Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - June 10, 2017

How serverless changes application development

When viewed through the prism of the Rogers Innovation Adoption Curve, serverless is still a young market, most likely at the beginning of its early adopter phase. But it has some big players behind it (that a traditional IT decision maker wouldn’t get fired for betting on), a healthy number of open source alternatives, and the beginnings of a market for startups providing complimentary tooling. One intriguing aspect of serverless is its potential to turn the notion of vendor lock-in on its head. Suppose you really like Amazon Polly for voice-to-text but you prefer IBM Watson for text sentiment analysis. Your front-end application could record spoken words, send the recording to a Polly function on AWS, and send the resulting text to Watson. So instead of being locked into a single vendor or ecosystem, you can embrace finding exactly the right tool for the specific job.

HR 2.0: how technology is transforming HR

We are social beings and our workplaces are small societies, so it’s no surprise that social media and technology is having an influence on the corporate environment. The growth of social media shows the appeal of human connections, but that need was hardwired into humans long before Facebook. From swapping stories around the campfire 10,000 years ago to sharing pictures on Instagram, our biological need to bond and share may change expression, but it remains vital to who we are. Businesses are subsequently increasingly using habits of instant messaging, cloud-based document sharing and quick feedback to meet these growing expectations. Until the advent of timelines on social media, social sharing was an ephemeral phenomenon. Now, people expect to relive social sharing over time by looking back at a record of messages, pictures, and videos they’ve shared.

One Day, a Machine Will Smell Whether You’re Sick

“We send all the signals to a computer, and it will translate the odor into a signature that connects it to the disease we exposed to it,” Mr. Haick said. With artificial intelligence, he said, the machine becomes better at diagnosing with each exposure. Rather than detecting specific molecules that suggest disease, however, Mr. Haick’s machine sniffs out the overall chemical stew that makes up an odor. It’s analogous to smelling an orange: Your brain doesn’t distinguish among the chemicals that make up that odor. Instead, you smell the totality, and your brain recognizes all of it as an orange. Mr. Haick and his colleagues published a paper in ACS Nano last December showing that his artificially intelligent nanoarray could distinguish among 17 different diseases with up to 86 percent accuracy.

IoT skills set to rise in importance

“IoT training is about coding plus communication. On its own, coding will allow an engineer to give a device some functionality and behave in a certain way. But the IoT is based on the idea that the ‘things’ are able to effectively communicate with one another and exchange data. To make an IoT specialist, they would need to be educated about wireless communications technologies and networking as well as coding,” he says. “ABI Research predicts that 48bn devices will be connected to the internet by 2021, 30% of which will be Bluetooth devices, so knowledge of this most pervasive of low power wireless communications technologies is key In addition, for some people currently working in IT, it means more education is needed about embedded software engineering, as they may find themselves working with smaller, more constrained devices than they ever have before.”

The dangers of hacking back

Attribution is not only a technical problem, but a geopolitical one too, which could be extremely asymmetric in favor of the attackers. ... Moreover, cyber attacks are just one form of digital response that these groups could use in response to a hack back. As we saw last year, cyber attacks can be very successful when part of a larger information campaign that includes disinformation, automated social bots, as well as data theft, dump, and manipulation. When a company hacks back, even if they’ve accurately attributed the source of the attack, they risk triggering retaliation not just from cyber warriors but also trolls, which can inflict widescale brand, reputational, financial, and even physical damage. And that doesn’t even touch upon potential responses outside of the cyber domain, such as targeted economic punishment or escalation of interstate tensions.

PayPal CEO offers sobering view of cybersecurity threats

“History is not on our side,” he added. “because of what’s happening in technology, 40 percent of businesses will go out of business within the next five years.” That’s particularly sobering for credit unions, where the number of institutions nationally has shrunk by 32 percent in the last decade (and shrunk by 35 percent in Michigan during that period), according to statistics offered by Michigan CU League CEO Dave Adams. In order to survive, said Schulman, institutions – particularly financial institutions – must be willing to change their business models and adapt to how consumers do business. “There is going to be more change in financial services in the next five to seven years than occurred in the last 30 or 50 years,” he predicted, noting that basic financial transactions can be done via mobile device for as much as 80 percent cheaper than using existing branch infrastructure.

