Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - July 03, 2017

The numbers don’t lie: Why women must fill the data scientist demand

Being able to inspire a team and see the big picture are both important. A data scientist must be able to not only collect and analyze data but draw meaningful insights and understand what it means for the company. The ability to holistically view a situation is a competitive differentiator for organizations as well as a positive attribute that many women possess. Once we begin associating a variety of skills with data science, the perceptions of our industry can change. According to the Washington Post, women now make up 40 percent of graduates with degrees in statistics – a popular starting point for a career in data science. While a degree in mathematics is a great place to start, it’s important not to categorize the position as being completely scientific and technical, only suited for individuals who excel at math and science.

Global Risks in 2040: Q&A with Andrew Parasiliti

The center recently undertook an effort to envision the world in 2040, and the security challenges that will shape it: artificial intelligence, 3-D printing, the accession of the millennial generation, and the sheer speed with which our society moves and makes decisions. The lead investigators are all early-career researchers, drawn from fields as diverse as nuclear strategy, anthropology, and microeconomics. ... We have more projects underway on artificial intelligence. We're working on a study about how the growth in communications technology, the Internet of Things, and big data are all redefining and compromising privacy, and what that means for security. We are, in general, interested in the changing nature of power and governance in the international system, and, increasingly, how that links up with the challenge of what Michael Rich, RAND's president and CEO, has been calling “truth decay.”

UK tech sector urges public to embrace robots in the workplace

UK tech experts say that the appeal of robotics and AI has the potential for reducing menial tasks in the workplace. In fact, 85% of respondents think that the biggest benefit of robots will be increased efficiency, with a further 40% of the opinion that these efficiencies will be felt in the wider UK job market. A fifth of respondents (21%) think robots will actually create job opportunities, where 20% said it will reduce job opportunities. “Robots and AI have the potential to save tech professionals from menial tasks and free up their time considerably. Humans are capable of so much more than administrative paper pushing, so if robots are able to alleviate some of these pressures, who knows what more we can achieve,” commented Tom Butterworth, managing director of Silicon Valley Bank’s Early Stage Practice.

The Internet of Things will power the Fourth Industrial Revolution

By 2020 more than 50 billion things, ranging from cranes to coffee machines, will be connected to the internet. That means a lot of data will be created - too much data, in fact, to be manageable or to be kept forever affordably. Gateways can help; they not only dispatch traffic but carry out some analytics functions, so that data can be better managed. For example, they could be used to filter out ‘normal’ data over time and to look for unusual patterns which may indicate a problem. They can also improve the costs of the transmission and storage of all that data. In next-generation network technology, these gateways will be used dynamically as part of the network where and when needed. But this brave new world is not without its challenges. One by-product of more devices creating more data is that they are speaking lots of different programming languages.

Robotics, Dentistry and the Future

Robotics is also making dental implant surgeries safer, quicker and more precise. In fact, pairing robotics with digital 3-D mapping using 3-D printers makes work easier by multitudes. Models produced through 3D Printers for implant procedures make for finely detailed end-results. These 3-D Models can be the best surgical guides. These can be used for not just pre-surgical planning assistance but also to provide inter-operative positioning verification. Again, supporting the fact that instead of feeling threatened by technology and dental robotics, dentists need to embrace this growing field with open arms. Another emerging trend is the use of nanobots. These bacteria sized robots help perform procedures that normally would not be possible by the human hand.

Introducing wait stats support in Query Store

Nobody likes to wait. SQL database is multithreaded system that can handle thousands of queries executed simultaneously. Since queries that are executed in parallel compete for the same resources (tables, memory, etc) they might need to wait for the resources to be available to proceed with execution. These cumulative waits can be very large and downgrade the whole database performance. There are more than 900 wait types in SQL Server. Some are more important/frequent than others. For a long time, the only way you could get closer to understanding what is waiting bottleneck of your workload was to look at instance (sys.dm_os_wait_stats) or recently added session (sys.dm_exec_session_wait_stats) level wait statistics. These options have certain limitations and might not provide optimal experience

Artificial intelligence turns critical for banks facing nimble fintech rivals

For traditional banking institutions facing competition from fintech players which are more nimble, AI is a critical tool to improve customer experience. One such example of this is facial recognition technology, which is 10 to 15 times more accurate than human beings at identifying people. In its several other forms, such as advanced virtual assistances and voice assistants, AI software is proving to be faster and better than service agents in responding to customer queries and emails at the contact center level. Australia’s Westpac is using visual recognition to enable customers to activate their new cards via their smartphones. Barclays have been using voice recognition to authenticate telebanking customers, adding another layer of security to its processes. Japan’s Mizuho Bank and Mitsubishi UFJ are using AI-based robots to manage their front desks and take care of routine customer queries.

