Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - May 13, 2017

The Cybersecurity Legacy of James Comey

Cryptography expert and cybersecurity author Bruce Schneier suggests Comey, as leader of the FBI, should have spent more time building the bureau's cyber forensics skills rather than advocating for an encryption bypass. Cyber forensics skills, Schneier contends, have been lacking at the FBI for a generation. "They had 20 years of not having to learn real forensics, and that's the average career length of an FBI officer," he says. "Comey has no legacy here. He didn't do anything good or bad." But the Council on Foreign Relation's Knake says Comey has left his mark on the FBI beyond the encryption battles. In some respects, Comey's leadership help foster improved cooperation with the private sector on cybersecurity.

Major ransomware attack hits hospitals in England, shutting down IT systems

Hospitals across England have been affected, including those run by East and North Hertfordshire NHS trust, Barts Health in London, Essex Partnership university NHS trusts, the university hospitals of Morecambe Bay NHS foundation trust, Southport and Ormskirk hospital NHS trust and Blackpool teaching hospital NHS foundation trust, as well as GP surgeries in Manchester and Liverpool. "We are experiencing a major IT disruption and there are delays at all of our hospitals. We have activated our major incident plan to make sure we can maintain the safety and welfare of patients," Barts said in a statement. Barts, East and North Hertfordshire NHS trust and Colchester General Hospital are postponing all non-urgent appointments for today, with Barts also diverting ambulances to neighbouring hospitals.

Blockchain exchange bids to disrupt artworks trading

Blockchain technology promotes transparency and therefore makes it more difficult for dishonest actors to play their games. We don’t expect changes to happen overnight, but we believe that the art finance industry needs to be more open and fair, and blockchain technology is a step in the right direction. ... This didn’t resonate much with our audience, and very quickly we realised that we had to focus on the core value proposition and not so much in how the technology works. Talking about the issues we address creates much more engagement than explaining how we address them. ... One of our goals is to democratise access to fine art. We believe that by significantly lowering the barrier of entry to art investment combined with transparency, openness and a seamless user experience we will see a much wider audience participate in the art market.

Q&A with Paul Daniels and Luis Atencio on RxJS in Action

RxJS is ideal for software that needs to handle inputs that come in from multiple angles such as lots of user input, API calls, websockets, etc., all coming in at once and factoring into your business logic. When faced with such a heterogeneous data set, RxJS is powerful in that it can easily consume and consolidate these event streams under a single programming model. If you don't have such a need. In other words, if the level of user interaction is minimal, or your data is driven from a few database calls, then RxJS may be overkill. ... Building banking software is no different than any other application. With Observables like functional programming you want to think about what the input to your program is and what the output is.

Hybrid IT Has Arrived: John Lombard, CEO, Dimension Data APAC

In the world of hybrid IT, companies are acquiring capabilities from a variety of different sources. Some may be provided by the in-house IT department, and some might be software-as-a-service (SaaS) applications such as Salesforce. It’s likely that much of it will be infrastructure-as-a-service, delivered from cloud providers. Now the burning question is: ‘How do I bring these services together securely, and deliver a single cohesive experience to my customers and employees?’ This will in turn affect the way employees communicate and collaborate with each other as we see the emergence of countless different tools and offerings by vendors to address these demands. In fact, holographics, augmented reality, and virtual reality will also begin to move from B2C into B2B as well – driving a fundamental transformation of the workspace.

Playing the Networks Game Successfully with SD-WAN and NFV

With ongoing shifts and developments in technology capabilities, software is no longer constrained by the structure that delivers it and networks should not have these constraints either. In a world where users can get started on a cloud platform in minutes, we need technology that connects us securely to that cloud within seconds, making SDN key to building networks of the future. SDN is an enabler of innovation, allowing enterprises to develop new kinds of applications, services and business models, thereby creating new streams of revenue for the company. Dynamic network services support businesses viably because they can be used on a per-consumption basis and can be deployed as a trial service first. This means enterprises can now manage technology investments in a more cost-effective way, taking the necessary time they need to get used to the idea and run projects, as opposed to making upfront heavy investment in technology.

Artificial Intelligence: Cybersecurity Friend or Foe?