Executive interview: Brian Kelly, chief security officer, Rackspace

During an attack, he says, there is often an “A team” and “B team” of hackers. “The B team do the reconnaissance. They are noisy and sloppy. They are trying to map the network. Then there is a pause and, within an hour, the A team come in to arm-wrestle with you.” Some organisations tempt hackers in with a honeypot, to catch them trying to break into a network. For Kelly, a reasonable strategy to thwart at attack is to tie up the B team, possibly leaving a few “cookies” for them to steal, and lead them to a place on the corporate network where their activities can easily be monitored and the security team can learn about the attack vectors being tried. But fighting a determined A team hacker is tough and the IT security tools that the security teams rely on will start to fail, warns Kelly. “How adaptive are the tools, given that the attack can change within eight, 10, 12 or 15 minutes?” he says.

How to Apply Machine Learning to Event Processing

On top of stream processing or complex-event processing in general, you often need a human to make the final decision. Think about predictive maintenance where replacing a part might costs thousands of dollars. However, the analytic model of the data scientist just offers you a specific probability if the machine will break. A human can take a deeper look in both, live and historical data, to decide if a part will be replaced or not. A live visualization pushes events in real time to a user interface (e.g. desktop, web browser or mobile device). The operations team can live-monitor systems and see exceptions or errors when or even before they occur (using the analytic models). Thus, they can do proactive actions – e.g. stop a machine or send a mechanic.

How artificial intelligence will transform financial services

With payment fully digitalized, financial services institutions have integrated into the cashless ecosystem, supporting consumers that pay with their digital wallets, smartphones or digital currencies for everyday transactions. In the age of hyper-connectedness, payment transactions are now fully transparent, empowering customers with friction-free payments and checkout procedures. Having embraced digital payment channels, customers view payment processes as a background activity seamlessly done via mobile devices agnostic to technology platforms whether it’s contactless NFC (Apple Pay), wearables, Smart TV or distributed blockchain ledgers. Having built payment platforms that are interoperable, cost efficient, and secure, financial institutions are now razor focused on competing for a seamless customer experience and racing towards greater financial inclusion to attract the larger un-banked and uninsured market share.

CFO or CEO: To whom should IT report?

CIOs must justify IT investments with tangible productivity gains that may not always be substantiated by pure financial means, according to Vinit Kholi of Sibcy Cline Realtors. He points to cloud services and Microsoft Office 365 as examples. “Companies have to clearly define their need and then follow up to ensure tools that impact the whole organization are implemented in a way that adds value for the users. Budgetary discussions become incidental if the business case is strongly presented,” Kholi said. Companies that opt to only replace technology when it breaks will go the way of Kodak, Blockbuster and Radio Shack. Today’s midmarket IT leaders’ primary functions include protecting company data and empowering employees with technology to get their jobs done.

Quote for the day:

"If you don_t find a leader, perhaps it is because you were meant to lead." -- Glenn Beck

Daily Tech Digest - June 09, 2017

Be wary of vendors touting superior data science

Intelligence is overhyped, potentially because of its sundry definitions across both the public and private sector. "At the end of the day, it's about intelligence. What data science is about is being able to leverage the huge amount of information we have, and to analyze it, enrich it, and make it actionable in a proactive instead of a reactive way," Peloquin said. ... In order to make informed decisions, CSOs should ask vendors questions like, Do you have a Phd data scientist on staff? Who leads your team? Where are they from? What is their background and experience? "They [CSOs] need to be smart enough to ask the vendor to ensure that their products are not just marketing speak. If they [the vendor] based all of their capabilities on the output of automated tools rather than experts in the field that can do targeted attacks, then I would argue that their solution is not as mature as they are claiming it to be," Peloquin said.

How Disruptive Innovation Can Finally Revolutionize Healthcare

While these high-level measurements are important for tracking performance, they distract from the understanding of the true causal mechanism of how industries become more affordable and accessible. Nearly a decade ago, The Innovator’s Prescription showed how disruption could transform healthcare. Yet unlike other industries, healthcare has been largely immune to the forces of disruptive innovation. Whereas new technologies, new competitors, and new business models have made products and services much more affordable and accessible in fields ranging from media, telecom, finance, and retail, the U.S. healthcare sector keeps getting costlier, and is now by far the world’s most expensive system per capita, about 2X higher than the U.K., Canada, and Australia, with chronic conditions such as diabetes and heart disease now accounting for more than 75% of total spending.

Security Implications of Permission Models in Smart-Home Application Frameworks

A software app or physical device is collectively referred to as an app in AllJoyn terminology. An app can expose interfaces that have members. For example, a lock can provide the control interface with the members lock and unlock. Apps can consume interfaces from other apps. For example, an auto-lock app will consume the door lock's control interface. AllJoyn standardizes some interface definitions for a select set of devices, such as lights and HVAC. Apps are security principals and are associated with an identity certificate signed by a certificate authority that all apps must trust. The AllJoyn security manager is a component that speaks the AllJoyn protocol and issues identity certificates to apps. An administrative user, such as a home or building owner, operates the security manager component.

