Daily Tech Digest - May 04, 2017

Cloud v. Data Center: Key trends for IT decision-makers

What's driving the move to the cloud? A rich source of data is RightScale's annual State of the Cloud survey, which has tracked the cloud-related activities of enterprises and SMBs for the past five years. When it comes to the perceived benefits of cloud-based computing, the main attractions have consistently been 'faster access to infrastructure', 'greater scalability', 'higher availability' and 'faster time-to-market'. Note also that there's a rising trend for citations of these four key cloud benefits ... There's also a gaggle of secondary benefits, cited by significantly fewer survey respondents (<40%): 'business continuity'; 'geographic reach'; 'higher performance'; 'moving CapEx to OpEx'; 'cost savings'; and 'IT staff efficiency'.


Using AI-enhanced malware, researchers disrupt algorithms used in antimalware

"Many machine learning algorithms are very vulnerable to intentional attacks," add the researchers. "Machine-learning based malware detection algorithms cannot be used in real-world applications if they are easily to be bypassed by some adversarial techniques." Hu and Tan came to this conclusion based on research by Szegedy et al, who were able to bypass malware-detection algorithms using altered information (adversarial examples) that maximized malware classification errors, making it impossible for the detection algorithm to spot malware. The two researchers then proceeded to build on the research of Szegedy et al by proposing the use of generative neural networks and the alteration of original samples to make input and output adversarial examples.


How to Integrate Threat Intel & DevOps

Integrating cyberthreat intelligence (CTI) into a DevOps platform is critical to prevent, detect, respond, and predict cybersecurity threats in a more timely and cost-effective manner. This is true because integration allows automation of everyday tasks such as patch management and vulnerability scanning, allowing employees to turn their attention away from these automated tasks to focus on more complex problems and analyses. At the same time, in our modern, complicated, fast-paced cyber environment, it's difficult to hunt for and find vulnerabilities. Ideally, you will subscribe to threat feeds that have information specific to your systems, networks, or industry, because a power plant operator will want different kinds of threat information than a bank IT team. If your threat feed is specific to your environment, it could help automate the discovery of vulnerabilities and help you prioritize fixes.


Agile development an 'IT fad' that risks iterative failure

One of the key tenets of an agile methodology is that it is an iterative process, where errors can be quickly resolved through continuous improvement. However, according to 6Point6, while fail fast is an intoxicating prospect, in practice, it can blur the distinction between continuous improvement and genuine failure. Specifically, Porter believes in agile projects it is hard to know when an agile project is on the road to ruin. He warned the iterative process may lead to iteratively improving, one failure at a time, towards the wrong outcome. “At no point will this become obvious in the same way it would if you were constrained and measured by a combination of time, budget and scope,” he said.


Blockchain Inadvertently Fuels Cloud Adoption

The biggest and hottest of these catalysts is blockchain—arguably one of the best technologies for the digital age. Blockchain’s inherent strengths have been designed to increase trust and virtually eliminate fraud. Based on algorithms, blockchain technology’s advanced encryption and validation form many independent parts, providing golden distributed ledgers, recorded provenance, and data lineage, as well as numerous benefits for the financial supply chain. Coupled together, blockchain and cloud become a powerful, secure trusted platform. Cybercrime —a constant threat for banks and once seen as a cloud inhibitor—has now also morphed into another catalyst for cloud adoption as banks seek greater security. That’s because core banking technology was originally based on paper and customers without mobile phones—a model that’s no longer applicable or tenable.


Smart Cities Are Going to Be a Security Nightmare

Simply put, smart cities rely on interconnected devices to streamline and improve city services based on rich, real-time data. These systems combine hardware, software, and geospatial analytics to enhance municipal services and improve an area’s livability. Inexpensive sensors, for example, can reduce the energy wasted in street lights or regulate the flow of water to better preserve resources. Smart cities rely on accurate data in order to properly function. Information that has been tampered with can disrupt operations — and constituents’ lives — for days. Several cities have adopted smart technologies, applying artificial intelligence to accelerate their transition into the future. In Barcelona, smart water meter technology helped the city save $58 million annually. In South Korea, one city cut building operating costs by 30% after implementing smart sensors to regulate water and electricity usage.


