Daily Tech Digest - December 08, 2017

How Innovation Works And How To Lead It

As a leader, one should always look for the opportunities to develop the team and self to strengthen the delivery and keep the team spirit up. There is always a scope for the leader to improve; it is just a matter to understand why there is an opportunity and what needs to be changed. Once the leader knows why, the next thing is to delimit “HOW”, once the problems are known and the opportunities are identified, then leaders must outline how to tie the loose ends and handle the situation. Some companies and people know HOW they do what they do. Whether you call them a ‘’differentiating value proposition’’ or ‘’unique selling proposition,’’ HOWs are often given to explain how something is different or better. Not as obvious as WHATs , and many think these are the differentiating or motivating factors in a decision. It would be false to assume that’s all that is required.

Why Enterprise Security Is A Matter Of Policy

As the most common trigger for policy changes are changes to an application, it’s critical that teams understand exactly what devices and connectivity each application needs in order to function correctly and deliver its benefits, while remaining secure. Therefore, the automation solution should be able to automatically discover and map the connectivity flows for all of the enterprise’s business applications, to show IT and security staff exactly how data flows across the network. ... The automation solution should also enable IT teams to perform proactive risk analysis on planned application connectivity or security policy changes before they are made, to ensure that they don’t introduce security gaps or compliance violations. Then, if no exceptions or issues are identified, the approved changes can be rolled out to the relevant security devices with zero touch – thereby saving significant time, effort, and most importantly helping to prevent misconfigurations which cause outages and security holes.

Why Third-Party Security is your Security

This third-party standard establishes the baseline that third parties must meet, so communicate it to them before you have to rely on them. The standard also serves as the benchmark that your organization will use to measure the third-party security. According to the survey, 57% of respondents suggest establishing a process for evaluating the security protection capability of third parties before engaging in business activities, while 52% recommend establishing a vetting process to ensure all third parties are evaluated and screened against objective security requirements. With a policy and standard in place, now you can set up on-going processes to do that measuring and feedback. Survey results show that 54% of respondents monitor third parties to ensure continued compliance with contractually required security requirements while 44% say they periodically review third parties to objective security requirements.

3 common cybersecurity maturity failings

There’s a common misunderstanding about what constitutes “good security.” Many organizations have reduced this concept to a pure checkbox exercise, without understanding why the boxes must be checked. Good cyber security is not determined by an organization itself, or by comparison with other enterprises. Good cyber security is measured by the success or failure of our adversaries. It is the attackers who determine most of the rules of engagement. IT security’s job is to prevent them from gaining access to the infrastructure, data and whatever else they consider valuable assets. Anything short of that, and the organization is in a security “bad” place. Security maturity helps prevent adversaries from completing the full cyber kill chain. Yet there are many “failings” when it comes to understanding what maturity represents. Let’s consider the top three.

Google ups Chrome security for business users with new features and policies

Chrome admins will now be able to whitelist and blacklist specific extensions in a more scalable way as well. With an updated extensions policy (available now), IT admins can create a policy that will restrict extension access based on permissions, the post said. One example provided would be admins blocking all extensions that need to use a device's camera or microphone. The newest Chrome version also supports the latest version of Transport Layer Security (TLS)—version 1.3—in Gmail, which could improve security and speed. According to the post, Google will be bringing support for TLS 1.3 to the broader web sometime in 2018. Chrome users won't immediately notice any difference with the support of TLS 1.3. However, Google urged admins to make note of any incompatible systems in the Chrome admin forum. In its post, Google also outlined some of the security features that will be coming in 2018.

Shadow IT: How Today's CIOs Graple With Unsanctioned Tech

Shadow IT is a serious affair at SAIC, a $5 billion provider of IT services to government agencies. Because SAIC employs 10,000 people building IT solutions, CIO Bob Fecteau sees shadow IT as essentially DevOps. That is, some groups are building, testing and running their own IT capabilities. “The business says they won’t give me IT support, so we’re going to create operational development capability called DevOps," Fecteau says. "IT occurs in those spaces." While he accepts that IT work is happening outside his purview, he says he is still responsible for knowing how much of the corporate budget is going to IT — whether he sanctions it or not. "What’s relevant is: Can I account for it? Do I understand how much it costs? And do I understand how much it impacts the business," Fecteau says. "If I can answer yes to most of those questions then I’m probably doing my job."