Risk analytics enters its prime

Recognizing the value in fast and accurate decisions, some banks are experimenting with using risk models in other areas as well. For example, one European bank overlaid its risk models on its marketing models to obtain a risk-profitability view of each customer. The bank thereby improved the return on prospecting for new revenue sources. A few financial institutions at the leading edge are using risk analytics to fundamentally rethink their business model, expanding their portfolio and creating new ways of serving their customers. Santander UK and Scotiabank have each teamed up with Kabbage, which, using its own partnership with Celtic Bank, has enabled these banks to provide automated underwriting of small-business loans in the United Kingdom, Canada, and Mexico, using cleaner and broader data sets. Another leading bank has used its mortgage-risk model to provide a platform for real estate agents and others providing home-buying services.

Blockchain for mainstream banking

It is indeed strange to note that the arrival of Bitcoin and the likes were to create an independent currency mechanism apart from central bank controls. However, today, central banks are keen to explore how the adoption of blockchain technology can help make the financial system more transparent, fast, efficient, and secure and track every piece of hard currency (such as the British pound and yuan) travelling through the financial system in real time. This is virtually impossible at the moment. Here in Malaysia, Bank Negara Malaysia (BNM) implemented a fintech regulatory sandbox which took effect in October 2016. BNM recognises the potential of new methods and technology that are emerging so rapidly, and is encouraging local banks to explore and experiment without fear. With central banks having interests in the blockchain game, we have better confidence in this matter.

Avoid these 5 IT vendor management worst practices to avoid IT audit trouble

Determining how and for what an IT vendor gets paid can provide great insight on how effectively an organization manages these groups. I’m not saying this just because I am a CPA. But because I am one, I’ve had the opportunity to perform audits of these invoices and experienced many invoice surprises. Like with many business processes, some discrepancies are truly honest mistakes and misunderstanding of contract provisions. Unfortunately, not everything is. Not only should organizations recalculate the mathematical accuracy of invoices and compare the calculation to the contract, but they should very the source of the information (e.g., number of transactions) provided. If you can’t gain satisfaction over the integrity of your vendor’s billing process, you probably will also have a vendor service delivery oversight problem as well.

Quote for the day:

"Progress doesn't come from early risers; progress is made by lazy men looking for easier ways to do things." -- Robert Heinlein

Daily Tech Digest - July 02, 2017

What makes identity-driven security the new age firewall

Using a proprietary algorithm, Microsoft Advanced Threat Analytics works round the clock, continually grasping behaviour of organizational entities, such as users, devices, and resources, and helps customers adapt to the changing nature of cybersecurity attacks. In addition to this, the technology enhances threat and anomaly detection with the Microsoft Intelligent Security Graph, which is propelled by enormous amounts of datasets and machine learning in the cloud. “Identity is the new firewall. If you are taking a traditional end point/device protection approach then you are short changing your organization goals. It is critical to understand that the perimeter of IT includes users, apps across cloud and on premise, and most importantly data. Identity is what can help secure this perimeter,” says Rajiv Sodhi

Enabling IoT Ecosystems through Platform Interoperability

To enable interoperability for IoT platforms on the cloud, fog, or device level, the BIG IoT API offers a well-defined set of functionalities. Seven functionalities are crucial. The first is identity management to enable resource registration. The second is discovery of resources according to user-defined search criteria. The third is access to metadata and data (data pull as well as publish-and-subscribe for datastreams). The fourth is tasking to forward commands to things. The fifth is vocabulary management for semantic descriptions of concepts. The sixth is security management, including authentication, authorization, and key management. The seventh is charging that allows the monetization of assets through billing and payment mechanisms.