Artificial Intelligence: 10 influencers driving AI in business

As we move ever further into the age of machine learning and artificial intelligence (AI), we see more and more companies and AI influencers turning towards this technology in an effort to streamline their customer experiences, reduce their costs, or just wishing to push the boundaries. New research from Axelos and PRINCE2, found that 60% of IT professionals believe that machine learning and AI will have a huge impact on project managers, and that 59% believe automation will replace many routine PM tasks, and this is just one job. But what about the people driving this industry? Who are the most influential people currently making a splash in the field of AI? Take a look at CBR’s list of the top 10 AI influencers that you should be looking out for.


Credit unions look to blockchain to solve digital identity crisis

The concept of self-sovereign identity promises to give individuals their own digital existences apart from any company or government. Perhaps Descartes could be sure of himself simply as a result of his own cognition, but people's identities online are fragmented, out of their control, spread across countless proprietary platforms. Mark Zuckerberg could erase anyone's Facebook identity tomorrow if he chose. ... If people could be in control of their own digital identities, and the public keys to those identities could be stored securely and cheaply on a blockchain, "all of a sudden now the bank doesn't have to build an identity system, yet they get identities that are more trustworthy than they got when they were building their own," said Phillip Windley


Industrial robots that build cars can be easily hacked

"If these robots are welding a car chassis together or a wing on an airplane, two milimeters can be catastrophic,” said Mark Nunnikhoven, the vice president of cloud research at Trend Micro.
 Robot controllers, which are typically handheld screens with buttons that are used for operating or programming the machines, are also often remotely accessible through the internet, and those internet connections are not always secure. It was through unsecured network connections that the researchers were able to alter the configuration file in the ABB robot that caused it to draw the line wrong in their tests. The researchers said robots from other manufacturers had similar security holes, but ABB was the only company that lent the team a robot to test for vulnerabilities. Many of the industrial robots probed also had security issues with how users were authenticated to access them.


How the insurance industry could change the game for security

The cyber insurance industry doesn't have anywhere near the kind of deep expertise as, say, property and causality, life insurance, or automotive. "You'd think they'd take their actuarial knowledge, analytical knowledge and amass a ton of information about the claims they paid out, what the underlying causes were, so they can improve their policies," he said. "And the reality is, they haven't." Instead, the industry is struggling with a dramatic shortage of personnel and a problem with getting good actuarial data. "Most people writing cyber insurance don't have technical backgrounds," he said. "They come from writing some other type of property and casualty insurance. They need to hire better people -- and collect more data."


Is Your Small Business Ready For a Data Breach?

Your online presence is the face you present to the world. The information needs to be accurate. The branding needs to be consistent. It needs to be in line with your business strategies. And it needs to protect the customers who place their trust in you. That’s especially true when it comes to data breaches. Having digital integrity in the context of data breach means that you are protecting your prospect and customer data from a number of bad actors trying to steal it. In 2015 alone, almost 160 million records containing sensitive information were compromised. And if you think you’re too small to be a target, you’re wrong. Small businesses are the target of 43% of all cyber attacks. Most criminals understand that small businesses don’t have the resources to enact security on the same level as a large enterprise. Unprepared businesses are the proverbial low-hanging fruit.



Quote for the day:

"Many people mistakenly think a new technology cancels out an old one." -- Judith Martin

Daily Tech Digest - May 03, 2017

How Microsoft Plans To Reinvent Businesss Productivity

Intentional Programming was Simonyi's idea for making development easier for non-developers using domain-specific languages that describe all the details of an area of expertise, whether that’s marine engineering or shoe manufacturing. “The Intentional platform can represent domain specific information both at the meta-level (as schemas) and at the content level (as data or rules),” Simonyi notes in his rather vague explanation of the acquisition; it’s all about moving from generic applications that help anyone create a generic document like a letter or an invoice, to much more specific systems that incorporate rules and definitions but are still as easy to use as Word and Excel. An expert in pensions, for example, could write down the details of a pension contract as mathematical formulas and tables and test cases in text descriptions


Self Contained Systems (SCS): Microservices Done Right

It is important that an SCS does not just handle a specific domain object. For example a SCS for customer data does not make a lot of sense: There will be customer data in many different Bounded Contexts. So coming up with a single model for a customer and implementing it in a separate SCS is not possible. Even if it was, each system will use customer data and so there will be too many dependencies to that system. This is also the reason why the split into SCS should be motivated by user stories, Bounded Contexts or the user journey - this top-down-approach will lead to a set of decoupled systems. While it might make sense to identify common parts later on, this should not be the focus. Common logic might be separated in a different system, but that means that the SCSs will have a dependency on the common system, which means that they not that decoupled any more.


