Daily Tech Digest - July 24, 2017

The Skills And Traits Of A Next Generation CIO

"Back then, when you searched for 'customer experience officer' on LinkedIn, mine was the only name that showed up," says Lindberg, who was recently appointed president of Kobie Marketing, a provider of loyalty program solutions. "Now there's something like 37,000 of us." Over the past ten years the number of digital customer touchpoints -- and the data associated with them -- has exploded. CIOs who see their primary function as managing internal IT systems are not in a position to deliver the information businesses need to improve the customer experience, she says. "If you're a CIO who hasn't made the realization that we are multiple years into the age of the customer, then it's time to shop for a new job," says Lindberg. "You have to understand the customer's wants and needs. That's why one of the first things I do upon walking into an organization is figure out how to connect the CIO to the live voice of the customer on an ongoing basis."


Cisco Security Report: 34% of Service Providers Lost Revenue from Attacks

DeOS attacks’ “aim is not just to attack, but to destroy in a way that prevents defenders from restoring systems and data,” writes David Ulevitch, SVP and GM of Cisco’s security business, in a blog post. Security researchers watched the evolution of malware during the first half of 2017. Attackers increasingly require victims to activate threats by clicking on links or opening files, the report says. Additionally, they are developing fileless malware that lives in memory and is harder to detect or investigate as it is wiped out when a device restarts. Adversaries are also relying on anonymized and decentralized infrastructure, such as a Tor proxy service, to obscure command and control activities. The report notes an increase in spam volumes, in which attackers use email to distribute malware and generate revenue. This coincides with a decline in exploit kit activity since mid 2016.


Consumers Welcome AI, Despite Lingering Privacy Concerns

In a world where more than four billion records of personal information were stolen or lost during 2016 and data breaches at large corporations dominate news headlines, privacy has become a hot-button issue for any new technology, including AI. Although consumers remain concerned about protecting their privacy and the vulnerability of their personal information, most are more interested in the potential for positive societal impact. When asked about the importance of AI being used to solve today’s bigger issues for the benefit of our society, consumers told us that they would be willing to share their personal information if it meant doing so could further medical breakthroughs (57%), relieve city traffic and improve infrastructure (62%), solve cybersecurity and privacy issues (68%)


Quest for AI Leadership Pushes Microsoft Further Into Chip Development

Bringing chipmaking in-house is increasingly in vogue as companies conclude that off-the-shelf processors aren't capable of fully unleashing the potential of AI. Apple is testing iPhone prototypes that include a chip designed to process AI, a person familiar with the work said in May. Google is on the second version of its own AI chips. To persuade people to buy the next generation of gadgets—phones, VR headsets, even cars—the experience will have to be lightning fast and seamless. "The consumer is going to expect to have almost no lag and to do real-time processing," says Jim McGregor, an analyst at Tirias Research. "For an autonomous car, you can't afford the time to send it back to the cloud to make the decisions to avoid the crash, to avoid hitting a person. The amount of data coming out of autonomous vehicles is tremendous you can't send all of that to the cloud."


OAuth 2.0 Threat Landscapes

It’s neither a flaw of OAuth 2.0 nor how Google implemented it. Phishing is a prominent threat in cyber security. Does that mean there is no way to prevent such attacks, other than proper user education? There are basic things Google could do to prevent such attacks in the future. Looking at the consent screen, ‘Google Docs’ is the key phrase used there to win user’s trust. When creating an OAuth 2.0 app in Google, you can pick any name you want. This immensely helps an attacker to misguide users. Google could easily filter out the known names and prevent app developers from picking names to trick the users. Another key issue is, Google does not show the domain name of the application (but just the application name) on the consent page. Having domain name prominently displayed on the consent page will provide some hint to the user where he is heading to.


AI Cyber Wars: Coming Soon To A Bank Near You

We are beginning to see both offense and defense using automation, machine learning and artificial intelligence (AI) to counter each other’s moves. For example, as firms adopt voice biometrics to make customers’ access to their accounts and information more secure, cyber-criminals can use the same machine learning algorithms to mimic voices and gain unauthorized access. Lyrebird, a Montreal-based AI startup, has developed a voice generator that can imitate almost any person’s voice, and can even add emotional elements missing from computer generated personas such as Siri and Cortana. Staying one step ahead of the threat is difficult, but forward-thinking financial institutions realize it’s imperative. As financial institutions up their game to protect their assets, three AI priorities have emerged: focusing resources, visualizing the threat, and accelerating response time.