We as an industry also will see the growth of cross-platform autonomous malware designed to operate on and between a variety of mobile devices. ... This new variant of autonomous malware includes a learning component that gathers offensive intelligence about where it has been deployed, including the platform on which it has been loaded, then selects, assembles and executes an attack against its target using the appropriate payload. Transformer malware is being used to target cross-platform applications with the goal of infecting and spreading across multiple platforms, thereby expanding the threat surface and making detection and resolution more difficult. Once a vulnerable target has been identified, these tools can also cause code failure and then exploit that vulnerability to inject code, collect data and persist undetected.

Trump Finally Signs Cybersecurity Executive Order

The executive order calls on the secretaries of commerce and homeland security, working with other agencies, to assess the scope of efforts to train the American cybersecurity workforce, including cybersecurity-related education curricula, training and apprenticeship programs, from primary through higher education. ... "One key to this [executive order] is a robust federal cyber R&D program through the academic community to educate and cultivate a pipeline of next-generation computer scientists and front-line defenders, as well as the tools and technologies to support them," says Signal Group Executive Vice President Greg Garcia, a former DHS assistant secretary for cybersecurity and communications.

Six Ways CIOs Can Drive Digital Transformation

Digital transformation can’t be accomplished in a silo. Currently, the bulk of the work is carried out by IT teams—without the involvement of cross-function teams within the company. The focus on IT is partially because they were cited by 53 percent of Forbes and Hitachi’s survey respondents as the most prepared for digital transformation. Only a third of the survey respondents viewed other company functions as ready. Instead of focusing solely on IT for digital transformation, companies should empower IT teams to collaborate with other departments on ways to digitize their systems. By partnering with other departments, IT teams can make an efficiency and revenue impact across the organization. If digital transformation continues to live in a silo, its effectiveness will remain limited.

The Future Of Data Monetization

Banks and credit card companies hold a wealth of data around their customers’ financial habits that are invaluable to retailers in particular. They have access to real transaction data – what consumers actually do, as opposed to just what they say they do. Their information can help to build a complete consumer profile, revealing where and when customers are spending money, where they go on vacation, when they are moving house, insurance information, and so forth. Retailers can leverage this in a variety of ways, from predicting sales volumes so they can adjust supply accordingly, leading to lower inventory costs and a more efficient supply chain, through to target relevant promotions according to location and trends. Another industry holding data particularly useful to retailers is telecoms.

Quote for the day:

"The way to success is strategically along the way of least expectation and tactically along the line of least resistance." -- W. Sherman

Daily Tech Digest - May 10, 2017

Using OpenStack: Leveraging Managed Service Providers

There are many ways that users can consume OpenStack to help benefit their IT business, whether it’s built on premises or off. However, one option that has come from this maturity, is the option for a “managed” cloud, being delivered by a managed service provider (or MSP). This option allows customers to maintain a private cloud, either on premises or off, but leave the burden of deployment, configuration, and day-to-day management to a hired, experienced team of experts. And while this does cost you a monthly/annual subscription to retain their services, it relieves you from the complexities of having to do this yourself. Many businesses may find that their internal IT teams may be understaffed, unskilled, or simply better off utilizing their resources elsewhere.

Google Fuchsia: A very, very early first look

Google has been a bit mum on actual Fuchsia details, but we do know its purpose. It's designed for "modern phones and modern personal computers with fast processors, non-trivial amounts of RAM with arbitrary peripherals doing open-ended computation." That's a bit of a mouthful, but it essentially means it's intended to be THE future OS for current Google-powered devices like smartphones and laptops. If you're not crazy about Armadillo it's time to start hoping Google is still experimenting. If not you're going to have to get used to this new, card-based, minimal operating system. Luckily, you may not have to wait long to find out what Google intends: Google I/O 2017 is happening in a week's time and Fuchsia could take center stage. There's no mention of Fuchsia or Armadillo in the I/O schedule, though there are several events centering around Magenta and Flutter.