Given the Inevitably of IoT Security Breaches, Are We Getting Ahead of Ourselves?

The threats extend all the way up to representative democratic systems of government, prospects that haven’t gone unnoticed by leading figures in commerce, industry and government. “My guess is we are reaching the high-water mark of computerization and connectivity and in a few years we are going to be deciding what to connect and what to disconnect and become more realistic about what can work,” the Pew researchers quote a speech given by Bruce Schneier at the Organization for Economic Cooperation and Development (OECD) in Cancun, Mexico in June 2016. “We are creating a society by which a totalitarian government can control everything. Right now it’s more power to the powerful. And we are living in a computerized world where attacks are easier to create than defenses against them,” Schneier was quoted.

Calm before the storm? Ransomware, botnet attacks predicted to surge

“After the initial shock of ransomware’s rapid growth and the popularity of its usage, threat actors have begun to settle in for the long-term deployment of this category of destructive malware tools,” the report authors wrote. “All indications point to a new wave of innovation in the distribution and tactics used for ransomware attacks in the future.” For Kurt Hagerman, CISO of security firm Armor, it’s clear “the healthcare industry is pretty behind the curve from a security standpoint.” Hagerman used the banking sector as an example of an industry that saw its weaknesses and moved toward security standards, enforcement and education. The impact over time has been less fraud. While the risk can never be eliminated, the total number of records stolen is going down.

Blockchain integration turns ERP into a collaboration platform

"It's a very hot topic right now," said Zulfikar Ramzan, CTO of RSA Security, a subsidiary of the Dell EMC Infrastructure Solutions Group. "We are definitely getting a lot of inbound inquiries around blockchain and its implication within enterprise environments. I think it's driven largely by the fact that when there's a new technology out there, to some degree people want to be buzzword compliant with the latest and greatest." Ramzan said his customers are asking about blockchain for audit logging and or verifiable logs, which is viewed as a reliable way of tracking what happened in an organization to satisfy regulatory auditors. Other RSA customers are interested in it for user authentication to ensure users are accessing the correct digital records at the right time.

Getting threat intelligence right

While threat intelligence feeds provide valuable information to help identify incidents quickly across an enterprise, they are generally based on known, observed information. Much of today’s threat intelligence is supplied as IOCs – essentially fingerprints of known attacks or attackers, says Kane Lightowler, managing director of Carbon Black in Asia Pacific and Japan. “IOCs may provide great value against previously observed attacks, but offer limited insights on new attacks and attack methodologies.” Sparkes agrees, noting that intelligence feeds require a “patient zero” – the first organisation or person to see the attack and record the IOCs before others can benefit from it. Lightowler says patterns of attack are more effective against both known and unknown threats because they focus on the actual behaviour and techniques of the attacker, rather than fingerprints.

Big data and relinquishing your right to privacy

At the heart of the privacy debate are the “unspoken” rules about what companies can do with our data. Even when we know that our activity and information and even our voices are being recorded and stored, what obligation does a company have to tell us every single example of how it can be used? As consumers, we might not mind if our listening preferences are used to advertise related goods or services, but do we have to agree to every possible use of information—both positive and negative—as an unavoidable part of data gathering? The bigger concern is why any company would think it’s OK to not inform its customers of the rights they’re signing away. After all, checking the box that you’ve read the full agreement has been called “the biggest lie on the internet.” It’s alarming to think that we have already adopted a cultural mindset that privacy is just something we sacrifice to make sure we have a ride to the airport, or to turn our lights on when we’re late getting home.

How to avoid a disastrous recovery

The ultimate goal of DR planning is to move “cold” data, complete copies of the data center frozen at a point in time, to the most cost effective location possible that provides for meaningful SLA recovery if/when necessary. These copies are then constantly updated to ensure any subsequent changes to the production environment are replicated to the DR environment. Before moving forward with DR planning, organizations must look at industry-specific regulations such as HIPAA or the Sarbanes-Oxley Act to determine the right hosting infrastructure for their data. For example, strict data sovereignty and security requirements prevent organizations from saving personal data to the cloud if that data leaves the country of residence at any time. After evaluating these requirements, it may be that the CIO will see that hybrid cloud makes the greatest financial and risk permissive option for that organization.