How do you turn these islands into a living IoT lab?

For Villoslada, this IoT infrastructure is in line with the Spanish archipelago's 'sun and data' model and can help turn it into a "lab for IoT technologies and products of the fourth industrial revolution". "IoT will have a profound impact in our digital world. We have the elements to offer citizens a range of services that can be useful," he says. For the moment, a pilot is being carried in the parking lot of the Balearic Technology Innovation Park, or ParcBit, where the technology monitors the occupancy and availability of 1,200 parking spaces. Google has also bought into the idea. It's already offered the Balearic government its own IoT platform and a partner in the form of Spanish consultancy Beeva to conduct another pilot project to optimize the use of moorings in Pollença harbor. According to Villoslada, the Balearic Islands are the first autonomous community in Spain to support this kind of deployment.

Deduplicating Massive Datasets With Locality Sensitive Hashing

Many online platforms that deal with natural language documents face a big problem: thousands of duplicate documents. Duplicates are easily produced in news media when a content producer like Reuters or the Associated Press distributes an article to a number publishers. Each publisher will typically add a paragraph or a footer making each copy slightly different from the others. A web crawler that monitors the sites of the individual publishers will see many almost identical articles as each copy was essentially written by Reuters and only slightly modified by the other publishers. Quora also recently released the Quora Question Pairs dataset. The dataset contains pairs of user generated questions, some of which are semantically the same Here the aim is specifically to find questions that are semantically the same, often those questions are just slighty paraphrased ones.

Why this venture capitalist says blockchain technology and “cryptoassets” are the future of fintech

“We’ve been living in the internet application world, and we’re starting to see peer-to-peer networks forming, but blockchain is really going to be the enabling technology moving forward,” Deaker told the conference. ... The opportunity for blockchain as a massive disruptor lies in the vast amount of “unbanked opportunities” around the world that blockchain technology can solve, said Deaker. She also believes the want from consumers for ease, flexibility, openness, and personalisation (coupled with a prevalence of mobile technology) will drive use cases for blockchain tech. And while the discussion around blockchain usually focuses firmly on the underlying technology, eschewing the tradeable asset parts commonly associated with projects, Deaker said the future of fintech sits in “a bucket broadly defined as cryptoassets”.

Human Resource (HR) staff to be replaced by robots (AI) within 10 years

As McKinsey shows, certain types of tasks are more likely to be automated than others. Technical activities, such as data collection and data processing, are very likely to be automated. (Your company may have already begun automating some of these functions.) Other types of work, such as managing people, planning, or creative work are much less likely to be automated somewhat probably impossible in task. This explains why HR administrative jobs have a 90% chance of being automated by 2035, according to a study from Oxford University, but HR managers, directors and officers are much less likely to be replaced by robots. A robot can spit out data, but it can’t create a strategic plan or mediate a conflict between two employees. In short, robots are likely to take over mundane HR tasks, while the HR tasks that require creativity, problem-solving, decision-making, or people skills will remain the domain of humans.

---

Quote for the day:

"People tend to make rules for others and exceptions for themselves." -- Anonymous

---

Daily Tech Digest - December 07, 2017

How blockchain will underpin the new trust economy

As a peer-to-peer network, combined with a distributed time-stamping servers, blockchain databases can be managed autonomously to exchange information between disparate parties. There's no need for an administrator. In effect, the blockchain users are the administrator. In the trust economy, an individual's or entity's "identity" confirms membership in a nation or community; ownership of assets; entitlement to benefits or services; and, more fundamentally, as evidence that the person or entity exists, according to Deloitte. Blockchain doesn't simply solve data access or sharing issues; it also solves a confidence problem. In the peer-to-peer trust economy, an individual user – not a third party – will determine what digital information is recorded in a blockchain and how that information will be used.