What is Node.js? The Javascript Runtime Explained

Node.js takes a different approach. It runs a single-threaded event loop registered with the system to handle connections, and each new connection causes a JavaScript callback function to fire. The callback function can handle requests with non-blocking I/O calls, and if necessary can spawn threads from a pool to execute blocking or CPU-intensive operations and to load-balance across CPU cores. Node’s approach to scaling with callback functions requires less memory to handle more connections than most competitive architectures that scale with threads, including Apache HTTP Server, the various Java application servers, IIS and ASP.NET, and Ruby on Rails. Node.js turns out to be quite useful for desktop applications in addition to servers. Also note that Node applications aren’t limited to pure JavaScript. You can use any language that transpiles to JavaScript, for example TypeScript and CoffeeScript.


Four Tips for Working with Angular Components

If you want to improve the quality of your applications, you need to improve the quality of your code. That may mean tackling a new concept, or it might simply mean approaching existing concepts in a better and more efficient way. Learning to use components in Angular in the most efficient way possible, for instance, can help you to create applications that are more upgradable, that run more smoothly and that will be more future proof. Components have been a part of Angular since version .5 of AngularJS and provide a convenient and handy way to organize and recycle code. Angular (the shorthand for Angular 2) is not so much an upgrade to Angular 1.x as much as a ‘sequel’, being entirely rewritten with mobile support and other features in mind. Here, the controllers used in 1.x are completely replaced with components.


The Database’s Role in Speeding Application Delivery

Among databases there is considerable feature variance, even between relational databases and this may impact time to value. Some databases have a significant overhead in respect of database administration, usually because of the need for performance tuning – partitioning, adding indexes and so on. Products that are largely self-tuning have a cost advantage here, and it can be argued, improve time to value by that alone, although the more significant cost involved is likely to be the cost of the DBA or, alternatively, the business cost of poor database performance. Some practically useful database features improve time to value simply because you do not have to spend time building the capability that is missing or designing around it. A particular case in point here is distributed capability.


In 2017, the pressure is on to be secure. Are you feeling the squeeze?

Executives will be leaning on CSOs to ensure and demonstrate that company data is adequately protected – and their jobs are well and truly on the line, with another recent Trustwave survey suggesting that a data breach that becomes public is a fireable offence at 38 percent of companies. Other concerning vectors for breaches included ransomware and intellectual property theft, with practitioners most concerned about their responsibilities to identify vulnerabilities and stop the spread of malware. Advanced security threats and a shortage of security skills were the areas applying the most operational pressure on respondents, with cloud, Internet of Things (IoT) and social media presenting the biggest technological security challenges.



Quote for the day:


"Don't be afraid of your fears. They're not there to scare you. They're there to let you know that something is worth it." -- C. JoyBell C


Daily Tech Digest - July 23, 2017

Natural Language Processing: The What, Why, and How

Business managers have a Big Data problem. They puzzle over dashboards and spreadsheets drowning in too much data and trying to compile it all together into meaningful information. Arria, a company based in London, has come up with a solution. The Arria NLG Platform is a form of Artificial Intelligence, specialized in communicating information which is extracted from complex data sources in natural language (i.e. as if written by a human). It literally takes an organization’s data and transforms it into language, not standard computer-generated text that is overly technical and difficult to read, but natural human language that reads like a literate and well-educated person wrote it. Arria’s software can turn a spreadsheet full of data, that is dragged and dropped automatically into a written description of the contents, complete with trends, essentially providing business reports.


Real Time Data Integration on Hadoop

This very quick and focused data integration is often referred to as “streaming data enrichment”. In the insurance example, the company wants each recommendation to be based on the full context of the customer’s relationship with the company. Data integration in near real time is required because the first call provides a critical part of the context for the second call or website visit. My colleague, NoSQL expert Bryce Cottam, suggests using a low latency NoSQL database, such as HBase, as the repository for the integrated data in this case. Apache HBase is an open source database included in, or available with, most Hadoop distributions. Integration can be further simplified by designing the solution around a specific data integration requirement. For the insurance example, the problem is to integrate the data by customer.