Artificial Neural Networks (ANN) Introduction

We recognize images and objects instantly, even if these images are presented in a form that is different from what we have seen before. We do this with the 80 billion neurons in our brain working together to transmit information. This remarkable system of neurons is also the inspiration behind a widely-used machine learning technique called Artificial Neural Networks (ANN). Some computers using this technique have even out-performed humans in recognizing images. ... An ANN model is trained by giving it examples of 10,000 handwritten digits, together with the correct digits they represent. This allows the ANN model to understand how the handwriting translates into actual digits. After the ANN model is trained, we can test how well the model performs by giving it 1,000 new handwritten digits without the correct answer.

Alibaba: Building a retail ecosystem on data science, machine learning, and cloud

The war in retail has long ago gone technological. Amazon is the poster child of this transition, paving the way first by taking its business online, then embracing the cloud and offering ever more advanced services for compute and storage to thirrd parties via Amazon Web Services (AWS). Amazon may be the undisputed leader both in terms of its market share in retail and its cloud offering, but that does not mean the competition just sits around watching. Alibaba, which some see as a Chinese counterpart of Amazon, is inspired by Amazon's success. However, its strategy both in retail and in cloud is diversified, with the two converging on one focal point: data science and machine learning (ML).

The Future is Imminent: 9 Design Trends for 2018

For those uneducated graphic designers in the audience, the term synesthesia refers to the perceptual condition of mixed sensation; a stimulus in one sensory modality (like hearing) involuntarily elicits a sensation or experience in another sensory modality (like smell). A person with synesthesia might hear a bird chirping and all of a sudden smell the scent of popcorn, or taste the flavor of mint, or feel the sensation of floating. ... A progress spectrum is a far more natural way of measuring “progress.” Instead of breaking up the user experience into unnatural, linear, paginated steps, a progress spectrum reflects the true experience of the user, one in which progress is experienced along a broad and continuous spectrum, where one event seamlessly flows into the next.

The Cyber-frauds

A mobile wallet works like an electronic prepaid card and can be used to pay for things ranging from grocery to rail tickets without the need to swipe the debit/credit card. All you have to do is to key in the username and password for logging in. The app can be loaded with money either through debit/credit card or net banking. The flip side is that these wallets mostly rely on the phone's locking system for security and don't ask for any PIN or password while the payment is being made. ... Rahul Gochhwal, co-founder of Trupay, says, "The biggest security issue is lack of second factor of authentication (password) while transacting. This makes them vulnerable to system-level breaches as transactions can be system generated by a hacker without a password. Thus, technically, a hacker can make thousands of fraudulent transactions simultaneously."

What every CIO Needs to Know About Cyber Resilience

Bohmayr & Türk, from the Boston Consulting Group, write that “cyber-resilience in an organization must extend beyond the technical IT domain to the domains of people, culture and processes. A company’s protective strategies and practices should apply to everything the company does — to every process on every level, across departments, units and borders, in order to foster an appropriately security-conscious culture.” ... The issue of board responsibility and oversight of cyber risks isn’t new. In 2015, the Cybersecurity Disclosure Act of 2015 bill was introduced in the US Senate. The bill would have required “public companies to disclose whether any board member has experience or expertise in cybersecurity, and to describe the nature of that background” and should no board director have cybersecurity expertise, to justify why such expertise was unnecessary.

Security in a silo – breaking down the barrier between CISOs & C-Suite

If you’ve been in the security industry for any length of time, and as a CISO I assume you have been, you’ve probably already seen and read such articles… but if you are still reading this, it probably means that you don’t feel like this is yet a reality within your organisation. So, with the shared understanding that we are both in agreement that this shift is past due, we can start to talk about building your strategy to make it happen. Before doing so, however, we need to acknowledge a sobering truth: People don’t care about security for the sake of security alone. What they care about is the result that a sound security strategy can provide and the impacts/risks associated with the lack of a sound security strategy. We’ll use this understanding to inform the methods that we use to engage the organisation and our board.

The Hard-Dollar Benefits of GRC Consolidation

The intention of implementing a single platform architecture must come from an IT vision for rationalizing applications in use across the company. Instead of supporting potentially hundreds of applications that each do only one thing, the GRC infrastructure, in time, should comprise one cohesive platform that supports many functions. GRC applications tend to span activities and departments within organizations. Groups across the company often independently manage activities such as risk assessments, audits, controls testing and third-party assessments. To do this, they make use of many individual solutions – some of which do the same thing, just in different organizational silos. For secure business management, this colossal set of single-use applications has to be visible, managed, supported and maintained. This is something that is both costly and time inefficient.