3 Keys To Keep Your Data Lake From Becoming A Data Swamp

Perez says one of the biggest mistakes organizations make is collecting too much data, simply because they can. Consider your smartphone. If you own one, chances are you've got hundreds or more pictures stored on it. "You end up with a billion pictures on your phone, and yet 99 percent of them are probably garbage that you would get rid of in a heartbeat," he says. "It's gotten so easy to take pictures with your phone, it's essentially free. And you probably think, 'One day I'll go and clean it up,' but of course no one ever does. You're collecting an enormous amount of information, but you have no way to work your way through it to use it effectively." When you inevitably want to show someone a particular photograph, finding it can require scrolling through an enormous volume of junk.

Quote for the day:

"Great things are done when men and mountains meet." -- William Blake

Daily Tech Digest - June 08, 2017

Did someone cancel the fintech revolution?

The Accenture report says that these promises have yet to come to pass; old fashioned banks are still standing, and perhaps standing still, while startups have yet to gain real traction in customer acquisition and seen their VC investment decline by more than a third in the last year. Nevertheless, Accenture suggests that the revolution is more likely to be stalled than dead. The firm argues that the UK can establish itself as a leading exporter of fintech R&D, helping individual firms monetise their expertise and 'UK plc' build the county's digital reputation. To do this, the report argues that government and regulators must compete with rivals such as Singapore to attract investment and talent. This is particularly important at the moment because of Brexit, which may result in limiting of free movement and see banks shift operations overseas.

Is a chief AI officer needed to drive an artificial intelligence strategy?

This role provides strategic, and in many cases tactical, guidance and support for exploring and transforming the business using realistic AI approaches. This role would also serve as the pragmatic evangelist for the process, people and tools that can help achieve real business results with AI or human intelligence augmentation. It is important for this role to guide the appropriate and reasonable expectations of AI and to push for the proper applications so the business value is demonstrated. The ability to simplify complex topics and to influence others is also essential to the role since there can be a confusing array of approaches, vendor products and internal tensions around strategic directions. This role needs to provide a clear, actionable path forward for the chosen artificial intelligence strategy that allows flexibility but focuses on realistic delivery along the way.

Which Machine Learning Algorithm Should I Use?

The machine learning algorithm cheat sheet helps you to choose from a variety of machine learning algorithms to find the appropriate algorithm for your specific problems. This article walks you through the process of how to use the sheet. Since the cheat sheet is designed for beginner data scientists and analysts, we will make some simplified assumptions when talking about the algorithms. The algorithms recommended here result from compiled feedback and tips from several data scientists and machine learning experts and developers. There are several issues on which we have not reached an agreement and for these issues we try to highlight the commonality and reconcile the difference. Additional algorithms will be added in later as our library grows to encompass a more complete set of available methods.

jhsdb: A New Tool for JDK 9

The jhsdb tool is described on its Oracle JDK 9 Documentation Early Access page, "You use the jhsdb tool to attach to a Java process or to launch a postmortem debugger to analyze the content of a core-dump from a crashed Java Virtual Machine (JVM)." The tool comes with several "modes" and several of these modes correspond in name and function with individual command-line tools available in previous JDK distributions. The jhsdb tool not only provides a single tool that encompasses functionality of multiple other tools, but it also provides a single, consistent approach to applying these different functions. For example, the jhsdb command-line syntax for getting help for each of the "modes" is identical. The jhsdb tool can be attached and applied to a running JVM via its process identifier (PID) similar to how several other tools (including jcmd) work.

10 critical skills that every DevOps engineer needs for success

People skills are key, but tend to be underappreciated, said Alan Zucker, founding principal of Project Management Essentials. As software engineers, DevOps professionals tend to look to tools rather than people and processes. "Great DevOps engineers start by understanding the people, the culture, and how the organization runs," Zucker said. "They then build a strategy that focuses on simplifying the overall operating environment to achieve the goal of continuous delivery." For a DevOps team to be successful, it needs to include individuals who possess strong communication skills, said Alex Robbio, president and cofounder of Belatrix Software. "Similar to Agile development teams, soft skills are incredibly important—not just for the individual engineer, but also in making the organizational cultural shift to implementing and then standardizing DevOps," Robbio said.

We need to talk about how artificial intelligence can manipulate humans

Unfortunately, the commercial forces driving technology development are not always benevolent. The giant companies at the forefront of AI—across social media, search, and e-commerce—drive the value of their shares by increasing traffic, consumption, and addiction to their technology. They do not have bad intentions, but the nature of capital markets may push us toward AI hell-bent on influencing our behavior toward these goals. If you can get a user to think, “I want pizza delivered,” rather than asking the AI to buy vegetables to cook a cheaper, healthier meal, you will win. If you can get users addicted to spending 30 hours a week with a “perfect” AI companion that doesn’t resist abuse, rather than a real, complicated human, you will win.