Why public cloud is more expensive than you think

“If you were to go out and rent a car from Budget for one day a week, no problem,” he says. “If you want to use that car 24/7, 365 days a year then you’re going to pay for it twice over.” So anyone that’s looking to run an application that has predictable traffic levels and must always be available should avoid public cloud options for that, he says. “That’s very expensive under the Azure and AWS pricing model,” MacDonald explains. “Which it should be, because if you have these virtualized server banks and you’re doing pay-as-you-go, then you have to charge a lot to make a profit, because it’s not going to be used all the time.” Canada15Edge has been in business for about two years, operating one data centre on a colocation model for its clients. MacDonald says he’s hosting a number of managed service providers in his building.


Architecting the digital enterprise

To be nimble requires an organisation to empower those architects closest to the business needs – those with domain expertise. To maintain consistency amidst this new autonomy, an enterprise’s domain architects need to operate with a consensus around the approach to key architecture “plays” – such as cloud, security and analytics. The enterprise architect of the future needs to be able to grasp and manage risk: understanding what to solve now and what to solve iteratively. As the dominance of the biggest players has eroded, they must construct fluid ecosystems of software, where a product may be used to deliver a business outcome for one or two years until enterprise toolsets evolve. This is a different mentality for architects – one which tolerates risk and even sprawl so long as it is managed and iteratively resolved.


Attack and response: Cloud-native cybersecurity vs. virtual machine security

Most vulnerabilities lie in the application level, and deciphering the specific application to protect against relevant threats is hard to do on an ongoing basis. Cloud-native security addresses this problem with whitelisting and protection from known threats. For the first time ever, you can automatically whitelist which traffic should and shouldn’t get to your application automatically. VM security is completely blind to the application specific elements, or to the larger context of the application, especially in orchestrated systems where the IPs of the application might change on an hourly basis. Regarding protection from known threats, one of the major issues with existing web application firewalls (WAFs) is that it is very hard to configure it correctly for every exposed service.


What’s the Big Deal about China’s First Open-Source Blockchain Platform NEO?

Erik Zhang, core developer of NEO, introduced Smart Contracts 2.0 to the audience and explained the major differences between NEO and Ethereum. Ethereum uses its own language called Solidity for programming, whereas NEO supports all programming languages via a compiler, including those on Microsoft.net, Java, Kotlin, Go and Python. By allowing for common programming languages to be used on its platform, NEO hopes to attract a vast community of developers. NEO will have the Nest Fund, a project similar to Ethereum’s The DAO, and Tony Tao will soon release a white paper on the project. The DAO will make improvements on its shortcomings and will be released after being audited by a worldwide peer review.


Open hybrid cloud enables government IT service delivery

An open hybrid cloud solution enables government IT shops to provide flexible and agile service delivery with minimal disruption using current/existing infrastructure. At the same time, it establishes a fast, flexible and agile service-delivery environment supporting today’s traditional workloads and tomorrow’s cloud-based applications. Open hybrid cloud leverages innovation, economics and flexibility by providing access to the best service providers, vendors and technologies without getting locked in. Open Source solutions are leading the industry in rapid innovation and delivering secured open hybrid cloud. “If you automate your way into the cloud, you can automate your way across to another cloud and start making spot market decisions about what cloud you want to be in based on what you’re trying to do,” says Adam Clater


11 Things Every CEO Must Know About Disruption

The first thing to remember about disruption is that it's a two-way street. Either you are the disrupter, or you are being disrupted. This means I mean that if you aren't making things happen for you, or your company, then someone is probably going to put you out of business right under your nose with a lower price point and better business plan. ... This isn't meant to be fear-based, but it's the reality of the situation. Between the pace at which technology advances and the rate at which ideas are generated, disruption is truly a natural cause of the times. If you're comfortable in your business, you need to be thinking about who knows your comfortable and how they are planning to make you uncomfortable. There is a constant ebb and flow of disruption and being disrupted."


The Jobs that will be Orchestrated, not Automated

With the help of Robotic Service Orchestration (RSO) technology, we can orchestrate services across a human and digital workforce to get the right worker to do right task at the right time. As we move to an increasingly automated workforce, this is going to become increasingly important. While there are jobs that will absolutely and positively remain in the human realm, these jobs will likely benefit from some sort of robot interaction which will have to be managed.  RSO can also be used to ease the transition and effectively "install airbags" in the automation process. RSO can help to ensure that it’s easy to switch back from digital to human, if there are any unexpected side effects from moving to an automated agent instead of a human one.