Cybersecurity concerns may stop consumers from purchasing a connected car

The desire to consider cybersecurity when purchasing a car was most prevalent with younger generations aged 25-34, with 62% stating they would conduct this research. On the opposite end of the spectrum, only 43% of consumers 55+ would look into the car’s cybersecurity protection. “It’s clear that cybersecurity will be a key factor for many consumers when they are purchasing their next vehicle,” said Daniel Thunberg, Global Head, Connected Transport, Irdeto. “It is important for automakers to make security a priority by implementing a multi-layered, defense in-depth strategy so their brand is not perceived by consumers as one that does not take security seriously. By implementing security at the beginning of the manufacturing process, OEMs and Tier 1 suppliers will not only stay one step ahead of hackers, but will show consumers that they are committed to their safety by implementing a proper security approach.”

What to expect with pervasive encryption on IBM mainframes

Data set encryption requires extended format files and encompasses most basic sequential files and all forms of Virtual Storage Access Method (VSAM) data sets. It does leave a couple curious holes by excluding partitioned data sets and tapes. Information Management System v14 allows data set encryption for a subset of data sets, while IMS v15 will have full support. Users can encrypt the Coupling Facility cache and list structures as well through CF Resource Manager policy. IBM's z/OS encrypts the data for protection both in flight and at rest in the CF. The z/OS's System Authorization Facility controls access to encryption keys and functions to very granular levels. This could lead to situations where someone may be authorized to read a data set but unable to decrypt it. This is the perfect setup for storage and database administrators.

Which of Your Employees Are Most Likely to Expose Your Company to a Cyberattack?

Basic human behavior is very hard to reprogram. Therefore, training should be augmented by constantly updating technology, which has now evolved to detect errant behavior. The advancement of technology has only just begun to solve what seemed to be intractable issues in security and governance, and these new capabilities such as predictive analytics and artificial intelligence are expected to better monitor and influence human behavior. By employing a modern breed of analytics that enables organizations to analyze documents for sensitive content, review user actions, and track the flow of data across the enterprise, cybersecurity stakeholders can now identify many common indicators of negligent or malicious activity

Top 10 Technology Trends Impacting Infrastructure & Operations for 2018

In 2018, IT will be increasingly tasked with supporting complex, distributed applications using new technologies that are spread across systems in multiple locations, including on-premises data centers, the public cloud and hosting providers. During the Gartner IT Infrastructure, Operations Management and Data Center Conference in Las Vegas, David Cappuccio, vice president and distinguished analyst at Gartner, said I&O leaders should focus on 10 key technologies and trends to support digital transformation. “These are not necessarily the top 10 technologies, or the hottest trends in IT, but rather the 10 trends we feel will have an impact on I&O teams over the next few years,” says Cappuccio. “Some are happening already, some are just beginning, but each will have an impact on how IT operates, plans, enhances internal skill sets, and supports the business.”

The OSI model explained: How to understand (and remember) the 7 layer network model

When most non-technical people hear the term “seven layers”, they either think of the popular Super Bowl bean dip or they mistakenly think about the seven layers of Hell, courtesy of Dante’s Inferno (there are nine). For IT professionals, the seven layers refer to the Open Systems Interconnection (OSI) model, a conceptual framework that describes the functions of a networking or telecommunication system. ... This can help network managers narrow down problems (Is it a physical issue or something with the application?), as well as computer programmers (when developing an application, which other layers does it need to work with?). Tech vendors selling new products will often refer to the OSI model to help customers understand which layer their products work with or whether it works “across the stack”.

What’s on the horizon for security and risk management leaders?

Security and risk management leaders are beginning to give more weight to the risks associated with the complex ecosystems that are an integral part of digital businesses: digital supply chain risk, third-party (and fourth- and fifth-party) risk, and so on. “Historically, it has been fairly straightforward to assess the financial risk of business relationships by leveraging business and credit rating services such as Standard and Poor’s, Dun and Bradstreet, and Moody’s. With regard to technical and cyber risk, there has been no standard framework or approach — or rather, there have been too many, with a minimal level of commonality or consistency,” the analysts pointed out. The demand is obviously there, but fulfilling it such a way that customers can be confident in the ratings is difficult. For one, the information based on which the ratings are calculated can’t be just from public sources.