The Behavioral Economics of Why Executives Underinvest in Cybersecurity

In the case of cybersecurity, some decision makers use the wrong mental models to help them determine how much investment is necessary and where to invest. For example, they may think about cyber defense as a fortification process — if you build strong firewalls, with well-manned turrets, you’ll be able to see the attacker from a mile away. Or they may assume that complying with a security framework like NIST or FISMA is sufficient security —just check all the boxes and you can keep pesky attackers at bay. They may also fail to consider the counterfactual thinking — We didn’t have a breach this year, so we don’t need to ramp up investment — when in reality they probably either got lucky this year or are unaware that a bad actor is lurking in their system, waiting to strike. The problem with these mental models is that they treat cybersecurity as a finite problem that can be solved, rather than as the ongoing process that it is.

Public-private partnership critical to thwarting cyber threats

It’s a serious problem for healthcare organizations, which have a responsibility to secure their systems, medical devices and patient data from these kinds of cyber attacks with razor-thin operating margins, and, as a result, “cannot afford to retain in-house information security personnel, or designate an information technology staff member with cybersecurity as a collateral duty,” according to the task force. Meadows acknowledges that security is a “harder sell” for C-level healthcare executives “because it’s really an insurance policy and there’s no perceived ROI to having good security posture and hygiene,” particularly in smaller organizations facing resource constraints. However, organizations making the decision to “prioritize cybersecurity within the healthcare industry requires culture shifts and increased communication to and from leadership, as well as changes in the way providers perform their duties in the clinical environment,”

Did Bitcoin Enable an Explosion in Ransomware Attacks?

Now with Bitcoin, money can be collected automatically and without being tied to a bank account. While you can look at the Bitcoin blockchain and see where money goes, it becomes difficult to track it once it is passed through multiple wallets. Many use Bitcoin mixing services that split up Bitcoin and mix it with other money to confuse the tracking process. If you pass it through multiple Bitcoin wallets and mix it in with other Bitcoin, it becomes very difficult to trace. Bitcoin also makes it easier and faster for criminals to gain access to the money they steal. In the past, they might have to wait for it to transfer between bank accounts or to be physically transferred in cash. Now, they can move it around to multiple Bitcoin wallets quickly and start using it with a new email address. This allows the money to be spent before it can even be located.

Don’t like Mondays? Neither do attackers

Monday may be our least favorite day of the week, but Thursday is when security professionals should watch out for cybercriminals, researchers say. Timing is everything. Attackers pay as close attention to when they send out their booby-trapped emails as they do in crafting how these emails look. Malicious email attachment message volumes spike more than 38 percent on Thursdays over the average weekday volume, Proofpoint said in its Human Factor Report, which analyzed malicious email traffic in 2016. Wednesdays were the second highest days for malicious emails, followed by Mondays, Tuesdays and Fridays. Weekends tend to be low-volume days for email-borne threats, but that doesn’t mean there aren’t any. “Attackers do their best to make sure messages reach users when they are most likely to click: at the start of the business day in time for them to see and click on malicious messages during working hours,” Proofpoint researchers wrote in the report.

Threat Intelligence: A New Frontier in Cybersecurity

The art of bringing a high-value threat intelligence capability to market consists of the application of data science and human intervention to the raw threat feeds. It is this filtering and curation which enables the vast amount of threat data to be ignored or else responded to very quickly. It is then the same filtering and curation function that allows for the most suspicious data to be extracted from the main body of the threat data. The SecOps team's resources can then be concentrated on applying greater forensic effort around that data subset in an effort to understand the modus operandi of the most threatening adversaries -- and stay ahead of them. This is a primary area where threat intelligence providers differentiate themselves. Machine-learning algorithms leveraging standard and advanced statistical models -- and customized to cybersecurity goals -- have to be used to automatically process the many billions of security events that threat intelligence providers see.

Quote for the day:

"Failing organizations are usually over-managed and under-led." -- Warren G. Bennis

Daily Tech Digest - June 07, 2017

Kanban: Real Scaled Agility For Your Enterprise

Generally speaking, the aim of Agile scaling methods is to apply larger Agile wrappers around clusters of Agile teams in order to re-establish some kind of hierarchical structure needed to manage the interdependencies described above. Whether its a Release Train or a Nexus, or whatever else, the idea is that there is an “Agile Team of Teams” managing the interdependencies of multiple, smaller teams. As long as the total number of people doesn’t grow beyond the Dunbar number (~150), the Dunbar-sized group is dedicated and cross-functional, there is a team managing the interdependencies within the Dunbar, there are no dependencies outside of the Dunbar and there is some cadence (1-3 months) of integrated delivery—it’s still “Agile”. All of this scaling out as far as a Dunbar (and only that far) allows the enterprise to still “be Agile”—Scaled Agile.