Maximizing the Potential of Open Source Threat Intelligence Feeds

Open source threat intelligence feeds are appealing for a number of reasons. One of the more obvious reasons is their price- absolutely nothing. This is critical for smaller organizations that lack the resources for robust sources of intelligence. Cost aside, open source threat intelligence is also appealing because it provides a wide scope of information on different industries, topics, and locations. With the collaborative efforts of many contributors, users can benefit from intelligence without the hassle of contracts and data limits. Open source threat intelligence is also popular because much of it derives from honeypots, which are decoy entities used to study invasive behaviors. These open and closed-source applications register anomalies and problematic activity that can be then be turned into feeds, software patches, and studies of adversarial behavior.



Quote for the day:


"If the road is easy, you're likely going the wrong way." -- Terry Goodkind


Daily Tech Digest - July 22, 2017

Top 5 open-source tools for machine learning

Machine learning is going through something of a renaissance these days. It seems like there are new moves forward with this technology every day, from advances in image and sound recognition to lip reading and beating us at all the games. However, this renaissance has largely been funded by Silicon Valley. Companies are scrambling to find enough programmers capable of coding for ML and deep learning. Last year was a good year for the freedom of information, as titans of the industry Google, Microsoft, Facebook, Amazon, and even Baidu open-sourced a number of their ML frameworks. Freeing code is a great way to attract talent and grow a community, as well as garner good will. Google is unquestionably the goliath in the field of open-source machine learning with TensorFlow beating all comers by most metrics.


Self-Disrption Or Self-Destruction - Can Wall Street Tame The Blockchain?

On Wall Street, blockchain could upend how institutions trade with one another. One example: It could shrink the three days that it currently takes to clear a securities transaction into seconds. It could also enable entirely new forms of exchange — think self-enforcing contracts and, yes, digital currency. Indeed, “blockchain will do for transactions what the internet did for information,” IBM CEO Ginni Rometty said at a conference in Geneva in September. Extending Rometty’s analogy, it should be noted that it’s early days for blockchain, with developers still establishing the ground rules for the equivalents of the TCP/IP language protocols that allowed the internet to become the internet. But despite all the anarchistic rumblings that the end is nigh for Wall Street intermediaries, here’s the surprising reality


CMOs much more likely than CIOs to lead digital transformation

CMOs are nearly twice as likely as CIOs to lead digital transformation efforts within their organizations, according to new research from Altimeter Group. The top three transformative initiatives — accelerating innovation, modernizing IT infrastructure and improving operational agility — typically fall under the responsibility of IT, but a disconnect exists between the trends driving change and the individuals who lead the efforts, according to Brian Solis, principal analyst at the research and advisory firm. CIOs are more likely sit on the sidelines, because their agendas are already full, he says. When CIOs join an organization there's usually a backlog of demanding projects they need to take over, according to Solis. "There's an aspect of being in IT that is always looking in the past, or at least working in the past," he says.


Psychological safety at work is the bedrock for effective software teams

"You get all these wonderfully smart people into a room, and what happens is you end up in this performance environment ... you want to perform well, so you grind and grind," he explained. "But what you really want to create as a leader is a learning environment. If you're in a performance environment, you're not going to do a lot of learning, because you're always on." Second, Sakaguchi said, team leaders need to model curiosity and ask questions. He explained that since he does not have as strong a background in software development as many on his team, he often asks questions that some might consider "dumb" questions in front of his team members. But instead of being looked down upon, Sakaguchi said his team often appreciates the fact that he asked the question.


The future of enterprise chatbots

Truly, the importance cannot be overstated. Enterprises are beginning to adopt chatbot platforms in the same way they are currently embracing mobile and IoT platforms, and that number is expected to grow exponentially. App downloads are slowing, and messaging platforms have proven their staying power. Customers and employees on interoffice messaging platforms like Slack — who, by the way, just invested $80 million in chatbots for their platform — use messaging for the same reasons: It’s monumentally convenient for the user, incredibly cost- effective, and gets results faster. Today’s enterprise chatbots are comprehensive toolsets that every company needs if they want to compete. Chatbots can handle complex multi-step workflows, answer questions, and even make software platforms easier to use, giving them more value to your users.