Why Cybersecurity Must Be an International Effort

As countries strengthen their cyber capabilities, Painter explained, they need a stable environment so the beneficial parts of cyber aren't undermined by weak security. He said it's time for nations to discuss cyber policies through the United Nations and multi-government organizations instead of going solo. International law applies in cyberspace, he said; it isn't a "lawless space" where "anything goes." It sounds simple on the surface but is complex in practice. According to Painter, international agreements must focus on how to prevent cyberattacks that don't necessarily qualify as cyber warfare; right now, policies don't address these types of threats. States shouldn't attack the critical infrastructure of other states, for example. They shouldn't attack one another's computer emergency response teams (CERTs), something Painter likened to "going after ambulances on the battlefield."

Microsoft launches low-code platform to speed enterprise IoT development

Microsoft IoT Central is now in public preview, bringing IoT skills to more frontline workers with the help of low-code development, according to a Microsoft blog post. The scalable SaaS solution is built on Microsoft Azure and supports enterprise security, IoT best practices, and more. With the new solution, Microsoft handles the infrastructure, allowing end users to focus on creating IoT solutions that can value to their organization. According to the post, "Microsoft IoT Central makes it so that everyone can benefit from IoT." Microsoft's Azure IoT Hub will act as the cloud gateway for Microsoft IoT Central, the post said. This allows users to securely connect, provision, and update devices, as well as send them commands. It can support millions of connected devices, the release said.

Support for CDOs growing among businesses

This comes across in a new survey of 287 CDOs, chief analytics officers and other high-level data and analytics leaders from around the world. The 2017 study, conducted by technology researcher Gartner, revealed growing use of the Chief Data Officer title and an increase in the number of organizations that have instituted an Office of the CDO. Moreover, for the first time, more than half of CDOs now report directly to a member of the C-suite, another board member or the business owner. "The steady maturation of the office of the CDO underlines the acceptance and broader understanding of the role and recognizes the impact and value CDOs worldwide are providing," notes Michael Moran, a research director at Gartner. Budgets are also on the rise. Survey respondents report an average CDO office budget of $8 million—up 23 percent from the $6.5 million average reported in 2016.

---

Quote for the day:

"I not only use all the brains I have, but all I can borrow." -- Woodrow Wilson

---

Daily Tech Digest - December 06, 2017

What is a botnet? And why they aren't going away anytime soon

According to an Akamai internet security report released this week, botnets are not only still alive and well, but getting more clever and more difficult to combat. For example, attackers are now using Fast Flux DNS, changing DNS information so rapidly that defenders have a hard time tracking and disrupting them. While Akamai was part of the battle to control last year's Mirai attacks, Mirai itself is still around, with two DDoS attacks exceeding 100 Gbps this past quarter, Akamai reported. Plus, new botnets are popping up. This fall, Check Point researchers say they discovered a new botnet, variously known as "IoTroop" and "Reaper," that's compromising IoT devices at an even faster pace than Mirai did. It has the potential to take down the entire internet once the owners put it to work. Mirai infected vulnerable devices that used default user names and passwords.

When the threats get weird, the security solutions get weirder

Many of our assumptions around security are being challenged by new facts. Take two-factor authentication, for example. A report last month by Javelin Strategy & Research claimed that current applications of multi-factor authentication are “being undermined.” Two- or multi-factor authentication is also underutilized by enterprises, with just over one-third using “two or more factors to secure access to their data and systems.” So we can’t trust two-factor authentication like we used to, and even if we could it’s wildly underutilized. But surely we can trust Apple devices, right? Apple has a sterling reputation for strong security. Or, I should say, “had” such a reputation. Apple apologized and issued a patch this week for a major security flawthat enabled anyone with physical access to an Apple computer running macOS High Sierra to gain full access without even using a password

Security, vendor choices affect server purchases for IT buyers

An increasing number of systems can detect unauthorized or unexpected changes in system firmware images and firmware configurations, enforcing a system lockdown to prevent such changes and alerting administrators when change attempts occur at the firmware level. Servers frequently include persistent event logging, which includes an indelible record of all activity. And servers benefit from various recovery capabilities. For example, automatic BIOS/firmware recovery can restore firmware to a known goodstate after the system detects any flaw or compromise in the firmware code base. Some systems can apply similar restoration to the OS by detecting possible malicious activity and restoring the OS to a known good state as well.