IoT security regulation coming, warns Bruce Schneier

The real problem, however, said Schneier is that nothing incents a government to do something “stupid” like fear, which is why the information security industry has to get involved. “The choice is not between regulation and no regulation. The choice is between smart regulation and stupid regulation, and if we don’t want regulation to be imposed on us from the outside with little thought and little time, we need to start thinking about this and getting ahead of this because it is coming,” he said. “It will take just one disaster before your government, my government or both will do something, and they will do the thing they can grab the quickest, so we have to ensure that it is something that is also smart.” In the past, Schneier said security has largely been left up to the market, which although “not great” has worked “mostly OK” but these imperfect solutions have been OK because the effects of failure have been fairly limited.

3 steps to better IT career management

Historically, career advice began by counseling wannabe world-beaters that vertical market choice mattered greatly. Baby boomers need only recall Benjamin Braddock’s graduation party, where a friend of the family urged upon him this unsolicited career advice: “One word … plastics.” (Non-boomers may need to be told that we’re talking about Mike Nichols’ 1967 movie, The Graduate.) Plastics may not be the vertical of promise it once was, but there are still advantages in choosing a strong vertical market. The global economy, forecast to grow in the aggregate 3.5%, (World Economic Outlook) does not grow evenly. Some regions and some industries will grow faster than others. Situating oneself in a high-growth vertical market does not guarantee career success but increases the probability of positive opportunities.

7 Ways AI Will Revolutionize Business Travel

Once you pass through airport security, “you’re back on track timewise and decide to get a coffee and something to read,” Thompson continues. “While approaching the book store, you’re notified of special promotions based on your reading history. Then, at checkout you receive a coupon for gardening and classic car magazines, based on a recommendation system that knows these are your hobbies. “Now you’re starting to wonder why your co-worker hasn’t arrived at the gate. She receives a warning that she was in the wrong terminal and gets instructions on the quickest route to the correct gate. Location services have long been used to route planes. Now, they can also be leveraged to better move passengers along and help assure that flights are on time.”

Compliance Risks And The Fast-Growing Company

By implementing continuous accounting, which embeds the period-end tasks within accountants’ day-to-day activities, companies can mitigate their accounting and control risks. Costs are lower, since there is less need to employ additional accountants or other temporary help at closing time, while automated tools free up the accountants to provide value-added insights and services. That’s great news for fast-growing companies confronting the hodgepodge of accounting regulations and reporting standards worldwide. Rather than be the naysayer when operations come calling for capital to grow the business, the CFO is a strategic partner in the market expansion. With visibility into the flow of capital, the CFO can confidently say, “Yes, you can” do this or that as the engine of growth accelerates.

Not investing in cybersecurity has 'inverse ROI'

Clearly, there's an argument about the inverse ROI of not doing cybersecurity. It became very, very clear [that] the attack and the attack patterns were at older machines and institutions that had not patched something that was available for several months. So you can review your entire cybersecurity policy, and it may go to that level. But really this was about keeping your software licensed and current and patching things. For companies that do it right, they didn't have disruption; they didn't have to consider paying a ransom. For companies that don't do it right, they just learn what it costs to not do it right. The real lesson to be learned is that there is very much the potential for the big one. And the question is, how do organizations prepare and understand that with regard to ROI, and then how do we deal with it as a society?

Cybersecurity labor crunch to hit 3.5 million unfilled jobs by 2021

The National Association of Software and Services Companies (NASSCOM) recently estimated that India alone will need 1 million cybersecurity professionals by 2020 to meet the demands of its rapidly growing economy. Demand for security professionals in India will increase in all sectors due to the unprecedented rise in the number of cyber attacks, according to NASSCOM. Despite having the largest information technology talent pool in the world, India is highly unlikely to produce an adequate number of professionals to close the cybersecurity skills gap. "Every IT position is also a cybersecurity position now" according to the Cybersecurity Jobs Report, 2017. "Every IT worker, every technology worker, needs to be involved with protecting and defending apps, data, devices, infrastructure, and people."