Using Blockchain to Secure IoT

A decentralized approach to IoT networking would solve many of the questions above. Adopting a standardized peer-to-peer communication model to process the hundreds of billions of transactions between devices will significantly reduce the costs associated with installing and maintaining large centralized data centers and will distribute computation and storage needs across the billions of devices that form IoT networks. This will prevent failure in any single node in a network from bringing the entire network to a halting collapse. However, establishing peer-to-peer communications will present its own set of challenges, chief among them the issue of security. And as we all know, IoT security is much more than just about protecting sensitive data. The proposed solution will have to maintain privacy and security in huge IoT networks and offer some form of validation and consensus for transactions to prevent spoofing and theft.

PokitDok teams with Intel on healthcare blockchain solution

If you’re wondering why Intel is involved in such a project, Mike Reed, who heads up blockchain technology for the chip maker, says Intel uses these projects as a springboard for its chip business. “Intel has a long history of contributing to open source, and working with Linux and the hyperledger project allows us to work across multiple market segments,” he explained. In addition to the open source software, as you might expect, Intel has also contributed to the broader blockchain ecosystem with a technology they call SGX. “One key piece is Intel SGX, a method [we’ve built into our chips] to improve the scalability, privacy and security of blockchains,” Reed said. He added that PokitDok has taken advantage of this capability.

An untold cost of ransomware: It will change how you operate

Even if the backup looks promising, there is no easy button. The people creating ransomware know that backups can stand between them and their payday. There are a lot of cases where Microsoft Volume Shadow Copies have been destroyed by ransomware. If you leave your backups online so you can have quick recovery, you may find that ransomware can actually delete or corrupt your backups. This is not uncommon; ead the user groups from various backup companies and you’ll see the sad tales of woes. If you are not concerned enough, there are other potential dangers to your backups. They need to be airlocked from systems your users have access to. Before you bring your backups online, make sure the affected computers are off of the network. You need to be absolutely certain that those systems can’t access the backup.

Excel 2016 cheat sheet

If you're working in a workbook you've saved in OneDrive or SharePoint, you'll see a new button on the Ribbon, just to the right of the Share button. It's the Activity button, and it's particularly handy for shared workbooks. Click it and you'll see the history of what's been done to the spreadsheet, notably who has saved it and when. To see a previous version, click the "Open version" link underneath when someone has saved it, and the older version will appear. And there's a very useful difference in what Microsoft calls the backstage area that appears when you click File on the Ribbon: If you click Open, Save or Save As from the menu on the left, you can see the cloud-based services you've connected to your Office account, such as SharePoint and OneDrive. Each location now displays its associated email address underneath it.

With Security Awareness Money Talks

Undercutting the incentives for employees to do the right thing for security purposes is the fact that the vast majority of email attachments from a boss will in fact be a legitimate email attachment from the boss. Even with rampant phishing attacks happening today, most attachments are legitimate, in the same way that most people ringing your home doorbell are not homicidal maniacs. Statistical reality aside, employees’ perception is that the odds are dramatically against them opening a contaminated attachment and having damage result and having that damage traced back to the employee’s actions. In short, employees are rushed and they think it’s a decent gamble to open attachments that at least look legit.

Why Cyber Attacks Will Continue until Prevention Becomes a Priority

Cybersecurity is often described as an arms race between security professionals and skilled attackers, as both parties rush to gain the upper hand. While even cutting-edge defenses are inevitably thwarted by determined attackers, cybersecurity professionals are able to quickly react and nullify attacks. But many businesses don't keep tabs on the front lines of cybersecurity development, leaving them several generations behind with regard to best practices and current threats. For example, while multifactor authentication has been recommended for more than a decade, many organizations are only now adopting the technology across their applications and platforms. Making matters worse, many organizations fail to follow best practices for maintaining and protecting their current environments, creating countless avenues of attack for even inexperienced attackers.

Microsoft fixes 55 vulnerabilities, 3 exploited by Russian cyberspies

Fifteen of the vulnerabilities fixed in Microsoft's patch bundle for May are rated as critical and they affect Windows, Microsoft Office, Microsoft Edge, Internet Explorer, and the malware protection engine used in most of the company's anti-malware products. System administrators should prioritize the Microsoft Office patches because they address two vulnerabilities that attackers have exploited in targeted attacks over the past two months. Both of these flaws, CVE-2017-0261 and CVE-2017-0262, stem from how Microsoft Office handles Encapsulated PostScript (EPS) image files and can lead to remote code execution on the underlying system. ... Also known as Snake or Uroburos, the Turla group has been active since at least 2007 and has been responsible for some of the most complex cyberespionage attacks to date.