Learning Deep Learning with Keras

There is a handful of popular deep learning libraries, including TensorFlow, Theano, Torch and Caffe. Each of them has Python interface (now also for Torch: PyTorch). So, which to choose? First, as always, screw all subtle performance benchmarks, as premature optimization is the root of all evil. What is crucial is to start with one which is easy to write (and read!), one with many online resources, and one that you can actually install on your computer without too much pain. Bear in mind that core frameworks are multidimensional array expression compilers with GPU support. Current neural networks can be expressed as such. However, if you just want to work with neural networks, by rule of least power, I recommend starting with a framework just for neural networks. For example…


Intel Unveils USB Toolkit for AI Prototyping

The compute stick, a standard USB 3.0 drive, is among a series of AI hardware implementations and development tools in Intel’s pipeline. The heart of the USB-based device is the Movidius Myriad 2 vision-processing chip capable of handling more than 100 gigaflops within a 1-watt power envelope. The ability to run real-time deep learning networks from the device “enables a wide range of AI applications to be deployed offline,” explained Remi El-Ouazzane, vice president and general manager of Movidius, the computer vision startup Intel acquired last September. The device converts convolutional neural networks into an embedded neural network running atop the Myriad VPU. A tuning feature allows developers to validate scripts to compare accuracy of customized models to the original. The device can then be used as a neural network accelerator that adds deep learning inference capabilities, the company said.


How a new generation of machines will ‘see’ like humans

Evolutionarily, it is far more important to be able to concentrate on movement within a scene than to take repeated, indiscriminate inventories of its every detail. This becomes especially relevant when we are talking about the vast amounts of data being captured and analyzed in certain applications and use models – autonomous cars, for example. In controlled environments, sophisticated post-processing can deal with this limitation of traditional video imaging. But this brute-force approach simply won’t work in real-time – in-the-field use cases with limited power, bandwidth, and computing resources, including mobile devices, drones, or other kinds of small robots. ... Rather than analyze images on a frame-by-frame basis (our eyes certainly do not do this), the new paradigm is based on selectively capturing visual information according to changes in the scene.


Google’s AI Fight Club Will Train Systems to Defend Against Future Cyberattacks

AI is actually more pervasive now than most people think, and as computer systems have become more advanced, the use of machine learning algorithms has become more common. The problem is that the same smart technology can be used to undermine these systems. “Computer security is definitely moving toward machine learning,” Google Brain researcher Ian Goodfellow told the MIT Technology Review. “The bad guys will be using machine learning to automate their attacks, and we will be using machine learning to defend.” Training AI to fight malicious AI is the best way to prepare for these attacks, but that’s easier said than done. “Adversarial machine learning is more difficult to study than conventional machine learning,” explained Goodfellow. “It’s hard to tell if your attack is strong or if your defense is actually weak.”


Focus on Culture When Building an Engineering Culture

More often than not, when I meet fellow engineers, thought leaders or young job aspirants, engineering culture is one hot topic that invariably pops up for discussion. Unfortunately, this is one area that lingers in the backdrop when business focus areas are defined. Most of you would agree, no matter how vehemently we convey this across, the topic fails to attract the attention it deserves, until we retrospect sitting on a large pile of issues to be solved. ... No matter where we are based or which industry we belong to, hiring good engineers has always been a challenge. The effort is worth it when these awesome engineers help build our engineering brand. An established engineering brand results in attracting more such talent. As great sustainable culture is usually built bottom-up, it is imperative that we hire the best.



Quote for the day:


"What I've really learned over time is that optimism is a very, very important part of leadership." -- Bob Iger


Daily Tech Digest - July 21, 2017

Big Data Technology: In-House vs Outsource

For any technological venture, speed to market is key to determining overall success. This includes the development of internal technology. From project inception to launch, creating a big data solution can take as much as 2-3 full years. That’s two-plus years for a solution you need today. And while the need for an immediate solution is a sizable, the lifecycle of technology isn’t. A two-year wait time can create one of two problems: Either your newly developed solution is nearly outdated at launch, or you become caught in an unending cycle of redesign in an attempt to get ahead of a rapidly progressing technological landscape. Meanwhile, with the wide adoption of cloud-based SaaS model, speed of integration and deployment for third-party solutions has never been faster.