The Computest Story: The Transformation to an Agile Enterprise

Inspired by Henrik Kniberg & Anders Ivarsson's famous article on how Spotify scaled their development organization we decided to put multidisciplinary teams in the center, supported by a group of people outside the teams focusing on coaching and fulfilling company-wide responsibilities. As Figure 2 indicates, the major difference in the first transformation step was to integrate as many central functions in interdisciplinary teams as possible, to structure them by industries and to differentiate the leadership group in 'captains' and 'coaches'. Whereas the captains took over social leadership for the teams as well as responsibility for resource and account management, the coaches formed a group of thought leaders with a broad variety of subject matter expertise, responsible for both policies and solutions.

Quote for the day:

"Thinking is the hardest work there is, which is probably the reason so few engage in it." -- Henry Ford

Daily Tech Digest - July 01, 2017

Windows 10 to Get Built-in Protection Against Most Ransomware Attacks

In the wake of recent devastating global ransomware outbreaks, Microsoft has finally realized that its Windows operating system is deadly vulnerable to ransomware and other emerging threats that specifically targets its platform. To tackle this serious issue, the tech giant has introduced a new anti-ransomware feature in its latest Windows 10 Insider Preview Build (16232) yesterday evening, along with several other security features.... The anti-ransomware feature, dubbed Controlled Folder Access, is part of Windows Defender that blocks unauthorized applications from making any modifications to your important files located in certain "protected" folders. Applications on a whitelist can only access Protected folders.

How IoT is empowering the elderly to become healthier and more productive

The central feature is the use of a personal dashboard for the patient, with a personalized treatment plan. The steps are then sent to smart devices to notify patients when they need to inject insulin, for instance. "It provides the healthcare team, not only the raw data, like the glucose reading or the insulin activity level," he said. "It provides everything that we collect from the patient. It actually provides them with all kinds analytic insights, diagnostics, and treatment plans." It's a "patient-involved system," he said, that can crunch numbers based on the AI engine to deliver specific recommendations. It will say "the intervention will be to take those medications at that time, at that dosage, and that they should follow up in one week, two weeks, etc.," he said. Still, the physician remains the ultimate gatekeeper, and can override the system if necessary.

Master data management driving better business decisions

While there is still a lot of excitement about new technologies such as cloud and graph database replacing so called “legacy” technologies, in reality the boring but strategic business processes of onboarding customers and suppliers, and transacting with your customers and suppliers remain fundamental business requirements that cannot be ignored. And these business fundamentals are greatly enhanced by the quality data that MDM brings to the equation. It seems as if the very large scale ($100 million and up) MDM programs or not as widespread as they were three to five years ago, which is causing some stress on the software vendors and the systems integrators. Many of the MDM programs we see are increasingly tactical rather than enterprise in nature.

Under pressure: Is it now make or break for net neutrality?

“We’ll see more pressure on regulators to adopt the US measures, as operators and content providers lobby for less regulation,” says Martin Morgan, VP marketing at Openet. “Operators have paid huge sums of money for spectrum and invested in rolling out 4G networks. With data becoming commoditised they’ll be looking for more innovative ways to deliver content services.” To do that they will of course have to keep a close eye on what’s going on in the US. Michael Hekimian, a legal director at law firm Ashfords says that the US will now become the “acid test” for new business models and in particular any alternate pricing models. If ISPs and content providers manage to improve services to consumers without raising prices and being anti-competitive then expect to see pressure on global regulators mount.

Active Cyber Defense Will Help Deter Future Threats

Retaliation is a response to a cyberattack that could manifest any number of ways. Responses include a mix use of sanctions, cyber responses like a direct “hackback” on the offender, and even a conventional kinetic attack in extreme cases. ... Denial is a form of active cyber defense in which an entity has such formidable cyber defenses that it removes the incentive of carrying out an attack, thus leaving little motive to carry out any further attacks. Denial processes include a cyber kill chain, where a company receives notification of an attack at multiple stages and is thus able to stop it. ... The third form of deterrence is entanglement, or norms created to regulate cyber behavior. Entanglement is a necessity for looking to prevent cyberattacks by state actors as it introduces accountability into their decision-making calculus.