Cyber Security in Belfast: An Industrial Reinvention

Northern Ireland’s investment in CSIT and in developing a robust cyber security talent pool has already reaped significant dividends. An ultra-competitive recruitment market has driven U.S. tech companies to look overseas for talent, and Northern Ireland has taken advantage. Companies have been pouring into the area over the last few years enticed by the hard-to-find skillsets being nurtured at Queen’s and Ulster University. For instance, before making its decision on where to expand its Center for Open Source Research and Innovation, Massachusetts-based Black Duck advertised positions it was seeking to fill in both Boston and in Belfast. The result? Belfast produced five times as many qualified applicants as the U.S.


Is It Safe to Preserve Data in The Cloud

Eventually, it seems, that even the most secure organization can be infiltrated. As a result, organizations should also have a corruption detection and prevention system. Of course data stored in the cloud should be stored or sent to the cloud in such a way that a company can recover from any corruption or accidental deletion, and make it harder to accidentally delete cloud data, and the data must also be proactively monitored for corruption or attacks. Most cloud vendors do have the ability to have multiple copies of data in different geographies. However this is more of a HA rather than a preservation function as typically snapshot integration is not native nor simple in the cloud across tiers and across clouds. Traditional cloud vendors also do not yet support WORM functionality that could prevent accidental or malicious deletion or corruption of data, nor do they support automated integrity checks of the data.


In the digital era, CIOs not buying ‘this bimodal crap’

The CIOs say there were some bumps along the way, but nothing unexpected, while trying to cajole IT workers to unlearn years of learned processes. Management buy-in is also essential for success. "We have people who understand our business and secret sauce but they’ve been doing things a different way for 20 years," Shurts says. "They get excited about agile, they see that it’s better but then we do a pilot and it’s a lot harder than they think. They really want to do it but they have to unlearn habits learned over 20 years… The good news is we’re getting through that and we’re starting to see innovation and really good results." Schulze says people may need to be retooled because they were successful learning how to do IT in a certain way but success will ultimately hinge on having the right culture and mindset to facilitate change.


IoT Security Concerns

When looking at all of the different ways that IoT devices can be modified to do bad things a few different ideas come to mind in terms of risk. How easy is it for a non-authorized user to gain access to a given device and what kind of device is it? If the device is a network router, that is a big problem. If the device is a water sensor and you need a lot of networking equipment to do it, then the risk can be classified as a low risk. How an IoT device is modified is also a problem. If the IoT device is hacked in such a way that it becomes unusable, because the code ran out the the battery power that is a bigger deal than say an IoT device which can be fixed by sending it a reboot. Knowing something about the people involved and the process used to gain access can help assessing risk. There are also broadly speaking three classifications of users who work on accessing things which they don’t have access.


Microsoft will separate Edge from OS updates

It’s no secret that Microsoft’s Edge browser, the revamped browser that shipped with Windows 10 as a replacement for Internet Explorer, is struggling to gain any sort of traction. As IE fades rapidly, Google Chrome has been picking up share while Edge remains stubbornly at 5%. As I illustrated last week, Edge doesn’t really have one (and edge, that is). It’s painfully slow. I should not be able to watch a website load piece by piece in 2017 on a broadband connection. Much of the problem stems from the fact that Edge updates are tied to operating system updates. So Edge doesn’t get an overhaul until Windows does, and that has only really happened twice, with the Anniversary and Creators Updates. Compare that to Chrome, which seems to get a new build every week.


Making Sense Of Cybersecurity Qualifications

It’s a growing problem for many employers. Increasingly, hiring companies must sift through resumes that tout cybersecurity-related degrees, certificates, industry certifications, apprenticeship credentials, digital badges, micro master’s degrees, nanodegrees and other credentials – trying to determine what a candidate really knows and how those credentials fit together. The influx of credentials is causing plenty of confusion for students, employers, policymakers and for the certifying organizations themselves, says Holly Zanville, senior adviser for credentialing and workforce development Lumina Foundation, a private group focused on increasing success in U.S. higher education. “It used to be that most of these [credentials] would be awarded by colleges and universities, but not anymore,” Zanville says.