Scammers demand Bitcoin in DDoS extortion scheme, deliver empty threats

This week, the FBI says they’ve investigated hundreds of these cases, including several in Indiana – home to several major companies, the Indy 500, and this reporter. However, there has been no indication of attacks. When the targeted organization fails to meet the deadline or refuses to pay, those responsible for the demands fade into the background and the promised DDoS never happens. So, while the extortion attempts are turning out to be empty threats for now, that wasn’t always the case. In fact, it’s likely the people responsible for the most recent threats are using the ‘Anonymous’ and ‘Lizard Squad’ brands because they’ve been associated with DDoS attacks in the past. Most administrators will remember the panic that swept through enterprise and SMB channels when Anonymous was using DDoS as their primary means of protest in 2010, something they still do to this day.


A coding error led to $30 million in ethereum being stolen

The perils of a blockchain’s immutable transactions was brought home yesterday as some $30 million in ether was stolen due to a bug in the code of a well known ethereum wallet. It could have been worse: an additional $75 million was at risk because of the same coding fault, but a group of vigilante hackers rescued those funds and are promising to give them back to their owners. The ether was grabbed from the wallets of at least three projects that had recently completed so-called “initial coin offerings” (ICOs). More worryingly for ICO boosters, the vigilante hackers—who call themselves “The White Hat Group“—saved funds from wallets belonging to some of the biggest coin offerings to date. The bug has now been fixed. Those wallets required multiple people to sign off on transactions, which were supposed to make them more secure.


The 3 most in-demand cybersecurity jobs of 2017

"For lower-level professionals, companies need to consider if they want to pay a premium for an analyst to get every skillset they're looking for, or if they want to invest in trainings and seminars," Zafarino said. If you chose the latter, it's key to bring in a consultant for a short amount of time to help get the employee up to speed. "In the long term, that person is probably perfect, especially if you don't have the money at hand," he said. "If you do, you absolutely want to go with the more senior resource, and you can bring in lower-level people along the way." Zafarino said he commonly sees two paths to becoming a cybersecurity professional. In the first, a person comes from a computer science background, and can usually command a higher salary.


Bank workloads to be taken over by machines

Cognitive technologies, or machines that perform human tasks – have become cheap enough for banks to deploy them throughout their organisation. McKinsey said that automating tasks will “free up capacity” for staff to focus on higher-value work, such as research, generating new ideas or tending to clients. “This is really starting to take steam and it’s going to transform the industry over the next two to three years,” Jared Moon, a McKinsey partner who co-wrote the report, said in an interview. These cognitive technologies are estimated to free up 20 to 30% of employees’ capacity in units processing trades. Automation has not unanimously been welcomed with open arms. Workers worry they will be replaced by machines that can do their job for them, at a fraction of the cost.that can However, this won’t be the reality.


Data Mining - What, Why, When

The broad benefit of identifying hidden patterns, consequent relationships and establishing predictive models can be applied to many functions and contexts in organizations. Specifically, customer-focused functions can mine customer data to acquire new customers, retain customers, cross-sell to existing customers. Other examples are to enhance customer lead conversion rates and/or build future sales prediction models or new products & services.  Financial sector companies can build fraud-detection models and risk mitigation models. Energy and manufacturing sector can come up with proactive maintenance models and quality detection models. Retailers can build stock placement/replenishment models in stores and assess the effectiveness of promotions and coupons. Pharmaceutical companies can mine large chemical compounds data sets to identify agents for the treatment of diseases.


COBIT 5 for Risk—A Powerful Tool for Risk Management

One would think that, IT being critical to an organization’s operations, the risk related to IT and IT security would be covered by many different risk management frameworks, including the Committee of Sponsoring Organizations of the Treadway Commission (COSO) for enterprise risk management (ERM), the Risk Management Society’s RIMS Risk Maturity Model (RMM), Project Management Institute’s (PMI) Project Risk Management, International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC) 27005 Information technology—Security techniques ... Arguably, there is only one globally accepted and in-use business framework to employ when it comes to risk management in the IT domain and, specifically, the governance and management of enterprise IT. That framework is COBIT 5.


How to monitor MongoDB database performance

In a smoothly running set of primary and secondary nodes (referred to as a “replica set”), the secondaries quickly copy changes on the primary, replicating each group of operations from the oplog as fast as they occur (or as close as possible). The goal is to keep replication lag close to zero. Data reads from any node should be consistent. If the elected primary node goes down or becomes otherwise unavailable, a secondary can take over the primary role without impacting the accuracy of data to clients. The replicated data should be consistent with the primary data before the primary went down. Replication lag is the reason that primary and secondary nodes get out of sync. If a secondary node is elected primary, and replication lag is high, then the secondary’s version of the data can be out of date.