Tracking Hacking: The World’s Biggest Data Breaches

Each bubble represents the number of records lost in any given breach, with the most sensitive data clustered toward the right side. Before 2009, the majority of data breaches were the fault of human errors like misplaced hard drives and stolen laptops, or the efforts of “inside men” looking to make a profit by selling data to the highest bidder. Since then, the volume of malicious hacking has exploded relative to other forms of data loss. Increasingly sophisticated hacking has altered the scale of data loss by orders of magnitude. For example, an “inside job” breach at data broker Court Ventures was once one of the world’s largest single losses of records at 200 million. However, it was eclipsed in size shortly thereafter by malicious hacks at Yahoo in 2013 and 2014 that compromised over 1.5 billion records, and now larger hacks are increasingly becoming the norm.

Key Abstractions for IoT-Oriented Software Engineering

Despite the considerable research on the Internet of Things (IoT), the technologies to make the IoT a systematic reality are far from being assessed. Early research focused mostly on communication and interoperability1. More recently, researchers have tried to facilitate the integration of resources and services toward provisioning software-defined distributed services. This is the case, for example, for the Web of Things (WoT) vision2, which aims to employ standard Web technologies to help develop coordinated IoT services. The WoT-possibly integrated with concepts from agent-based computing3,4-will likely represent a keystone technology in the IoT's future. Along such lines, several approaches (for example, in terms of supporting middleware5,6 and programming7) exist to aid IoT system and application development.

Machine learning systems are a 'land rush' of opportunity for CIOs

"There are so many opportunities that people haven't cashed in on yet," Brynjolfsson said. "And the bottleneck now is actually identifying the problems and opportunities that these technologies can be applied to most effectively." Experimentation -- such as Google turning a gaming algorithm loose on its data center to reduce power consumption -- is key. "The main error that a lot of companies are going to make is to extrapolate from the past and keep doing what they were doing with a little bit better accuracy or a little bit better precision," McAfee said. ... One thing is certain, the authors added: Machines aren't good at everything. Tasks that require creative thinking, interpersonal connections, large-scale problem solving or complex planning are still better performed by humans -- at least for now.

Quote for the day:

"When you find your path, you must not be afraid. You need to have sufficient courage to make mistakes." -- Paulo Coelho

Daily Tech Digest - June 06, 2017

Vulnerabilities Could Unlock Brand-New Subarus

There's irony in Guzman's latest findings. Last year, he had a 2016 Subaru. It lacked the telematics unit, but Subaru had a mobile app that owners could use to track vehicle maintenance. It also used a token that didn't expire, which Guzman says he reported and Subaru fixed. But the same vulnerability appeared again this year. Subaru "must have re-merged the code and reintroduced the vulnerabilities," he says. So how would an attack work? There are preconditions: An attacker would have to know, for example, that the victim has a 2017 Subaru - or later - with Starlink installed. The key to Guzman's attack is capturing the token that gets generated, and there are a variety of ways to do this. One way is by exploiting a cross-site scripting - aka XSS - vulnerability that Guzman also found.

Reverse Mentoring A Unique Approach To Rejuvenating Your IT Culture

CIOs are searching for employees skilled in the latest mobile, cloud, social and analytics tools, who can build, ship and maintain software using agile and devops methodologies. But such skillsets are in short supply at traditional enterprises whose IT workforces are long in legacy systems and short on digital capabilities. Enter digitally-savvy millennials as mentors. This younger generation, now entering the workforce, is a great resource for educating more tenured staff members on the use of new technologies, Gartner analysts Lily Mok and Diane Berry wrote in a research note earlier this year. “In return, younger staff can gain from senior staff knowledge and capabilities, such as business acumen, proper business protocol and more mature decision-making skills that come with time and experience,” the analysts wrote.

Artificial Intelligence Is About Machine Reasoning

With machine learning you will never be able to adapt to change, which is what every company is looking for. Because change equals innovation! Thus, we consider machine learning as a mathematic optimization technique, which is fully optional. Talking about a decision-making process, everything works correctly without machine learning. Thus, the machine will find a solution on its own. Machine learning can be used to make the way to the solution shorter or more efficient by applying or selecting better knowledge. That's what machine learning is used for. In our case, machine learning classifies the atomic knowledge pieces in the situation of a certain problem and prioritizes and chooses the better suited pieces to provide the best solution. Thus, machine learning helps to select the best knowledge to a specific state of a problem.

IBM Research creates a groundbreaking 5-nanometer chip

It’s a remarkable technical achievement, though a commercial version of the chip may not be possible for a while. Still, it should enable chips with 30 billion transistors, the on-off switches of electronic devices, on a fingernail-sized chip. Researchers say this kind of achievement should enable the $330 billion chip industry to stay on the path of Moore’s Law, or the prediction made in 1965 by Intel chairman emeritus Gordon Moore that the number of transistors on a chip would double every couple of years. IBM is presenting details of its research on its “silicon nanosheet transistors” at the 2017 Symposia on VLSI Technology and Circuits conference in Kyoto, Japan. The development comes less than two years after IBM researchers made a 7-nanometer test node chip with 20 billion transistors.