Biometrics: Moving Far Beyond Fingerprints

Organizations have struggled for decades to find security tools that kept out bad guys while admitting authorized persons. This is both a physical security and cybersecurity issue. But, Dunkelberger adds, thanks to the impact of biometrics over the past few years, security is no longer quite as difficult. “Every day,” he says, “millions of people interact with a sliver of glass in their pocket that will tell them everything from the current age of the universe to when their shampoo will be delivered to their doorstep to how much money they have in their retirement account. Each of these interactions, thanks to biometrics, can be accomplished seamlessly and without friction. No longer are they required to create and remember a highly entropic code to use as a shared-secret; now they can simply look at that sliver of glass and blink.” Biometrics are changing the way we think about security.

The latest cyberattack is more than it seems

It transpired soon that the malware's developers didn't really want the money. There was a single email address specified for contact with the hackers, but it was soon blocked by the service provider, as usually happens in these cases. Besides, it turned out that the virus encrypted the victims' hard disks without the possibility of recovery. That's odd: An attacker who wanted money would have taken care he could receive it; or at least would have demonstrated his ability to decrypt the files. So cui bono; who benefits from this? Ukrainian officials were quick to accuse Russia of waging cyberwarfare against their country -- but that's almost white noise these days, coming from Kiev, and many observers were confused by the malware's seeming geographic indifference. It hit large Russian companies, too -- the state-oil giant Rosneft and the giant steelmaker Evraz, among others.

Advertisers are closer to knowing exactly where you are

Chris Clarke is chief creative officer at International DigitasLBi and he has strong words about what is an increasingly important part of his agency’s business. “The whole industry is talking data, and yet there remains a huge gulf between promise and proof,” he says. “Basic accuracy has been a huge issue with geolocation and elsewhere there's the issue of insight. The smartest operators are bringing multiple data sources together and looking for anomalies that lead to creative insight. Get this right and the outcome is relevant, useful and charming. Get it wrong and it's spooky, or just wrong.” Another interesting London company in the space is LoopMe, a mobile video platform that is driven by AI, employing algorithms that optimise ad placements in real time. It claims it can reach three billion consumers worldwide. LoopMe recently launched PurchaseLoop Foot Traffic, which uses AI to deliver video advertising at the moment customers are most likely to head to a store.

Machine learning is transforming lending

The front-end provides APIs for connectivity to the banks' own operational processes. This is where CapitaWorld's operational efficiency model also claims strengths. The fully digital form with inbuilt validated information creates efficiency through reduction in human-resource intensive processes. The queue time reduces from weeks to hours. ... And finally the credit decision process itself. The model is based on machine learning. Prior decisions and rules as well as portfolio performance are captured by the platform. The vastly superior computing power today enables multiple hypotheses building and analysis. This in turn sets up new decision outcomes. What this also does is that pricing and risk decisions can be taken on much smaller sets of customers and even at an individual level. It is a step away from a standard Annualized Percentage Rate model. Imagine if your credit card interest rate was specific to you, based on your past behaviour.

Take Care of Yourself: CISO Self Care During Wartime

The challenge for Security leaders is that most organizations don’t really know what they want from their CISOs. During times of peace they want a diplomat — someone who can sit in the C-suite and talk about business objectives in non-technical terms. But when EternalBlue comes calling, they want a Commander-In-Chief/General/Drill Sergeant/Grunt to just make it all go away. The result is a CISO who has to bungee between the front lines and the corner office in the space of an hour. And make it look like you have complete control, because, you know, Leadership. ... Seriously, anyone in Security, and particularly the Security Leader, needs to have a significant support structure and coping mechanisms if they’re going to survive in the role which go beyond “take care of yourself”. Surround yourself with colleagues who can not only sympathize, but can help you find a way to emerge from a crisis with your sanity in tact.

Quote for the day:

"Don't raise your voice, improve your argument." -- Desmond Tutu

Daily Tech Digest - June 30, 2017

What is Docker? Linux containers explained

Containers decouple applications from operating systems, which means that users can have a clean and minimal Linux operating system and run everything else in one or more isolated container. Also, because the operating system is abstracted away from containers, you can move a container across any Linux server that supports the container runtime environment. Docker, which started as a project to build single-application LXC containers, introduced several significant changes to LXC that make containers more portable and flexible to use. Using Docker containers, you can deploy, replicate, move, and back up a workload even more quickly and easily than you can do so using virtual machines. Basically, Docker brings cloudlike flexibility to any infrastructure capable of running containers. Thus, Docker is often credited for the surging popularity of modern-day containers.