IBM bolsters enterprise app security with behavioral biometrics

"SecuredTouch technology provides a strong, risk-based, user-centric security check that keeps customers engaged, automatically delivering complete security and privacy while remaining completely transparent to the user, eliminating hassle, registration, and education," according to a press release. "The integration allows IBM customers to implement behavioral biometrics directly into their apps without any additional steps." Potential use cases include second factor authentication in financial applications, or adding another layer of enterprise security for corporate apps. The goal is to enhance the user's digital experience and reduce the friction caused by using passwords and tokens. It can also enable more transactions via mobile and reduce false positives, the press release stated.

Quote for the day:

"Nothing gives so much direction to a person's life as a sound set of principles." -- Ralph Waldo Emerson

Daily Tech Digest - May 09, 2017

Leadership For The IT Revolution

Leadership is not an immutable set of universal traits. The British have an expression, “Horses for courses,” by which they mean that just as some horses are best on wet tracks, or long tracks or short tracks, so are some people better suited to certain activities than other people. This applies in IT leadership. Horses for courses; environment matters. To be successful, IT leaders need to identify and apply a subset of leadership traits relevant to the environment in which they find themselves. This means that when the environment changes, leaders have to change — not who they are, but how they lead. ... Nathan Rothschild was convinced opportunities were greatest when cannonballs were falling in the harbor, “when there’s blood in the streets, even if the blood is your own.”

Insurance companies struggle with managing analytics teams

Led primarily by traditional CIOs, many companies have created centralized data management, big data and information governance strategies and capabilities. To lead these functions, insurance companies have sought talent from adjacent industries that have led the way in data analytics. This typically includes retail, financial services, information services and data companies. In some instances, Insurance companies have looked to executives coming out of healthcare organizations in order to leapfrog their own data capabilities. Though the Insurance industry has made significant strides in terms of data capabilities, it continues to grapple with the challenges of organizational access, and structuring to maximize the impact of analytics.

Battling cyber security’s human condition

Unfortunately, technical security protections are often easily undermined by social engineering and human error. In fact, according to CompTIA’s 2016 International Trends in Cybersecurity report, 58 percent of security breaches are caused by human error, versus 42 percent caused by technology error. For example, look at Sony Pictures’ catastrophic data breach, where the company lost employee personal information, emails, and even copies of un-released films. When the dust finally settled around this attack, evidence suggested that the intruders began with credentials harvested from spear-phishing campaigns that deceived employees. Sometimes attackers don’t even need to trick employees into giving up their credentials; they can just guess an over-simplified password. According to Verizon, 63 percent of all intrusions involve stolen, weak, default or easily guessed credentials.

Security Surprises Arising from the Internet of Things

Threats to IoT can be divided into two categories. First, devices are taken over to do something they are not intended to do, like a security camera that becomes part of a botnet attack. But also devices can be commandeered to do exactly what they are intended to do but in a devious way. Think of directing a self-driving car to drive off a bridge. Consider the cyber attack on Iran’s nuclear enrichment centrifuges to make them rapidly speed up and then suddenly slow down (imagine pushing down hard on the accelerator, and then the brake in your car), which eventually seriously damaged them. That flummoxed operators who had never planned a response to prevent something like that because why would you do that in the first place? Therein lies the danger of IoT security flaws: Hackers may come up with ways to use devices that were never conceived of before.

How to check for the Intel Active Management exploit that lets hackers take over your PC

A vulnerability that lets someone boot up your PC and install software at will, and even bypass logging in, sounds about as bad as it can get. Still, it's not clear just how easy this is to exploit. Security reporter Dan Goodin of Arstechnica reported last week that some researchers believe the exploit would have to be present and the machine would have to be set up or provisioned for remote management for it to open to the attack. Goodin, however, followed up with a report on Saturday that researchers had bypassed the AMT without even entering a password. In the end, the first step in fixing a problem is recognizing that you have one. If you think you might have the exploit on your machine, run the check.