Serverless Takes DevOps to the Next Level

Function-as-a-Service (FaaS) provides a managed runtime for executing any arbitrary code that has been uploaded to this service. This may look identical to just deploying a runnable artifact onto a compute instance (server) and having an operating system execute it but it’s not. FaaS takes care of making the function available at the scale required to satisfy the current demand but only charges for the execution count and time. At the same time it abstracts away the setup of the actual runtime (like JVM or NodeJS) and the operating system itself. ... And that’s the beauty of it - the entire compute stack is completely managed by the cloud provider, including the OS process running the function code. This simplifies the management of the compute infrastructure immensely, and combined with a pay-as-you-go billing model, offers an incredibly flexible and cost-effective compute option, compared to a more traditional Infrastructure-as-a-Service (IaaS) compute model.


Financial Services Sector the #1 Target of Cybercriminals

"The primary goal is money," says Dave Hylender, senior network engineer at Verizon. "That is the driving force behind most of these attacks." Financial services organizations cut the intermediary step between cybercriminals and the funds they seek. Hackers can obtain troves of data in attacks on healthcare organizations, but they have to take additional steps to monetize that information and open fraudulent accounts. However, money is more easily accessible if you can get malware onto bank systems, he explains. Threat actors can access usernames and passwords, withdraw money, and create fake debit cards, among other illicit activities. "Financial services targets will always be a lucrative reward if successfully compromised," says Michelle Alvarez, threat researcher at IBM X-Force. "Healthcare and retail targets can be profitable



Quote for the day:


"An intellectual is a man who says a simple thing in a difficult way; an artist is a man who says a difficult thing in a simple way." -- Charles Bukowski


Daily Tech Digest - April 27, 2017

Folks are fantasizing about Amazon's Alexa

“A deeper emotional attachment is starting to develop,” Mindshare writes. It says this increasing attachment is caused by improvements in understanding of the user, by the virtual assistant. Affinity increases the more the voice assistant understands the user. Artificial Intelligence (AI) improvements are behind those recent gains, and the user understanding is likely to increase as AI continues to improve over time. People like thinking they’re conversing with a genuine person when they talk to the devices, Mindshare says. According to its research, 70 percent of those interviewed want that. In addition, the report says, “Over a third (37 percent) of regular voice technology users say that they love their voice assistant so much that they wish it were a real person.”


How one organisation’s incident can become everyone’s defence

The Quantum Dawn exercises are one component of Sifma’s comprehensive work with its members on a variety of cyber security initiatives. These exercises create a cross-departmental incident response focus that is tough to achieve in daily business operations.  For example, the cyber security team at a given bank may understand their realm extremely well, but may not fully understand how payment processing in their bank works and the impact if payment processing functions are attacked as part of a sophisticated criminal enterprise targeting the bank. But through such collaborative exercises, each department understands its roles and responsibilities. Rapid and accurate communication is key. Indicators of compromise discovered during the early parts of an attack may trigger specific parts of the incident response playbook.


The Long Slog To Getting Encryption Right

According to the Ponemon study, enterprises' focus on encryption and key management is being spurred on by increased cloud adoption as more data moves into third-party data centers. Approximately 67% of organizations report that they either perform encryption on premises prior to sending data to the cloud or encrypt data in the cloud using keys they generate and manage on premises. An additional 37% also report that they encrypt some cloud data using methods that turn complete control of keys and encryption processes to the cloud provider.  This most recent study doesn't offer a fine point on how much data is going to the cloud completely unencrypted--but data out in 2016 from HyTrust showed that number to be pretty alarming. According to that study, about 28% of all data within all cloud workloads remain unencrypted.


How to implement DevOps: 5 tips for doing it right

The benefits of DevOps are clear: High-performing organizations deploy 200 times more frequently, with 2,555 times faster lead times, according to a study of more than 25,000 tech professionals from Puppet and DevOps Research and Assessment. High-performers are also twice as likely to succeed with product deployments without service impairments or security breaches. And when something does go wrong, they can fix it 24 times faster. "Tons of evidence showed us that [with DevOps], you can go more quickly and be more reliable at the same time," said Gene Kim, co-author of the report, and co-author of The DevOps Handbook. Here are five tips to help make sure your DevOps implementation reaps the maximum benefits.


Profiling The Insider Threat - Breaking Down a Complex Security Term

Frustration turned to anger, and after trying time and time again to get the company’s attention, Dave took it upon himself to destroy the software just to prove a point. This kind of situation is more common that usually thought: broken promises, the undervaluing of an employee’s opinion, and not heeding sensible advice can often result in those on the frontline of development to lash out against the company. In order to detect situations like Dave’s, the first line of defense is often looking out for the human signs of an unhappy employee. If this fails, then companies need to turn to technology to look for behavior on the network that is out of the ordinary. ... It’s also important to note that your data needs to be monitored at all time: while at rest, while it’s moving, and data in use for policy violations.