SMBs have big plans for 2018--but too many ignore the threat of a data breach

The results from the Microsoft survey show that SMBs are looking forward to 2018 with an optimistic attitude regarding the growth of their businesses. This is great news for Microsoft and other information technology companies, as SMB growth translates into more demand for their products. The next year seems primed for opportunities to provide more cloud services and productivity software—good news for Microsoft. But there is obviously still a need to educate SMB owners about the perils of cyber threats. Every business, regardless of size, must operate as if there will be a data breach at any moment—because that is the current reality. No business, no matter how small and seemingly insignificant, is immune from a cyberattack. All businesses must be prepared with a comprehensive plan for when, NOT IF, a data breach occurs.

How to achieve and maintain PCI DSS compliance

Conduct a PCI DSS gap analysis or pre-audit assessment to determine your organisation’s current level of compliance. ... A gap analysis is often proposed before a formal assessment by a QSA for an Attestation of Compliance (AoC), and can help organisations establish whether they are ready for a formal Report on Compliance (RoC) audit. After the consultant performs the gap analysis, they will send your organisation an assessment report and a roadmap of the steps you need to take to achieve accredited certification to the Standard. A PCI DSS gap analysis is similar to an actual RoC assessment, and includes a detailed review of the organisation’s compliance activities, such as on-site interviews with staff, an assessment of the in-scope system components and configurations, an examination of out-of-scope components and a physical and logical data flow analysis.

3 Areas The IoT Will Impact You Without Your Even Knowing

Connected devices in our homes have traditionally been about making life easier—and maybe even a little more fun. It’s cool to check in on our kids from our connected video cameras; it’s nice to click a button on our phone and watch our favorite movie or TV show. But going forward, these technologies will be about even bigger things: saving energy, time, and money. Your smart home apps will automatically manage your energy usage based on smart sensors and data collected over time. Predictive maintenance sensors will alert you—and even arrange for help—when your appliance is in need of adjustment to maintain optimal efficiency. ... On the business side, savings will be just as huge. The U.S. Department of Energy estimates buildings account for more than 40 percent of electricity use in our country. There’s no telling how much private and public bodies will be able to save in money—and natural resources—by utilizing the IoT.

Connected cars: What happens to your data after you leave your rental car behind?

A new report suggests it is not clear who is responsible for protecting the data that can be uploaded from smartphones when they connect to in-car systems. This data can include the location and contents of the smartphone as well as the user's home address, and it is often stored in the connected infotainment system and is not deleted. Privacy International rented a series of internet-connected cars from vehicle hire and car sharing firms and found that not only was information about previous drivers collected and retained in the infotainment system, the system also contained past locations the vehicle had travelled to and could identify previously connected smartphones. "In most of them there were between five and ten different phone identifiers. When you connect to the Bluetooth, it will store your identifier," Millie Graham Wood, solicitor and legal officer at Privacy International, told ZDNet.

Redefining perimeter network security: The future is a hybrid

“[The perimeter] is a very limited mindset which breaks down in a wifi and cloud world,” Keith Casey says. In addition to serving as adviser to multiple startups, Casey is an API problem solver at Okta, a San Francisco-based identity cloud provider. “Because we can’t count on the borders that we’ve always counted on, things are different,” he explains. “Previously, [IT] could say if you’re on our network — on our physical, hard-wired network — here are the security protocols. If you have physical access to our network, we can trust you.” Pre-cloud, this perimeter was always reinforced by internal defenses such as antivirus scanning or endpoint protection tools. Both then and now, Casey says, “Perimeter by itself isn’t enough. If I get inside, I can run wild. It’s like not using a safe because you keep your front door locked.” In that way, best practices haven’t changed: It’s always a good idea to have a rear guard.