Linux Foundation to develop tool for building blockchain business networks

The Linux Foundation announced a new software project under its Hyperledger open consortium aimed at creating a collaboration tool for building blockchain business networks -- or smart contracts -- and their deployment across a distributed ledger. The new project, called Hyperleder Composer, is a modeling language based on JavaScript and with REST API support, that allows non-developers and developers to model their business network. The language also supports modeling of relationships and data validation rules. For example, all blockchain business networks share certain elements, such as assets, participants, identities, transactions, and registries. With existing blockchain or distributed ledger technologies, it can be difficult for organizations to take a blockchain business use case and map the concepts into running code.

How to navigate uncertainty? Stop managing the manageable

A landmark study in the mid-1990s found that only 55% of a company’s results stemmed from issues that managers could control. That means fully 45% of the results related to effects in the environment -- a recession, a surprise by a competitor, a natural disaster, and so on. Managers tend to throw up their hands about external surprises. “Who could have known?” “What could we have done?” But that 45% can, in fact, be managed. The secret is to sense the external events quickly and to react faster and more nimbly. Remember: you don’t have to get everything right; you just have to be a little more right than your competitors. To begin managing those areas traditionally considered unmanageable, senior executives should focus on developing four organizational capabilities.

Why Your Own Resilience Matters Less Than Your Team’s

It’s no surprise that there’s a strong correlation between effective leadership and the characteristics common among resilient individuals—which include self-reliance, an internal locus of control, a growth mind-set, strong problem-solving abilities, and good interpersonal skills. Indeed, resilience experts at Sloan Group International reported in a recent presentation that, based on the available research, “people who self-select into a leadership role tend to have a higher ability to deal with stress and hold a high amount of resilience.” Vindication for the Shackleton model, right? Sure, but that model may deliver fewer returns as the workplace evolves. The more distributed leadership becomes, and the more collaboratively teams are asked to work, the fewer chances there are for Shackletons to come along and save the day when things go awry.

Industrial Robots Are Security Weak Link

One challenge for companies will be to find people who have experience in both robotics and security. “There will be a few folks, but it will be a hot market because not many students study both robotics and security,” Gennert said. “Those that do both will be able to write their own ticket.” Until companies can effectively combine robotics with security, robots may be an easy entryway for a hacker into a company's networks. Nunnikhoven said there’s no direct evidence that hackers have taken advantage of these exploits. There aren’t proper monitoring systems in place to know if the systems have been exploited, he said. Malicious hackers could get into a robot's controller system and make adjustments to its actions, which could create a dangerous situation in the factory or could enable the robots to build unsafe products on the production line.

Taking an Application-Oriented Approach to Cloud Adoption

In cloud, we don’t know exactly where our application is running. Hardware is prone to failure. Software updates and patches are also prone to error. It’s better to architect and design your application to handle failures rather than thinking and trying to make it robust which is never possible. Eliminate single point of failure (SPOF), build resiliency at every level. An application should function even when the underlying hardware has failed. AWS Availability Zones (AZ) and Regions, similarly Azure Locally Redundant Storage (LRS), Zone-redundant Storage (ZRS), Geo-redundant Storage (GRS), and Read-access geo-redundant storage (RA-GRS) all make it easier to design redundant capabilities. Building resilient cloud infrastructure is straightforward and far less expensive than traditional means.

Quote for the day:

"Our worst fault is our preoccupation with the faults of others." -- Khalil Gibran

Daily Tech Digest - May 08, 2017

And Now a Ransomware Tool That Charges Based On Where You Live

The payment scheme is based on the so-called Big Mac Index, an interactive currency comparison tool that The Economist created in 1986 to assess whether international currencies are at their correct relative levels or are undervalued. It basically compares the average price of a Big Mac in the U.S. against prices for the same product in various other countries to determine currency trends. The tool, which The Economist has said was originally designed as a lighthearted attempt to gauge currency misalignment, has become a global standard for measuring international purchasing power parity. Fatboy, according to Recorded Future, uses the same index to determine which of its victims get to pay more and which of them get to pay less—at least in relative terms.

Do You Really Have Big Data, Or Just Too Much Data?