7 Things Your IT Disaster Recovery Plan Should Cover

“Completing a BIA for major IT systems will allow for the identification of system priorities and dependencies,” notes Testoni. “This facilitates prioritizing the systems and contributes to the development of recovery strategies and priorities for minimizing loss. The BIA examines three security objectives: confidentiality, integrity, and availability.” Testoni adds that a BIA helps establish priorities for your disaster recovery, business continuity, and/or continuity of operations plans. “A standard approach to developing a comprehensive disaster recovery plan is to first develop the policy, then conduct the BIA,” he says. “After creating a prioritization with the BIA, contingency strategies are developed and formalized in a contingency plan.”


Android O: The Reddit AMA's 8 most interesting reveals

Google teased us with dark mode on both the Android N and O developer previews, but it’s not making it into the full release anytime soon. The reason? “Reliable and consistent theming is hard.” Numerous questions about themes and dark mode stacked up on the Reddit board, and Android engineer Alan Viverette addressed it thusly: “There are technical and logistical issues with theming. The technical side is largely solved in O with Runtime Resource Overlay support (a Sony framework that allows the system to modify the look and feel of an app while it is running); however, we still don’t have stable APIs for describing what can be themed or adequate ways to verify that existing applications properly support theming.”



Quote for the day:


"It's the little details that are vital. Little things make big things happen." -- John Wooden


Daily Tech Digest - July 20, 2017

7 Hot IT Outsourcing Trends - 7 Going Cold

Enterprises are moving more workloads to the public cloud, but continuing to run certain applications in dedicated private cloud environments for security, regulatory or competitive reasons. So they’re looking for providers that can seamlessly manage and integrate their hybrid cloud environments, says Rahul Singh, managing director with business transformation and outsourcing consultancy Pace Harmon. ... Over the past decade, the offshore delivery of infrastructure management services from network services and help desk support to server maintenance and desktop management became mainstream. But remote infrastructure management is no longer a growth industry for IT services providers; it can’t compete on price with the public cloud, where adoption rates are growing at compound rates of 25 percent a year.


OCI container standards arrive at last

OCI's newly finalized standards cover two key components of the container ecosystem -- the image format for containers, and the runtime specification. The OCI Image Format, as the first is formally called, is easy enough to grasp. It describes the way a container image is laid out internally and what its various components are. OCI likens the Image Format to Linux package manager formats like .deb and .rpm, "a dependable open specification that can be shared between different tools and be evolved for years or decades of compatibility." The other standard, the OCI Runtime Specification, describes how a container is configured, executed, and disposed of on all the major platforms where OCI containers run -- Linux, Windows, and Solaris. All three platforms now support Docker-style containers, but each platform has its own implementation quirks, and the spec is intended to encompass those.


Top cloud security controls you should be using

All cloud services are not the same, and the level of responsibility varies. Software-as-a-service (SaaS) providers will make sure their applications are protected and that the data is being transmitted and stored securely, but that is typically not the case with cloud infrastructure. For example, the organization has complete responsibility over its AWS Elastic Compute Cloud (EC2), Amazon EBS and Amazon Virtual Private Cloud (VPC) instances, including configuring the operating system, managing applications, and protecting data. In contrast, Amazon maintains the operating system and applications for Simple Storage Service (S3), and the organization is responsible for managing the data, access control and identity policies. Amazon provides the tools for encrypting the data for S3, but it is up to the organization to enable the protection as it enters and leaves the server.


This scary Android malware can record audio, video and steal your data

In total, there are three versions of GhostCtrl -- one which steals information and controls some of the device's functions, a second which adds more features to hijack, and now the malware is on its third version which combines the most advanced capabilities of previous incarnations while adding further malicious capabilities. Those include monitoring the phone's data in real time, and the ability to steal the device's data, including call logs, text message records, contacts, phone numbers, location, and browser history. GhostlCtrl can also gather information about the victim's Android version, wi-fi, battery level, and almost any other activity. The most worrying aspect of the malware isn't just its ability to intercept messages from contacts specfied by the attacker, as GhostCtrl can also stealthily record audio and video, enabling the attackers to conduct full-on espionage on victims.