Are you prepared for a corporate crisis?

Understandably, companies spend more time trying to prevent crises than preparing for them. However, crisis readiness has become at least as important as risk management, takeover readiness, and vigilance over safety. Underpreparedness has consequences and helps explain why companies engulfed by a large crisis initially underestimate the ultimate cost by five to ten times.2Senior executives are frequently shocked by how quickly a problem can turn from a minor nuisance into an event that consumes and defines the company for years to come. ... When a crisis hits (or is about to hit), one of the first actions should be to create a cross-functional team to construct a detailed scenario of the main primary and secondary threats, allowing the company to form early judgments about which path the crisis may travel.


Hyundai app exposed vehicles to high-tech thieves

"The issue did not have a direct impact on vehicle safety," said Jim Trainor, a spokesman for Hyundai Motor America. "Hyundai is not aware of any customers being impacted by this potential vulnerability." The bug surfaced as the auto industry bolsters efforts to secure vehicles from cyber attacks, following a high-profile recall of Fiat Chrysler vehicles in 2015 and government warnings about the potential for car hacks. Risks have multiplied in recent years as vehicles have grown more complex, adding features like mobile apps that can locate, unlock and start them. "What's changed is not just the presence of all that hackable software, but the volume and variety of remote attack surfaces added to more recent vehicles," said Josh Corman, director of the Atlantic Council's Cyber Statecraft Initiative.


Systemic cybersecurity crisis looms

Because it is highly probable that an organization will fall victim to a data breach at some point, it is wise to be as prepared as possible for that attack. Having a cybersecurity program in place can minimize the damage. Similar to insurance, companies without an effective plan in place will pay a premium, facing both financial and reputational repercussions. That said, cyber insurance providers have emerged with nearly 70 carriers on the market now. However, given the evolving nature of technology, an organization’s network, systems and methods for securing these assets change, which means their cyber risk changes. As a result, determining the appropriate policy is challenging. Additionally, the cyber insurance market is brand new, so the offerings are questionable at best. It is much more advisable to focus on implementing and maintaining a strong security program instead.


How to share your Power BI dashboards and reports

The key thing to remember about Power BI sharing is that it is domain based. In other words, if my Power BI dashboard is created under the markwkaelin.com domain, it can be shared only with other email addresses in that domain. It is important that the enterprise IT department and Office 365 administrators understand this limitation and plan accordingly. To share a dashboard, first open Power BI. In this example, I am using the Office 365 version. Next, navigate to the dashboard you want to share. Right-click the dashboard name in the navigation panel or click the Share button on the tab bar in the upper-right corner. Either method will take you to a screen where you can list the email addresses of the people you want to share this dashboard with in your enterprise.


After early hype, smartwatches slowly emerge with enterprise uses

Workers already wear smartwatches on the job for quick access to notifications and emails, as well as an array of personal fitness data. Also, some employers are giving workers smartwatches for specific tasks, Ubrani said. Among the workplace uses for smartwatches, enterprise software company SAP has made mobile apps available for Apple Watch and Samsung smartwatches for more than a year, but it isn't clear how widely they have been deployed. In 2015, one ambitious concept design detailed how a medical device service technician could check the status of repairs on an Apple Watch with the SAP Work Manager app. The success of that project isn't known. A more recent example is the Salesforce Wave Analytics app, which works with the iPhone and the Apple Watch to provide sales reps and managers with current data on their customer accounts.




Quote for the day:

"Our minds can be convinced, but our hearts must be won." -- Simon Sinek


Daily Tech Digest - April 26, 2017

Does IT Industry Need Better Namings?

In almost every software team there are members titled as quality engineers (QA). Their role is mainly to understand the specifications and based on them define a set of test cases in order to validate the product and to detect possible flaws. If we search what QA and QC mean by looking at the definitions, we see that a QC is "an aggregate of activities (such as design analysis and inspection for defects) designed to ensure adequate quality especially in manufactured products", whereas the QA is "a program for the systematic monitoring and evaluation of the various aspects of a project, service, or facility to ensure that standards of quality are being met", as per merriam-webster.com definitions. Based on these definitions, people embedded in software development teams in charge of defining test cases and validating the product are more QC engineers. This might cause problems.