Teardown of 'NotPetya' Malware: Here's What We Know

The malware can spread by using two attack tools built by the "Equation Group" - likely the National Security Agency - and leaked by the Shadow Brokers. The tools generate packets that attempt to exploit an SMB flaw in prior versions of Windows. "The new ransomware can spread using an exploit for the Server Message Block (SMB) vulnerability CVE-2017-0144 (also known as EternalBlue), which was fixed in security update MS17-010 and was also exploited by WannaCrypt to spread to out-of-date machines," Microsoft says. "In addition, this ransomware also uses a second exploit for CVE-2017-0145(also known as EternalRomance, and fixed by the same bulletin). "Machines that are patched against these exploits (with security update MS17-010) or have disabled SMBv1 are not affected by this particular spreading mechanism."

Eight obstacles to overcome in your digital transformation journey

"Digital transformation involves a significant change, and usually changes to people's jobs, compensation, bosses, and the type of work they do," said Marc Cecere, vice president and principal analyst on Forrester's CIO role team. "Making that kind of change is difficult, and is something where there is not a lot of science. Make sure you have someone on board who knows how people's minds are changed, and how to adapt to new business models." Organizational siloes are one of the biggest impediments to digital transformation efforts, in terms of understanding the customer journey, said Gianni Giacomelli, chief innovation officer at Genpact, and head of its Genpact Research Institute. Often either the IT group or the business lines try to solve it, and do not work together deeply, Giacomelli said.

Critical Infrastructure Protection: Security Problems exist despite compilance

The electronic security perimeter (ESP) is the control systems, server room, telecom room and so on. The critical cyber-assets will fall under this section of CIP. For the most part, entities covered by CIP will spend a good deal of time and energy constructing a hard exterior (the ESP), but assets contained within – the guts – are soft. "We're talking fairytale darkness here, all of the stuff you see on television when the power grid goes down, that's going to happen when the ESP is successfully breached," Grimes said. You would think that the ESP would be the ultimate hard point, but it isn't in most cases. physical access controls (PACs) are not covered under the ESP section. For example, video cameras are a weak point, as they're not considered when it comes to the ESP.

Global shipping feels fallout from Maersk cyber attack

The impact of the attack on the company has reverberated across the industry given its position as the world's biggest container shipping line and also operator of 76 ports via its APM Terminals division. Container ships transport much of the world's consumer goods and food, while dry bulk ships haul commodities including coal and grain and tankers carry vital oil and gas supplies. "As Maersk is about 18 percent of all container trade, can you imagine the panic this must be causing in the logistic chain of all those cargo owners all over the world?" said Khalid Hashim, managing director of Precious Shipping (PSL.BK), one of Thailand's largest dry cargo ship owners. "Right now none of them know where any of their cargoes (or)containers are. And this 'black hole' of lack of knowledge will continue till Maersk are able to bring back their systems on line."

How to write event-driven IoT microservices that don’t break

One concept that jumped out at me was the notion of a “heisenbug,” which the article defines as “timing-related bugs that often disappear during an investigation of it.” The term “heisenbug” stems from the analogy of physics’ Heisenberg Uncertainty Principle, under which the attempt to observe a system inevitably alters its state. Where computing environments are concerned, heisenbugs are equivalent to probe effects, in which attaching a test probe—or simply sending an asynchronous test ping—to a system changes its behavior. What that implies is that the very act of trying to isolate, analyze, and debug some systemic glitches will alter the underlying systemic behavior of interest—perhaps causing the bugs in question not to recur. One of the chief causes of heisenbugs are race conditions, under which a system behaves erratically when asynchronous input events don’t take place in the specific order expected by that system’s controlling program.

Blockchain remains a work in progress for use in healthcare

Blockchain has inherent qualities that provide trust and security, but it is not a technological panacea for all that ails healthcare when it comes to cybersecurity, believes Debbie Bucci, an IT architect in ONC’s Office of Standards and Technology. “When I look across other industries, I don’t see any of them really aggressively adopting it,” says Bucci, whose primary focus is on the privacy and security aspects of health information exchange. “There’s a lot of proof of concepts, pilots and use cases being defined. But, I have yet to see major companies stepping up to support blockchain—beyond Bitcoin, of course.” According to Bucci, ONC continues to keep a close watch on what develops in the marketplace when it comes to blockchain, which is still evolving and maturing, especially with respect to its applicability to healthcare.