Instead of hacking self-driving cars, researchers are trying to hack the world they see

Researchers from Google, Pennsylvania State University, OpenAI, and elsewhere have been studying the theoretic application of these attacks, called “adversarial examples,” for years, and declared that they would be possible in the real world. By altering just 4% of an image, a Google paper showed that AI could be fooled into perceiving a different object 97% of the time. Now, an independently-published paper from the University of Illinois at Urbana Champaign has brought the discussion specifically to self-driving cars, but the conclusions of the paper are much less clear-cut. Over a number of tests, the Illinois team printed fake stop signs with and without altered pixels and recorded videos approaching the signs as a self-driving car would. The resulting paper’s conclusion was that due to the different angles and sizes that the car would see the sign, a single pattern applied to a sign could not reliably fool a car.


Massive Amazon S3 breaches highlight blind spots in enterprise race to the cloud

According to Rob Enns, vice president of engineering for Bracket Computing, the prevalence of the S3 breaches highlights the fact that organizations must own their cloud security—they cannot outsource it. ... "To manage complexity in these new environments, consistency from on-premise to cloud and enabling IT to retain control of information security gives application architects and developers a base on which they can move fast while remaining compliant with the enterprise's security requirements." When considering a public cloud storage provider, Tran said, businesses should look at both the Service Letter Objective (SLO) and Service Letter Agreement (SLA) to determine what level of risk they're willing to take on, as they address different issues. Sometimes, the risk is too much and it needs to be left on the table.


The Dark Web Goes Corporate

Just as many enterprises no longer build or even deploy their own in-house tools, so too do many criminals outsource the deployment of their misdeeds. Even if you're sick of the endless "-as-a-service" acronyms in IT, you'll need add another one: RaaS, or ransomware-as-a-service. "RaaS providers give their customers fully functional ransomware with a dashboard to track victims and support services should they need it," says Shier. "In exchange, the authors of the RaaS portal ask for either a percentage of the ransom or a flat fee. The only thing left is for the customer to distribute the ransomware, possibly using the services of a spammer purchased separately or by doing it themselves using the knowledge they gained from the tutorials." And if you need more evidence of this in the real world, experts are now beginning to see the Petya ransomware as a RaaS attack.


Why you should use Apache Solr

Apache Solr is a subproject of Apache Lucene, which is the indexing technology behind most recently created search and index technology. Solr is a search engine at heart, but it is much more than that. It is a NoSQL database with transactional support. It is a document database that offers SQL support and executes it in a distributed manner. ... Solr is a document structured database. Entities like “Person” are composed of fields like name, address, and email. Those documents are stored in collections. Collections are the closest analog to tables in a relational database. However, unlike in a relational database, “Person” can completely contain the entity, meaning if a person has multiple addresses those addresses can be stored in one “Person” document.


Elon Musk’s top cybersecurity concern: Preventing a fleet-wide hack of Teslas

“I think one of the biggest risks for autonomous vehicles is somebody achieving a fleet-wide hack,” Musk said in response to a question from North Dakota Governor Doug Burgum. “In principle, if somebody was able to hack, say, all of the autonomous Teslas, they could, say—I mean just as a prank—they could say like ‘send them all to Rhode Island’ from across the United States. And that would be like, well OK, that would be the end of Tesla. And there would be a lot of angry people in Rhode Island, that’s for sure.” Preventing a fleet-wide hack is “pretty fundamental.” In fact, he said, “It is my top concern from a security standpoint—that Tesla is making sure that a fleet-wide hack or any vehicle-specific hack can't occur.” Musk added


Affordable React Native Mobile App Development

Although a write once, run anywhere approach may seem attractive as it minimizes development efforts and corresponding costs, it is deemed impractical in today’s technological landscape. Different devices and operating systems offer unique features and design languages to mark their brand and differentiate themselves from the competition, so applications must adapt to those differences and use those unique features to maximize user experience. In such environments, a learn once, write anywhere approach, which is best exemplified by React Native, would be most suitable. Developers skilled in React Native can develop applications for different platforms, thereby eliminating the need for additional developers for different operating systems. React Native can, therefore, result in huge savings in development costs.



Quote for the day:


"Too often we enjoy the comfort of opinion without the discomfort of thought." -- John F. Kennedy