7 Patch Management Practices Guranteed To Help Protect Your Data

You can’t secure what you don’t know about. The only way to know if a breach or vulnerability exists is to employ broad discovery capabilities. A proper discovery service entails a combination of active and passive discovery features and the ability to identify physical, virtual and on and off premise systems that access your network. Developing this current inventory of production systems, including everything from IP addresses, OS types and versions and physical locations, helps keep your patch management efforts up to date, and it’s important to inventory your network on a regular basis. If one computer in the environment misses a patch, it can threaten the stability of them all, even curbing normal functionality.


Building An App-Centric Infrastructure Performance Monitoring System

Achieving synergy between applications and infrastructure is more than just blending disparate management regimes. A functioning application-centric environment requires enterprise executives to make changes to their current ecosystem on both a systems and an operational level. This can be difficult for organizations that maintain substantial legacy infrastructure geared toward conventional data workloads. One of the first things to do is to stop depending on silo-specific tools. When application requirements were fairly predictable, it was common for organizations to provision infrastructure to support the most demanding circumstances, even if that resulted in over-provisioned resources that would sit idle for long periods. This also often led to isolated application and infrastructure environments within the datacenter ecosystem as solutions were crafted to solve unique challenges at particular times.


Lessons from the Field: The Adaptable Business Architect

Business architects (BA's) have to interact with so many different stakeholders that staying out of turf wars can be difficult. Strategy development teams may question why you want to hear about their strategies. Business process teams may push back against capability modeling as being redundant with process optimization efforts. Other architecture teams may be challenged by your very existence. And of course consulting firms will pop up everywhere and claim they can do everything. Avoid turf wars at all costs and stay away from decision rights conversations. (See my previous post on being politically savvy.) In most companies, there is plenty of work to get done, so leveraging the time and talents of other teams is crucial to making progress. Get these teams involved, make them part of what you are doing, and help them to see the business outcome you are striving for. \\


What life after the smartphone will look like

Life after the smartphone will be wondrous. We’ll be amazingly productive. Our faces won’t be filled with light, our fingers won’t be a chaotic symphony. We won’t be strangled by USB charging cables. We'll never have nomophobia. As you could probably guess if you’ve read this column lately, you know that smartphones will be replaced by artificially intelligent bots. They already live among us. Soon, they won’t run on our phones or laptops. They will just run. They will exist in the cloud, at your office, in your car, and everywhere you happen to need help and stay productive. First, they need to get a lot smarter. A companion bot will follow you constantly -- sometimes literally. You’ll talk to the bot, but simple tasks like asking about the weather or the Golden State Warriors playoff schedule will seem trite.


Top 3 CIO priorities for addressing today’s data deluge

With greater amounts of data comes larger challenges in understanding the lineage, quality and relationships between data from multiple sources and of different types. And CIOs arguably struggle more than ever to effectively manage and analyse data to make it actionable. At one company the hype about machine learning had executives excited about using proprietary algorithms to gain competitive advantage. A data scientist was hired and told there are years’ worth data stored in Amazon S3, and was tasked with figuring out how to drive innovation with it. Unfortunately, there was no metadata to show where the data came from and how the data lake integrated with the rest of the company’s data. There was also no infrastructure for data analysis, forcing the data scientist to try to find tools compatible with the technology stack and install them.


A Tutorial For Enhancing Your Home DNS Protection

Traditional DNS has weaknesses like that. With certain types of DNS attacks an adversary can make you think you are going to a favorite website but can re-direct you to a bad one, perhaps to steal your login info or to download malicious code. This is another very important reason to use a managed DNS service. There are cautions to consider when selecting a DNS provider. Some DNS providers collect information from you in ways that may creep you out. For example, if you select the free DNS service from Google, although there are privacy protections, they will be aggregating even more data on you and your browsing habits. It is free and offers protection and is backed by a company with incredible engineers, but you will give up some info you might want kept private.


Continuous Integration & Collaboration in Code Repositories for REST API Docs

Writing documentation can be downright boring sometimes, but great documentation is an excellent precursor to increased adoption of an API. Writing excellent documentation is as exacting as the code itself. There are syntax errors and unwanted whitespace that you can introduce. Sometimes your ideas simply stop flowing, but you still need to fill in the blanks to make sure your documentation is complete. With the growth of APIs as products, your documentation is more important than ever in order to create a successful API. API definitions and documentation go together, and while API specifications today are increasingly managed as code in GitHub, the API docs are not. Let’s change this to make the standard to write and manage API documentation, including related web sites, in GitHub and related code repositories.