Why Big Data and Data Scientists Are Overrated

The fact is, data scientists spend about three-quarters of their time doing data janitorial work – collecting, transforming, and cleaning data – rather than building the complex predictive models that they were actually hired for. That equals frustration for data scientists who had high hopes of making an impact, and sour grapes for the people who hired them. Organizations should start with the basics, and work up from there. Instead of being lured by the “shiny object” syndrome and thinking you need a big Hadoop data lake or neural networks to solve a problem, seek the simplest answer. “People make a mistake if they jump right to the most sophisticated tool, because they’re wasting a lot of time,” Mintz says. “The reality is a lot of problems are quite tractable with a simple regression. And some problems don’t even need that. You can just look at the data and see what’s happening.”

Can Open Banking fulfil expectations?

The new rules are designed to give banking customers – which include businesses – more control of their financial data, allowing them to share it with organisations other than their banks, therefore opening up opportunity for fintech firms. But the Bank of England governor Mark Carney has suggested lenders aren’t taking the threat of fintech seriously enough, which means they could see the rug pulled out from under them as smaller “underdog” firms start taking more market share. However, research from Accenture in October found that 69 per cent of British consumers wouldn’t want to share their bank account information with third-party providers. In fact, more than half said they will never change their existing banking habits and adopt Open Banking. It is clear that companies are facing an uphill battle, both in terms of implementing the new rules, and building customers’ trust.

---

Quote for the day:

"It's time to take the innovation out of IT and give it back to the business, with the support of IT." -- Stuart Birrell

---

Daily Tech Digest - December 05, 2017

Google Has Released an AI Tool That Makes Sense of Your Genome

DeepVariant was developed by researchers from the Google Brain team, a group that focuses on developing and applying AI techniques, and Verily, another Alphabet subsidiary that is focused on the life sciences. The team collected millions of high-throughput reads and fully sequenced genomes from the Genome in a Bottle (GIAB) project, a public-private effort to promote genomic sequencing tools and techniques. They fed the data to a deep-learning system and painstakingly tweaked the parameters of the model until it learned to interpret sequenced data with a high level of accuracy. Last year, DeepVariant won first place in the PrecisionFDA Truth Challenge, a contest run by the FDA to promote more accurate genetic sequencing. “The success of DeepVariant is important because it demonstrates that in genomics, deep learning can be used to automatically train systems that perform better than complicated hand-engineered systems,” says Brendan Frey, CEO of Deep Genomics.

Using AI for Real Intelligence

AI is clearly moving from the scientific and theoretical to the practical. "One interesting stat shows 75 percent of companies looking to implement AI or machine learning (ML)," said Stubbs. ... Microsoft is working on an AI platform that consists of services like Microsoft Cognitive Services, Bot Framework, Azure Machine Learning, and the Cognitive Toolkit. The company has more than 7,000 engineers working on this, and all product groups have been encouraged to incorporate AI capabilities. "We have previously talked about a mobile-first and cloud-first model, but that's really more about mobility of the experience than the device," Stubbs said. "With agents and bots and AR and VR, we are expanding the definition of how we think of this. It leads us to the intelligent cloud and intelligent edge models -- the idea that devices at the edge powered by the cloud are able to expand that experience. AI happens in a bunch of places; it doesn't just happen in the cloud."

2018 Goal: Re-position Cybersecurity As An Enabler

As long as cybersecurity is viewed as a pain, it’ll never be integrated into the fabric of an organization. Fortunately, there have been significant advances in cloud-based security services that enable new ways to embed cybersecurity into enterprise services people want. Ever wonder why dentists re-positioned themselves as teeth whitening experts? Answer: no one likes cavities and, by association, the people who fix them. Similarly, as long as cybersecurity is viewed as a pain, it will never gain widespread organizational support. Fortunately, there have been significant advances in cloud-based data encryption, endpoint trust analysis and access control that enable security controls to be integrated into the application workflow. Here are a few enterprise service ideas that will make you a hero in 2018

New Security Architecture Practitioner's Initiative

The Security Architecture Practitioner’s Initiative is a joint effort of The Open Group Security Forum and The SABSA Institute to articulate in a clear, approachable way the characteristics of a highly-qualified Security Architect. The focus of this initiative is on the practitioner, the person who fills the role of the Security Architect, and on the skills and experience that make them great. This project is not about security architecture as a discipline, nor about a methodology for security architecture but rather about people and what makes them great Security Architects. The project team consists of pioneering Security Architects drawn from both The Open Group Security Forum and The SABSA Institute who have between them many decades of security architecture experience at organizations such as Boeing, IBM, HP, and NASA. Operating under the auspices of The Open Group and in collaboration with The SABSA Institute, they will provide two core deliverables