The type of information companies are collecting is also multiplying -- from traditional sources such as customer mailing addresses and phone numbers to more advanced demographics, web histories, shopping preferences, and even biometric data. Advances in technology, computer power, and analytics mean companies can collect and process data in almost real-time. This may lead executives to believe that the more data they have, the greater their advantage. However, collecting a virtually unlimited amount of data can create a serious threat for organizations, because the amount collected often outstrips the ability to protect it. In fact, when CEB surveyed 54 information risk executives around the globe in 2015, more than three-quarters of them indicated it is harder, or significantly harder, to prevent data breaches than in the past.

Why SMBs are at high risk for ransomware attacks, and how they can protect themselves

Gibbons recommends having basic IT protections around how files are shared within a network, including a basic VPN setup for employees who work from home, or a fileshare system like Dropbox. "Having a corporate-sponsored way of sharing files remotely, working on them, and getting them safely back into the network goes a long way," Gibbons said. Basic employee education programs about email phishing and other cyber threats is also very effective, Gibbons said. "You need to plan as though you're absolutely going to get infected," he added. "The problem is you're subject to the weakest link in the chain—the least technically skilled individual in the business will be how you become a victim." When ransomware does hit, it's key to identify and isolate the infected machine to ensure it doesn't spread throughout the network, Gibbons said.

5 Career Paths in Big Data and Data Science, Explained

The first article provides a general overview of some of the dominant concepts in data science, with the second being an update to these concepts from earlier this year. The third article provides a deeper treatment of the concepts of data science and Big Data. The fourth and final article is a quick discussion touching on some of the complexities and nuances surrounding the use of the term "data science" versus a number of other terms. I have broken up the various professional possibilities into an easily manageable set of 5 career paths. While there may be mass outcry and widespread panic related to this particular division of roles, they really serve to categorize skills and professional responsibilities at a high level, and so I believe the following is quite useful for orienting newcomers to the myriad opportunities which exist in this professional realm, myriad opportunities

Why CFOs and CIOs need to partner on cybersecurity

“In the old days when your CIO and CFO had no relationship and didn't talk to one another, it was bad management,” said Lee Lofthus, assistant attorney general for administration at the Department of Justice. “Now, if you don't talk to one another, it's a real cyber risk for the whole agency.” Other panelists pointed to DOJ as a federal leader in institutionalizing the relationship between the CFO and CIO. The CIO sits on the working capital board at Justice, while the deputy CFO sits on the department’s investment review board. Lofthus added that there is no longer a bright line between a cybersecurity budget and an IT budget at DOJ. “It's an increasingly composite budget we get that has cyber baked into it,” he said. He pointed to the example of data center consolidation, which was originally viewed as a cost-cutting measure.

Another Tectonic Shift: The Cloud Disrupts Traditional BI Architectures

“Cloud” is not a technology it’s an architecture. In the same way that software built for the mainframe made assumptions about the environment in which it operates, software built for client-server architectures made a different set of assumptions. This is why we saw the rise of an entirely new set of vendors who seemed to appear from nowhere to become some of the largest software vendors in the industry. Almost no vendors of data technologies (databases, integration tools, query or reporting products) carried over from the mainframe market into the later stage client-server market of the late 1990s to early 2000s. We are at a stage in cloud adoption where the BI vendors are beginning to recognize that the way their software was built, deployed and managed is not well suited to the way cloud architectures work.

Computer Forensics Follows The Bread Crumbs Left By Perpetrators

The extent to which deleted data and historical activity may be recoverable varies on a few factors, but generally degrades over time and commensurate to the volume of activity on a system, he said. This approach to computer forensics remains suitable for focused, small-scale investigations, but is too time and resource-intensive for enterprise-scale tasks, such as hunting across thousands of systems in a corporate environment, Kazanciyan said. “As a result, technologies that facilitate rapid search and analysis of evidence across ‘live’ systems began to flourish in the past decade, and formed the foundation of what's referred to as the endpoint detection and response (EDR) market,” he said.

Tech execs unsure about cyberinsurance, want storage flexibility, and wonder about AI

"I wish they would understand that most of the data that I deal with is dark data, and what that means is just like the proportions of the universe, where 3 percent we can see but 97 percent is dark matter, just because you can't see it, it doesn't mean it's not there. My data are high-resolution images, very rich information, and I wish what they understood is we need to stratify that data better." "I'm very jazzed about screenless. The processing power has been woven into everything that we have, and so I believe that anything I touch, anything I speak to, it's all alive and I'm loving how it's evolving." ... "Oh, man. Well we're healthcare so HIPAA. I just wish that was a little bit more of an out-of-the-box type of setup, that they would just figure out how to make that more turnkey than it's their first rodeo every time.