6 Things To Look For In A Clouid Consultant

We all know personal hygiene habits that we’re supposed to have, but probably don’t practice consistently (did you really floss three times yesterday?). And there are social behaviors that we really look out for – and probably even judge people on. But when it comes to IT habits, most organizations don’t seem be screening consultants for key behaviors and policies. This is not a good state of affairs because IT habits and internal policies make a material difference to the likelihood of project success.  The short list of policy issues below should be part of any screening criteria for cloud consultants, in general, and Salesforce consultants, in particular. Now, it’s not essential that a consultant comply with every item on the checklist below, but wherever policies diverge from these, it’s an opportunity to engage in a healthy conversation … before you sign.


Russian Hackers Use OAuth Fake Google Apps To Phish Users

Victims that fall for the scheme will be redirected to an actual Google page, which can authorize the hacking group's app to view and manage their email. Users that click “allow” will be handing over what’s known as an OAuth token. Although the OAuth protocol doesn't transfer over any password information, it's designed to grant third-party applications access to internet accounts through the use of special tokens.  The OAuth protocol may have been designed for convenience, but security experts have warned it can be used for malicious effect. In the case of Fancy Bear, the hacking group has leveraged the protocol to build fake applications that can fool victims into handing over account access, Trend Micro said.



Quote for the day:


"Life is a mystery. You never know which small decision will make the biggest difference." -- @Leadershipfreak


Daily Tech Digest - April 24, 2017

Why Your HR Department Should Embrace Design Thinking

Design succeeds when it finds ideal solutions based on the real needs of real people. In a recent Harvard Business Review article on the evolution of design thinking, Jon Kolko noted, "People need their interactions with technologies and other complex systems to be simple, intuitive, and pleasurable. Design is empathic, and thus implicitly drives a more thoughtful, human approach to business." When done well, human centered design enhances the user experience at every touch point, and fuels the creation of products and services that deeply resonate with customers. Human centered design is foundational to the success of companies like SAP, Warby Parker, and AirBnB. ... To delight employees, Cisco has identified "moments that matter" -- such as joining the organization, changing jobs, and managing family emergencies -- and redesigned its employee services around these moments.


Healthcare Records For Sale On Dark Web

In addition, the majority of software developers and system administrators are not accustomed to working in an environment containing federally regulated information such as ePHI, Copolitco wrote. Security controls may chafe developers as they have to adjust how they do things. “All companies who have a compliance obligation must remember that the point of HIPAA compliance is to impose a certain level of security, said Reed. “Security is the ultimate goal, not necessarily compliance. Compliance comes as a result of having a good security program. Being compliant does not mean you are secure; it merely means you have 'checked the boxes.'” An HHS Office for Civil Rights official stated at the recent HIMSS and Healthcare IT News Privacy & Security Forum in Boston that the organization will be conducting on-site audits of hospitals in 2017 and that OCR is engaged in over 200 audits at the moment.


Coffee With a Data Scientist: Avkash Chauhan

No matter what I have done throughout my career "data" has always played a very important part. Over the years, I've recognized how data has transformed the business and engineering part of development. Machine learning is no longer limited to large enterprises, and smaller companies are ready to get involved and take advantage of its benefits. Also, with the proven results from deep neural networks in various fields, it is clear that this is the time when machine learning and deep neural networks will play a very important role in technology going forward. I suppose my interests in data science are very well timed for the rise of machine learning. It is certain that technology changes everything time and time again, and for every programmer, self-transformation is an important step to keep relevant and competent in an ever-changing field.


The Hardest Thing About Doing a Startup

I have found the ‘N+1 Syndrome’ to be the most common reason, especially among accomplished professionals who are doing well in their current gig. The thinking goes like this: You are earning well, you have a good name at work, your families are comfortable, and most importantly, you get that nice paycheck at the end of the month! Yes, you have this exciting idea, the thought of not reporting to a stupid boss is enticing, the lure of hitting that IPO jackpot, becoming famous, and retiring by the time you are 40 is tantalizing! You are going to do it, yes! No-one is better qualified! You will just get this one little thing out of the way, and then you are set! Most even have excellent ideas for the new business, but somehow they keep moving the start date forward by a year, then another year, and another.