Healthcare CIO advocates a faster move to the cloud

CIOs have a somewhat adversarial relationship with vendors even though we need them. A lot of CIOs lose sight of that and develop a real animosity toward vendors, which I get because we're bombarded by hundreds of vendors by email and phone calls. But it simplifies the CIO's job to have a small set of partners to manage rather than a wide variety of vendors. A partnership with a select few helps you drive your organization forward, because they become thought leaders, people you can turn to whenever you have big projects. Some CIOs ask: 'How do you know you're getting the best price?' You can test it as you go along and keep the vendors from getting too comfortable with their position. But most vendors understand the importance of the partnership. And with my partners, I can call the CEO and get some action. That's comforting to know.

Lack of Experience May Plague IoT Security Startups

“What’s going on right now is enterprises are extending the existing security infrastructure or security components they have already invested in to address early IoT issues,” said IDC analyst Robert Westervelt who co-authored a new forecast that said the worldwide market for IoT security product will grow from $11.2 billion in 2017 to $21.2 billion by 2021. “Some of the issues, depending on the industry and use case, are surely embedded system security. And so that’s why we think those two segments — device and sensor, and network and edge — are going to have the most growth over the next five years.” IoT security risks vary by industry. Healthcare organizations, for example, are using IoT patient monitoring tools that rely on sensors, which collect patient health data, and then transfer this data to the cloud so a physician can analyze it.

The 7 hottest jobs in IT

“With the intense focus on predictive analytics, deep learning, machine learning, and artificial intelligence, these positions should remain relevant for years to come,” says Flavio Villanustre, vice president of infrastructure and security for LexisNexis Risk Solutions. ... “To the best of our knowledge, it’s not clear how we can build machine learning models where only limited amount of data is available,” says Mehdi Samadi, CTO of Solvvy. “This is currently limiting the types of intelligent applications that we expect to see in the near future. The solution to this problem is either to find approaches that help us to generate data, or building more robust machine learning models which can learn from limited data. Transfer learning algorithms, learning from the data available in other domains in order to perform well in a new domain,” is a promising area for engineers, says Samadi.

Jindal Power And Steel Is Becoming Steel Smart With IoT

What Jindal Steel and Power has done at its Angul plant is enable an Industrial Internet of Things (IIoT) setup by creating a network of machines, advanced analytics, supply chain and people. The World Economic Forum, in its 2015 report, called IIoT— the latest wave of technological change that will bring unprecedented opportunities, along with new risks, to business and society. “The IoT framework helps the steel plant work smart,” says Anand. The framework helps the plant workers at the Jindal Steel and Power Plant in Angul to monitor the health and status of the machines. It also provides the interoperability of mobile devices with control systems to ease real time remote management. “The IoT allows the real time process monitoring and control on local network and creates an interface to the mobile devices and analytics layer,” says Anand.

It's About Time: Where Attackers Have the Upper Hand

Researchers found a broad range of incident response time among businesses. In half of the successful data breaches, it took five to six weeks or less for defenders to detect malicious activity. In the other half, detection took as long as four years. "Half of [breaches] are dealt with in the first 38 days, which is actually pretty good," says Barbara Kay, senior director of product and solutions marketing at McAfee. "It could be better, but it's not too bad." However, she continues, the four-year window in this data indicates there's a lot of activity in infrastructure that goes undetected for a long time. This is a sign of threat actors hidden deep within the business, which will take "deep hunting" to root out. The longest timeframe will typically be with the most sophisticated type of attacker, Kay adds. Someone who is deep within the network for a long time either wants something or has a vendetta against the company.

How Computer Security Pros Hack The Hackers

The secret to hacking is there is no secret. Hacking is like any other trade, like a plumber or electrician, once you learn a few tools and techniques, the rest is just practice and perseverance. Most hackers find missing software patches, misconfigurations, vulnerabilities, or social engineer the victim. If it works once, it works a thousand times. It’s so easy and works so regularly that most professional penetration testers quit after a few years because they no longer find it challenging. In my 30 years of professional penetration testing, I’ve hacked into every single company I’ve been hired to legally break into in three hours or less. That includes every bank, government agency, hospital and type of business. I barely got out of high school, and I flunked out of an easy college with a 0.62 grade average. Let’s just say I’m no Rhodes scholar.

Quote for the day:

"Never make someone a priority when all you are to them is an option." -- Maya Angelou