Will the Internet of Things always be so vulnerable?

The Internet of Things doesn’t have to be as vulnerable as it currently stands. In many cases, the transition to managing business affairs online — everything from accounting and storing customer data, to production and inventory management — has occurred faster than business leaders can adopt new security measures. In their eagerness to improve communication, data storage, and business operations through IoT devices, many businesses simply haven’t paused long enough to think about the careful protection of that data. Though countless enterprises would like to say otherwise, the truth is cyberattacks cannot be fully prevented. Nevertheless, smart companies — and individual users — can adopt quality standards and best practices that minimise those risks to ensure IoT becomes a boon, not a burden.

Data Breaches: Fear the simple, not the complex

John Grim explained how this works and how prevalent it is, he said: “Financial pretexting is tricking somebody, like sending them a fake invoice, and having an executive sign off on it, and basically stealing money that way.” “In terms of pretexting the top communication vector email, we’re seeing 88% there, and then we are seeing pretexting 10% of the time in telephonic or phone communications.” With close to 90% of this most basic form of attack being sent in via email, it begins to raise the possible question as to whether email is still a suitable platform for transferring sensitive information. CBR recently spoke to a startup called Pushfor that is tackling the space, aiming to provide a secure solution for sending important information.

Quote for the day:

"You can know a lot about something and not really understand it" -- Charles F. Kettering

Daily Tech Digest - May 07, 2017

Phishers Spoofing Email Senders to Muck around with Victims’ Web Accounts

The researcher observed that attackers could also use that same feature to add malicious PDF documents to a target’s to-do list. All they would need to do is attach the documents to their emails. They could then use the “*” character, per Wunderlist’s service, to flag that email and its attachments as important. Fortunately, it’s not hard to fix the issue. Web services can take a cue from companies like Google, Evernote and Facebook and begin using unique secret email addresses for each account. This address connects a generic mail-in account to the user’s account. To mess with the system, someone would need to know the secret email address for the target’s account and the company’s generic mail-in email address.

Why one CIO chose ‘speed over elegance’ in corporate split

It's customary for CIOs to seek synergies in such complex splits. Enticed by reduced license and support costs, Bender purchased several SAP applications. He chose SAP's Hybris ecommerce application and SAP cloud applications, including SuccessFactors for human resource management, Ariba for procurement and spending analytics, and Concur for travel and expense management. “Cloud-based solutions were preferable because we could stand them up faster and implement them accordingly,” Bender says. While Bender acknowledges the predominance of SAP in his portfolio he insists that he's not wed to the vendor; rather, he's picked the best solution for each business need. "You have to look in terms of adding value to the business," Bender says. "Where it makes sense we lean into SAP and we’ve had success with that.”

Culture May Eat Agile for Breakfast

Originally rooted in the “fake it ‘til you make it” practice, the approach used to be of an intermediary nature to gain time while figuring out or preparing the right solution. Nowadays, it is the answer particularly in areas like sales or customer service, the latter often acting as an extension of an inadequate product or service. Adding people to fix issues manually turns out to be psychologically challenging at the leadership level. There often is an immediate feeling of adding value by fixing a problem. However, this initial short-term success is achieved at the expense of the long-term solution by making it seem less urgent. Hence, this path means focusing on the low-effort-low-outcome quadrant, when the organization should address the real issue at hands: how to preserve its culture when hiring starts focusing on providing skills, not mindset?

HoloLens system uses augmented reality to aid spinal surgery

At least that's the promise of the new Scopis Holographic Navigation Platform, which is designed to be used with the Microsoft HoloLens to help doctors perform spinal surgery. The company claims that its system can use 3D tracking with the HoloLens to help accurately find spinal screw positions faster during surgery. The system also allows the medical team to place virtual monitors above the surgery space, giving the surgeon a hands-free way to refer to charts and images while operating. Scopis also employs the HoloLens' familiar finger gestures (which look like you're pinching the air) to allow the surgeon to control the AR content. Of course, the $3,000 HoloLens is still mostly in the hands of developers, so we're still learning about just how reliable it is during pressure situations like surgery, but this short video is an encouraging look at the possible near future of AR as a practical tool beyond gaming and casual apps.

