front could help us to ship services which conformed to a common pattern quickly without putting users at risk. By putting a platform and tooling in place, we saw HM Revenue & Customs take projects which would have taken 18 – 24 months and deliver them in under six weeks.

Kaspersky: Criminals Make 95% Profit on DDoS

Kaspersky did a review of the Dark Web to find out the going rate for DDoS as-a-service, and found the average to be slightly higher than the example above—attacks typically cost $25 per hour, with the cyber-criminals making a profit of about $18 for every hour of an attack. The security specialist also found that organizers of DDoS services generally offer customers a tariff plan in which the buyer pays a per-second rental price for botnet capacity. For example, a DDoS attack of 300 seconds using a botnet with a total bandwidth of 125Gbps will cost about between $5 and $6. As for profitability, it should be noted that DDoS attacks and, in particular, ransomware DDoS have already turned into a high-margin business. “The profitability of one attack can exceed 95%,” the firm noted.

Intel digs in to keep Moore's Law alive

"Moore's Law is not dead, at least not for us," said Stacy Smith, Intel's executive vice president leading manufacturing, operations and sales, during an event to talk about manufacturing in San Francisco on Tuesday. At its heart, Moore's Law states that the cost of making chips goes down while the capabilities go up. Intel's interpretation of Moore's Law has changed multiple times. Initially, Intel was doubling transistors every 18 months, which then expanded to two years. On its most recent 14-nanometer process, that time line expanded to three years. With the new measurements, Intel will be able to boast that its manufacturing improvements are surpassing Moore's Law. The company also said it would cut the manufacturing cost per transistor by half with each new manufacturing process, which is in line with Moore's Law.

Why Siemens put $10 billion into digital transformation

Making use of the data collected by devices is key for industries wanting to move forward in the digital age. Half of all the data that exists in the world was created in 2016. And less than 0.5% of all the data collected last year was analyzed and used, according to Judy Marks, CEO of Siemens, explaining that she believes MindSphere will help industrial companies in particular make better use of their data and take them to the next level of competitiveness in manufacturing. Next47 is Siemens innovation startup unit, and as part of Siemens focus on startups, it will invest $1 billion over the next five years in startups, Busch said. ... Artificial intelligence was a key to one customer, where an AI brain was inserted into a turbine resulting in a 15-20% reduction in nitrogen oxide emissions. "This is how powerful artificial intelligence can be," Busch said.

Insecure Security Cameras Sound Like A Joke But Aren't

To be fair, these attacks do require the burglar (or, for that matter, murderer or rapist) to engage in a bit of physical gymnastics. The attacker first needs to get close enough to the camera to access Bluetooth — distances vary based on device and environment and it can even vary from initially making the handshake to maintaining the connection. But these are security cameras, so the attacker must achieve this potentially very short distance while also staying out of the camera’s view. After all, if the attacker is filmed before initiating the connection, the point of this exercise may be lost.

This problem is hardly insurmountable. But it involves studying the camera beforehand to learn the proper angle and positioning needed to access Bluetooth without being seen.

How do identity governance and access management systems differ?

Identity governance relies on policies to determine if updated access is too risky for a particular user based on his previous access and behavior. These governance policies can be put into an automated workflow when a change is deemed a risk, and allows the owners of the application or the data to sign off on the update. This fixes the issue of having to recertify users annually, and takes more of an incremental approach to auditing access. If someone accesses a system they don't have permissions for, the identity governance system can flag the access as suspicious. They can even be notified if a user is attempting to access a resource they don't have access to, or that no one in their role is attempting to access.

Quote for the day:

"Failure is friend of success, its not trying that is its enemy." -- Gordon Tredgold

Daily Tech Digest - March 28, 2017

SDN Solves A Lot Of Network Problems But Security Isn't One Of Them

Generally, the main security risks come from poor or incorrect configuration of the devices. While this is not only true in SDN, De Gaspari said it is potentially even more important given how flexible, and therefore how easy it is to misconfigure the architecture. Despite the gaps in security, though, SDN continues to be an emerging alternative solution to the problems of modern day networks. Gregory Pickett, cybersecurity operations at Hellfire Security, said that there is a lot of good that comes with SDN. "It allows for operations that providers have wanted for decades, operations such as maintenance dry-out, customer egress selection, enhanced BGP security through reputation-based route selection, faster convergence of routes, and granular peering at the IXP. SDN renders these all these problems moot," Pickett wrote.

Security awareness relies on balance of technical, human-behavior skill sets

"Security awareness was initially started about 10 years ago with the advent of regulation and compliance requirements," Sedova said. "Unfortunately, they were designed with the wrong question in mind. They ask 'show me how many people have taken your training.' Instead they should have asked 'show me metrics that your program yields improvement in X behavior.' The companies leading the charge in the awareness space today are creating their programs around this question." This leads back to the discussion around the right balance of talent for creating these programs. According to the SANS 2016 report on security awareness, more than 80 percent of security awareness personnel have a technical background, but also need soft skills such as communications, change management, learning theory, and behavior modeling, in order to be most effective.