The 360 degree approach to cyber security

In order to take the right security measures, you need to understand where to direct your attention. A good start is to assess who the potential adversaries are, and what damages a security compromise can cause – a risk analysis if you will. Getting a full view of the attack surface is an integral part of this, but it’s not easy. Many companies don’t even know their digital footprint, leaving them unaware of potential entry points for attackers and threats. Plus, the IT systems in many companies have grown organically, resulting in intertwined systems, outsourced infrastructure, and 3rdparties that are digitally connected and integrated with business processes. Keeping all of this under rigid control is virtually impossible. And while there are technical solutions that provide the visibility you need, just mapping your digital footprint isn’t enough.

Five DevOps principles to apply to enterprise architecture

Because DevOps breaks down barriers that traditionally separate various teams within an IT organization, individual roles need to be malleable. For example, someone whose job title is "developer" should have the organizational flexibility to participate in IT operations work when needed. DevOps is about cultural practices, not specific technologies or tools. Still, DevOps works best when the IT team has modern, agile tool sets and frameworks at its disposal. For example, migrating from virtual machines to containers can help your organization manage DevOps more effectively. When designing your enterprise architecture, controlling access to sensitive information about the infrastructure or the data stored on it is important. But this need should be balanced against the importance of maximizing visibility across the organization.

Medical Device Cybersecurity: A Long Way to Go

In a statement provided to ISMG, the FDA says it generally does not comment on specific studies, "but evaluates them as part of the body of evidence to further our understanding about a particular issue and assist in our mission to protect public health. The FDA is carefully reviewing the findings of the report. The FDA takes medical device cybersecurity seriously , and we look forward to engaging directly with the sponsor of the report so we can have a better understanding of the report's data, methodologies of information collection and conclusions." The FDA also notes: "Medical device manufacturers must comply with federal regulations. Part of those regulations, called quality system regulations, require that medical device manufacturers address all risks, including cybersecurity risk.

Quote for the day:

"Do not be concerned that no one recognizes your merits; be concerned that you may not recognize others." -- Confucius

Daily Tech Digest - June 29, 2017

On-premise or In the cloud? Most suitable location for apps in a hybrid environment

If the application, or the data it processes, is subject to regulatory oversight under compliance regimes such as HIPAA or PCI, then there is a clear need to understand the security compliance status of that application, and if moving it to the cloud will risk a compliance violation. For example, HIPAA requires accountability practices on all Local Area Networks, Wide Area Networks, and for users accessing the network remotely through a Virtual Private Network (VPN). If the application needs to be compliant with PCI, you will need to have a firewall at each Internet connection the application uses, and between any network demilitarised zone and the internal network zone. Applications under this regulation, and others, are not ideal candidates for migration to the cloud.

Building AI: 3 theorems you need to know

Combined with the no-free-lunch-theorem, we realize this is the only way to create an effective learner: change its inductive biases so it can become effective for something else, namely, our data. Inductive biases also have to do with the problem of overfitting. In machine learning, overfitting occurs when your model performs well on training data, but the performance becomes horrible when switched to test data. Overfitting happens when you apply incorrect inductive biases in a model. If the equations of the model truly reflect the data (for example, a linear model applied to data generated by a linear process), then any fit will be a correct fit for test data. In a way, the model – in its very architecture – contains knowledge about the data. Such a model can learn very fast; with only a few data points, it can begin generating accurate predictions.

This Cell Phone Can Make Calls Even Without A Battery

There is still a long way to go before that happens. The phone has a basic touch-sensitive number pad and its only display is a tiny red LED that glows briefly when a key is pressed. A large touchscreen would require around 400 milliwatts—over one hundred thousand times as much as power as Talla's phone currently needs. Most importantly, voice calls are still awkward. You have to press a button, walky-talky style, to switch between listening and talking, and sustaining a conversation through clouds of static is near impossible. Talla promises better call quality and an E-Ink display for text messages on the next generation device, possibly along with a camera to snap selfies. Smith says that even as the prototype stands, built from off-the-shelf components, it is much cheaper than a normal phone.