How Mindfulness will Protect You From Being Replaced by a Robot

Mindfulness is a natural capacity, present in all of us to some extent. But we are all too familiar with its opposite: a default, heedless, distracted state often described as ‘autopilot’. It goes without saying that anything that we can do on autopilot, robots and AI will soon do better. Mindfulness may come to be seen as the core 21st century capacity, because it concerns our only competitive advantage over the machines: awareness itself. ... If we’re successful in creating a human-centered economy that plays to our best qualities, then this may mean that we work fewer hours, or fewer days. But it may also mean that many of us will be unemployed. If this is the case, how will we use our time? What will education teach us?

Big Data Analytics Talent is Just Waiting to be Tapped

There is also a need to separate the roles involved in managing and preparing data analytics – which can be divided into two broad categories: data science or data engineering. Aashu Virmani, chief marketing officer at in-database analytics software company Fuzzy Logix, recently explored these distinctions with Adrian Bridgwater in a recent Forbes article. “In the most simple of terms, data engineers worry about data infrastructure while data scientists are all about analysis,” Virmani states. Virmani also explored the qualities that make a good data scientist or good data engineer. Data scientists, Virmani says, “may not have a ton of programming experience but their understanding of one or more analytics frameworks is essential.” He also says that a large part of their role is hypothesis testing, but the key is letting the data tell its own story.

Is the digitization of finance making human bankers obsolete?

The future of banking also is changing the fundamental relationship between bankers and clients. Banking is primarily a relationship business, noted moderator Dan Primack, business editor at Axios. Often a human bank manager can be the driver of business based on his relationships and network, but that may be changing. So, is the digitization of finance making banking relationships less important? Michael Tannenbaum, chief revenue officer of the San Francisco-based SoFi — an online personal finance company that provides student loan refinancing, mortgages and personal loans — invoked what he called the 80/20 rule, where the majority of financial services perhaps could be solved with technology, and supplemented with high-end service from a financial services professional.

Cyberspies tap free tools to build powerful malware framework

After analyzing the way in which Netrepser's command-and-control server assigns unique tracking IDs to infections, the Bitdefender researchers believe that the attack group has compromised around 500 computers to date. The vast majority of those systems belong to government agencies and organizations, indicating that Netrepser's goal is cyberespionage, not financially motivated cybercrime. Bitdefender declined to disclose the countries whose government agencies have been targeted, but some of the spear-phishing emails sent by the cyberespionage group contained malicious Microsoft Office documents with Russian names and text. This doesn't necessarily limit attacks to Russia, because the Russian language is used in many former Soviet Union member countries.

The pitfalls of cybersecurity shopping: hype and shoddy products

Some vendors even resort to scare tactics. When Chow rejects a product pitch, salespeople often tell him he doesn’t care about his company’s security. “It’s a shame-and-guilt game,” Chow said. One CISO said that on two occasions, vendors have threatened to report his organization to the U.S. Dept. of Health and Human Services, claiming he was violating compliance regulations by not buying their security product. The aggressive sales tactics aren't surprising. Competition among vendors has ramped up in recent years as a wave of security startups has shaken up the sector with new products promising better protection. That’s brought a flood of venture capital into an increasingly crowded market.

Do you need a chief artificial intelligence officer?

There is significant new hype around AI and ML which can undermine the productive and beneficial uses of these technologies. But artificial intelligence and machine learning are a set of methods in computational science that have been in practice benefiting businesses for many decades. For organizations exploring this role, review how it has been structured in other organizations and what has been expected (e.g. recommendation, fraud detection, image analysis and so on). Great success has come from the proper implementation of these mathematically-based methods when applied to suitable problems in the business setting. The real change in recent years has been the focus on data acquisition, cleansing and engineering which is “the food” for a great AI and ML program.

Quote for the day:

"You're not always going to be successful, but if you're afraid to fail, you don't deserve to be successful." -- Charles Barkley