MIT researchers set out to create self-assembling chips

The research revolves around the self-assembly of wires on chips. The wires would handle the biggest challenge in chip making. Instead of etching fine features onto silicon using existing methods, materials called block copolymers would expand and self-assemble into predefined designs and structures. The implementation of such self-assembly technology will involve adding one step into existing chip manufacturing technologies, said Karen Gleason, a professor at the department of chemical engineering at MIT. Today's manufacturing technology involves burning circuit patterns on to silicon wafers via masks using long wavelengths of light. Chips are currently being manufactured at the 10nm process, and it's becoming difficult to cram in smaller transistors using the same wavelength.

Ohio Air Force Base Trains Cyber Army

President Trump has called for “crippling” cyber warfare offensive capabilities and asked for a cyber plan within 90 days since he assumed the presidency. The New York Times has reported a joint U.S.-Israeli effort under prior administrations to launch the Stuxnet worm virus into a nuclear processing plant in Iran out of concerns that country was developing an atomic weapon. Domestically, one of the biggest concerns is a cyber attack would target the nation’s electrical grid. “That may be wrong,” Lewis said. “It turns out the biggest target the Russians were interested in was the electoral system. But I think people worry about the electrical grid as being vulnerable and we really don’t know how vulnerable it is. Some (utility) companies do a good job, others don’t. You can’t predict.

5 Ways CISOs Could Work Better with Their Cyber Insurers

Engaging with the information security organization can lead to better premiums by allowing the company to display the security culture that exists in the organization. A top-three broker reported that two airlines with similar cybersecurity postures achieved a 30% differential in the cyber insurance pricing, attributed to the confidence projected by an engaged cybersecurity team in the purchase process and the "culture of security" presented by the CISO. CISOs are an important party in the insurer selection process. For example, a Fortune 2000 technology company was using a leading managed security services provider to oversee its cybersecurity. However, the vendor was not on the insurer's incident response panel. This meant that in the event of a breach, the company would not be reimbursed for the additional breach response costs incurred with the managed security provider.

IT Salary Survey 2017: Tech Pay Holds Tight (For Now)

Executives and analysts have wildly different forecasts for IT hiring and salaries going forward. Based on interviews with dozens of CIOs conducted before and after the 2016 presidential election, management consulting firm Janco Associates in December sharply raised its tech hiring forecast from 90,000 to 136,500 new domestic IT jobs to be created in 2017. “After the election, CIOs were much more optimistic,” says Janco CEO Victor Janulaitis, pointing to the Trump administration’s promises to increase infrastructure spending, revise the tax system, bring jobs back to the U.S. and revamp the H-1B visa program. If those changes are implemented, “there will be greater need for U.S.-based IT resources,” he says

Revealing Secrets with R and Factor Analysis

Factor analysis is a classical statistics technique that examines data that has several variables in order to see if some of the variables are closely connected in some way. One of the standard "Hello World" examples of factor analysis is an examination of user ratings of different films. The idea here is that behind the scenes there are latent, hidden variables, such as movie genre, that explain the observed ratings. ... Another way you could use factor analysis information is to combine the raw variables that correspond to a latent variable, in order to reduce the dimensionality of the source data. The best way to see where this article is headed is to take a look at the screenshot of a demo R script. The script is named FactorDemo.R and starts by setting up and displaying a small 20-item data set of film ratings as just described.

No Quick Fixes For Small Business Cybersecurity

“The average small business owner is what we call trapped in a whirlwind,” Charles Rowe, president of America’s Small Business Development Centers, a trade association, testified before the House Small Business Committee. “They’ve got 5,000 things to worry about, and sometimes this is not the wolf closest to the sled.” Rowe advocated during Wednesday’s hearing for an interagency committee designed to help companies adopt cybersecurity best practices, similar to the Trade Promotion Coordinating Committee, which was created to aid exporters. Jim Mooney, cybersecurity chair of the National Association of Federally-Insured Credit Unions, urged the government to develop national cybersecurity standards for companies similar to those currently required for banks and other financial firms under the Gramm Leach Bliley legislations.

Smart Forensics for the Internet of Things (IoT)

Digital forensics is slowly developing as a solution to this problem. At its core, this brand of forensics is the process of identifying, preserving, analyzing and presenting digital evidence to the court of law. It does so using well-defined principles and accredited tools. IoT forensics has more areas of interest than traditional forensics. In addition to the traditional type of networks — wired, Wi-Fi, wireless and mobile — IoT also has the RFID sensor network. Different IoTware such as appliances, tags and medical devices should be considered as sources of evidence during investigation as well. The main challenge in investigating an IoT crime is introduced by the dynamic nature of IoT solutions. IoT is a combination of many major technology areas, which includes cloud computing, mobile devices, computers and tablets, sensors and RFID technologies. As a result, forensics for IoT will encompass all of these aforementioned areas.

Get ready for 2018’s changes to data protection laws

The GDPR will apply to companies that fall into two broad definitions: ‘controllers’ and ‘processors’. The definitions are similar to those defined in the Data Protection Act 1998 (DPA) in that controllers say how and why personal data is processed, and processors act on the controller’s behalf. If you are a processor, the GDPR will place specific legal obligations and liabilities on you; for example, you will be required to maintain records of personal data and processing activities. If you are a controller, you are not relieved of your obligations where a processor is involved. The GDPR places further obligations on you to ensure your contracts with processors comply with the GDPR. While the principles are similar to those in the DPA 1988, there are some additional requirements that UK companies need to be aware of. The most significant is accountability.

Quote for the day:

"What lies behind us and what lies in front of us pales in comparison to what lies within us." -- Ralph Waldo