The Internet of Things is Revolutionizing Tracking and Receiving Packages

In a perfect world, pressing a button in your bathroom when you are out of toilet paper only to have a drone drop it on your doorstep hours later is the height of convenience. You don't even have to make a shopping list or tie a string around your finger in order to remember this often-forgotten necessity. But when you have to worry about someone driving by and seeing the toilet paper on your doorstep, realizing they are also out of toilet paper, and taking it for themselves, this stops being a convenience and instead becomes another burden of daily life. Going to the store on your way home is certainly preferable. The Internet of Things has come up with a number of solutions to stolen packages. So far the doorbell camera seems to be one of the most popular choices, followed by sitting at home waiting for your package to arrive.

Rise of the Machines

Move over R2D2 – robots are no longer just the stuff of sci-fi. They’re already here, and whether it’s through advancing drug design or charting the oceans, UK technology is transforming the impact that robots are having on our lives. At STFC, we’re helping to develop robots that can combat world hunger and explore the universe. Our research is driving forward the field and bushing the boundaries of what robots can do. Meanwhile, a whole variety of other UK-funded research is developing robots for use in medicine, disaster relief, deep sea exploration and so much more. Robots are helping us to achieve incredible things, and they’re changing the world around us in ways that nobody – not even George Lucas himself – could have predicted.

Can Design Thinking Unleash Organizational Innovation?

Design thinking’s ability to uncover customers’ unarticulated needs and its processes for testing potential success with small inexpensive experiments provided the framework they needed. The team ultimately focused on three core design principles: “customer empathy,” “go broad before narrow” and “rapid experimentation.” I love the phrase: “Uncover customers’ unarticulated needs.” The heart to any organization looking to become more innovative and creative in their thinking is to “uncover customers’ unarticulated needs.” It is likely the biggest operationalization challenge when it comes to integrating data science into an organization’s business models; to help organizations to become more effective at leveraging data and analytics to uncover their customers’ unarticulated needs.

Microsoft Cognitive Services brings cloud AI to the enterprise

The learning curve for Microsoft Cognitive Services is minimal for developers already familiar with building cloud applications, and those who are unfamiliar can integrate Cognitive Services with Azure Logic Apps with minimal coding. Still, these services aren't without their challenges. For example, it can be difficult to connect cloud-based applications with internal data sources, whether they reside on central databases or are distributed across remote systems and sensors. Implement a hybrid network and data integration strategy before you deploy production AI applications. Developers should also use Microsoft's free service tier to become familiar with the AI services, APIs and SDKs and to build and test applications.

‘Separating IT and cyber security: A necessity not a nice to do’

Cyber security and IT responsibilities must be separated in order to provide adequate checks and balances and ensure that existing cybersecurity measures are effective in protecting the business against a variety of malware and ransomware. In most organisations, IT departments are responsible for configuring and maintaining on-premises network infrastructures and cloud based systems, so they cannot also be responsible for verifying the security of these networks. This situation would be akin to asking a payroll professional to audit their own entries – in short, it’s simply not appropriate. When a business reaches a certain size, it will almost certainly engage with two separate accountancy firms, one to file its taxes, and another to complete its annual audit. The two very rarely interact, and it is unlikely that businesses would entrust the same firm with both responsibilities.

Security in a cloud-native environment

If you are architecting a cloud solution that can scale to support large volume, can run across different data center instances, and can be provisioned semi or fully automatically, you need to consider security as one of the core building blocks of your architecture. Cloud-native microservices are growing in numbers exponentially, and the rise of IoT is making ways to create more and more interfaces and service endpoints—this makes it more critical to secure application endpoints based on role-based authentication. Every incoming request knows the caller and its role with respect to the called application endpoint. These roles essentially determine if the calling client has enough privileges to perform the requested operation on the called application.

Life As An IT Contractor

Jerry McKune, an independent IT contractor based in the St. Louis area, said he appreciates the variability of IT contracting and the opportunity to keep learning new skills. “I love variety. I cannot stand to do the same thing over and over and over again. There’s a lot of variety in the contract world.” The challenge of variety, however, is that each new assignment means a new learning curve. “Education takes time,” McKune said. “If you’re on a six-month contract, and there’s a four- to five-month learning curve, there’s only going to be a short period of time at the end of it where you really know what you’re doing and you’re capable of performing the tasks assigned to you without help from somebody else.” Learning to rely on other people and not being afraid to say you don’t know something are essential traits.

Quote for the day:

"The only person you should try to be better than, is the person you were yesterday." -- Tim Fargo