The three ‘B's’ of cybersecurity for small businesses
Large-scale cyberattacks with eye-watering statistics, like the breach of a billion Yahoo accounts in 2016, grab most of the headlines. But what often gets lost in the noise is how often small and medium-sized organizations find themselves under attack. In the last year, half of American small businesses have been breached by hackers. That includes Meridian Health in Muncie, Indiana, where 1,200 workers’ W-2 forms were stolen when an employee was duped by an email purporting to come from a top company executive. Many small companies are just one fraudulent wire transfer away from going out of business. There’s lots of advice available about how to fight cybercrime, but it’s hard to tell what’s best. I am a scholar of how businesses can more effectively mitigate cyber risk, and my advice is to know the three “B’s” of cybersecurity: Be aware, be organized and be proactive.
Want to Know What’s in a GC Pause? Go Look at the GC Log!
The evidence presented here suggests that the garbage threads were not active for the vast majority of the pause. If the pause was due to background I/O then the GC threads, captured by the OS, should have accumulated an inordinate amount of kernel time, but they didn't. This all suggests that the GC threads were swapped out, and incredibly, not rescheduled for more than 22 seconds! If our app wasn't paused by the garbage collector then the only possibility is that the JVM was paused by the operating system, even if that doesn't seem to make any sense. Fact is, operating systems sometimes do need to perform maintenance, and when this happens, just as is the case with GC, the OS may need to pause everything else. Just like GC pauses coming from a well tuned collector, OS pauses are designed to occur infrequently and be very brief to the point of hardly being noticed.
Machine Learning Paving The Way For Enhanced Marketing
The key thing to remember is that as you supply machine learning software with more data, it keeps on learning and adapting. Other areas in which a machine learning application can help marketers include: Customer segmentation – Machine learning customer segmentation models are very effective at extracting small, homogeneous groups of customers with similar behaviors and preferences. Customer churn prediction – By discovering patterns in the data generated by many customers who churned in the past, churn prediction machine learning forecasting can accurately predict which current customers are at a high risk of churning. This allows proactive churn prevention, an important way to increase revenues. Customer lifetime value forecasting – CRM machine learning systems are an excellent way to predict the customer lifetime value (LTV) of existing customers, both new and veteran.
Cyber security is a ‘people problem’
While people have long been seen as the weakest link in IT security through lack of risk awareness and good security practice, the people problem also includes the skills shortage at a technical level as well as the risk from senior business stakeholders making poor critical decisions around strategy and budgets. Interestingly, the increase in reported skills shortages contrasts with a decrease in those reporting a lack of experience being a market factor. This suggests that as the industry matures the shortage of experienced, senior managerial professionals will reduce and the problem will be felt most acutely in the hands-on technical disciplines. “The survey highlights the continued need for industry, government, academia and professional organisations like the IISP to continue to work hard to attract new entrants and younger people into the industry,” said Piers Wilson, author of the report and director at the IISP.
Inside Story of Building a Global Security Operations Center for Cyber Defense
In this market, what a lot of our customers see is that their biggest challenge is people. There are a lot of people when it comes to setting up MSSPs. The investment that you made is the big differentiator, because it’s not just the technology, it’s the people and process. When I look at the market and the need in this market, there is a lack of talented people. How did you build your process and the people? What did you have to do yourself to build the strength of your bench? Later on we can talk a little bit more about Zayo and how HPE can help put all of this together. ... But within the SOC, our customers require things like customized reporting and even customized instant-response plans that are tailored to meet their unique audits or industry regulations. It’s people, process and tools or technology, as they say. I mean, that is the lifeline of your SOC.
Cutting through the Noise: Is It AI or Pattern Matching?
At any recent security conference lately, you probably have heard hundreds of vendors repeating the words "We have the best artificial intelligence (AI) and machine learning." If you happened to be in one of those conversations and asked "What does that mean?," you probably got a blank stare. Many security consumers are frustrated when marketing pitches don't clearly articulate what AI does in a product to help protect an environment better. There are several dilemmas facing security companies that keep them from being more up-front about how they use AI and machine learning. For some, the concepts are a marketing statement only, and what they call AI and machine learning is actually pattern matching. Also, machine learning relies on a tremendous volume of data to be effective, and there are very few vendors that possess enough of it to be successful in its implementation.
Blockchain: Overhyped buzzword or real-deal enterprise solution?
While the technology has grown in popularity, mainly because it's the basis for the wildly hyped cryptocurrency and payment platform Bitcoin, many experts are still not sure exactly how it works. Even the founder of Bitcoin, Satoshi Nakamoto, is a shadowy figure and no one appears to know with certainty who he is or if the name is a pseudonym for a group of developers. Nakamoto, however, holds one million bitcoins, or the equivalent to $1.1 billion. Angus Champion de Crespigny, blockchain leader at Ernst & Young, called the technology "overhyped" and said many business applications touted as beneficiaries of its use have regulatory or operational issues that can be difficult to solve via one technology alone. "We're seeing interest in using it to propagate security policies and identity access management, but it's early days.
Microsoft Open Sources React Native-Based Cross-Platform Library
"ReactXP is designed with cross-platform development in mind," its site says, though it promises it will only let developers "share most of your code" among platforms. "With React and React Native, your Web app can share most its logic with your iOS and Android apps, but the view layer needs to be implemented separately for each platform. We have taken this a step further and developed a thin cross-platform layer we call ReactXP." Developer Eric Traut provided more information in a blog post. "It builds upon React JS and React Native, allowing you to create apps that span both Web and native with a single code base," he said. Although it's built on both implementations, an FAQ indicates it borrows more heavily from React Native. ... ReactXP is described as a thin abstraction layer built upon and bridging React JS and React Native.
Are We Ready To Bid The SIEM Farewell?
"A lot of the vulnerability is bad configurations which stem from poor consultancy. These things weren't meant for a huge company," Grigg said. He's hardly pointing the finger at anyone to lay blame, as Grigg said that in his earlier years he had likely provided some bad consultancy. "I started to notice buddies of mine who were really good consultants, and watching them do their work, I thought, 'I probably shouldn't be allowed to touch this stuff'. Unfortunately, It's the norm to have bad consultants," Grigg said. Many companies hire a third party to come in as the 'fix it' people. Those that specialized in SIEM platforms, as Grigg eventually did, found themselves "Fixing what was super messed up," he said. Because so much of the SIEM industry is legacy software that was the same tool just redesigned and rebranded, Grigg said, "Those back doors still exist on there today."
Q&A on The Rise and Fall of Software Recipes
The simplest way to increase value is to implement a policy that ensures that bugs are reproduced in a test case before any attempt to their resolution, so that they can’t happen again without being detected by running the test suite. Not only is the software better by having the bug removed, but the expected behaviour is now formally documented by an executable test case. But there is no such thing as a single best way to debug software. Each software developer has his/her own preferred tool or process to do so. ... When dealing with a buggy piece of software, I add assertions (available in some form in virtually all languages today) that check for the conditions that represent the expected behaviour of the system. I iteratively reduce the scope of my bug (things are all right when entering it, and faulty when exiting it) by adding more and more precise assertions, until I find the source of the problem, and fix it.
Quote for the day:
"A bird isn't afraid of the branch breaking because it's trust is not on the branch, but on it's wings." -- Unknown