Google Says Machine Learning Chips Make AI Faster and More Efficient

For context, CPUs, or central processing units, are the processors that have been at the heart of most computers since the 1960s. But they are not well-suited to the incredibly high computational requirements of modern machine learning approaches, in particular deep learning. In the late 2000s, researchers discovered that graphics cards were better suited for the highly parallel nature of these tasks, and GPUs, or graphics processing units, became the de facto technology for implementing neural networks. But as Google’s use of machine learning continued to expand, they wanted something custom built for their needs. “The need for TPUs really emerged about six years ago, when we started using computationally expensive deep learning models in more and more places throughout our products.


Why There Is No API Security

To understand why APIs inherently lack security, you must understand that API exploits attempt to compromise the application in one of two ways. The first is through application programming errors that attempt to reveal data or impair the operation of the application. These exploits manifest themselves through malicious inputs like SQL injection, cross-site scripting, and other such attempts at exposing data. Generally, applications can be secured against programming errors. This is often an iterative approach that can take months to years of use, testing, patching and retesting, but it can be done. The second avenue is through attempts to exploit the business logic of the application to create unauthorized access or fraudulent transactions. The harder portion to identify and stop are the exploits of business logic. Applications are being designed to deliver micro-services which expose a large number of interfaces to the Internet.


An untold cost of ransomware: It will change how you operate

Even if the backup looks promising, there is no easy button. The people creating ransomware know that backups can stand between them and their payday. There are a lot of cases where Microsoft Volume Shadow Copies have been destroyed by ransomware. If you leave your backups online so you can have quick recovery, you may find that ransomware can actually delete or corrupt your backups. This is not uncommon; ead the user groups from various backup companies and you’ll see the sad tales of woes. If you are not concerned enough, there are other potential dangers to your backups. They need to be airlocked from systems your users have access to. Before you bring your backups online, make sure the affected computers are off of the network. You need to be absolutely certain that those systems can’t access the backup.


Researchers build a microprocessor from flexible materials

TMDs are compounds composed of a transition metal such as molybdenum or tungsten and a chalcogen (typically sulfur, selenium or tellurium, although oxygen is also a chalcogen). Like graphene, they form into layers. But unlike graphene, which conducts electricity like a metal, they are semiconductors, which is great news for flexible chip designers. Stefan Wachter, Dmitry Polyushkin and Thomas Mueller of the Institute of Photonics, working with Ole Bethge of the Institute of Solid State Electronics in Vienna, decided to use molybdenum disulfide to build their microprocessor. They deposited two molecule-thick layers of it on a silicon substrate, etched with their circuit design and separated by a layer of aluminium oxide. "The substrate fulfills no other function than acting as a carrier medium and could thus be replaced by glass or any other material, including flexible substrates," they wrote.


CIO Jury: 50% of tech leaders are implementing DevOps

DevOps implementations also vary from company to company. At business law firm Benesch, Friedlander, Coplan & Aronoff LLP, "I think the real focus is on agile communication and client outcomes, versus delivery," said CIO Jerry Justice. "[It's about] creating a solid feedback loop so you can adjust targets and timings." However, not all companies are ready to fully jump on board the new workflow. While Simon Johns, IT director at Sheppard Robson Architects LLP, said the firm has yet to implement DevOps, he also said that "there are elements of the 'philosophy' I would like to introduce into our workflows—build fast, fail fast type of situations." David Wilson, director of IT services at VectorCSP, said he doesn't plan to implement the workflow. "After nearly 30 years of IT experience, I doubt any of those large software companies are really investing in this," Wilson said.


Securing Risky Newok Ports

While some network ports make good entry points for attackers, others make good escape routes. TCP/UDP port 53 for DNS offers an exit strategy. Once criminal hackers inside the network have their prize, all they need to do to get it out the door is use readily available software that turns data into DNS traffic. “DNS is rarely monitored and even more rarely filtered,” says Norby. Once the attackers safely escort the data beyond the enterprise, they simply send it through their DNS server, which they have uniquely designed to translate it back into its original form. The more commonly used a port is, the easier it can be to sneak attacks in with all the other packets. TCP port 80 for HTTP supports the web traffic that web browsers receive. According to Norby, attacks on web clients that travel over port 80 include SQL injections, cross-site request forgeries, cross-site scripting, and buffer overruns.



Quote for the day:


Leadership: "If you are not building for the long term you are doing the wrong thing." --@Bill_George