5 Key Data Predictions For 2018

As data becomes self-aware and even more diverse than it is today, the metadata will make it possible for the data to proactively transport, categorize, analyze and protect itself. The flow between data, applications and storage elements will be mapped in real time as the data delivers the exact information a user needs at the exact time they need it. This also introduces the ability for data to self-govern. The data itself will determine who has the right to access, share and use it, which could have wider implications for external data protection, privacy, governance and sovereignty. ... A judge or insurance company may need it to determine liability, while an auto manufacturer may want it to optimize the performance of the brakes or other mechanical systems. When data is self-aware, it can be tagged so it controls who sees what parts of it and when, without additional time consuming and potentially error prone human intervention to subdivide, approve and disseminate the valuable data.

Businesses need to balance user experience, privacy and security

“Consent is a key aspect of the GDPR, and organisations need to ensure that consent is freely given, specific, informed and unambiguous,” he said. “They need to be clear about what they are collecting, what purpose they are collecting the data, and they must provide processes for consumers to withdraw consent if they wish.” However, done correctly, collecting and managing consumer information can improve the customer experience, said John Tolbert, lead analyst at KuppingerCole. “Consumer identity management can also enable new business models, such as freemium models where basic services are provided free with the option of upgrading to paid services or shared revenue models,” he said. Tolbert also emphasised the importance of making it clear to consumers what they will get in exchange for agreeing to allow businesses to collect and user their data.

Uwe Friedrichsen on Functional Service Design and Observability

Developers should familiarise themselves with fault tolerant design patterns, such as circuit breakers, bulkheads, timeouts and retries, which has been popularised by Michael Nygard’s “Release It!” book. Caching, although useful, should be deployed with care, and not used simply to overcome bad system design, such as a long activation path involving many dependent services. Friedrichsen presented a series of ‘foundations of design’ for microservices (pictured below), which included a series of design principles focusing on high cohesion, low coupling, and separation of concerns. This principles are especially crucial across system boundaries, and even though the theory has been well documented in the 70s by David Parnas (PDF link), it is still often misunderstood.

8 digital transformation resolutions for CIOs in 2018

CIOs can help by taking the lead in creating a company-wide digital transformation plan that goes beyond digitizing documents and looks at ways operations can be digitized and automated for faster, leaner performance. The plan should include which digital technologies you plan to implement, dates for implementation, specific levels of investment, and business values they'll deliver. The plan should be spread over a period of three to five years, and should be reviewed and revised with input from C-level executives, key business influencers and senior IT staff at least annually. Project priorities should be defined and agreed upon so that everyone understands which project gets worked on first. Too many projects going at once start to interfere with each other. They contend for resources and ultimately fail. The CIO can play a major role to prevent this disorganization from happening.

Big banks hope early bet on Alexa will pay off

Whether Alexa banking becomes a staple still remains to be seen, but banks with skills are keen to follow and find out, and regardless, it exposes them to the bigger picture of connected devices. Since September, U.S. Bank has let customers check their balances and make payments to U.S. Bank credit cards, among other things, speaking to Alexa. So far, the bank has deemed the launch as successful. “Customers who are using it seem to really like it,” said Gareth Gaston, head of omnichannel banking at U.S. Bank. While the bank isn’t disclosing usage numbers, he said people who ask Alexa a question tend to ask a follow-up question. Already, Gaston said, U.S. Bank plans to launch on Siri and Google Home and he can see a day where the lines will blur between talking to Alexa or a call center — especially when voice-based authentication on the devices exist. “I think this is the very, very tip of the iceberg that we are seeing,” he said.

Security: Making yourself a hard target for hackers is easier than you think

Strong passwords, two factor authentication, antivirus, and backups are just some of the simple things users can employ to protect themselves from cyberattacks -- yet breaches and malware infections show that some of the most basic advice is often not followed. "We pretend this is the most complicated thing in the world, and yet strong passwords, backing up your data, updating your security software -- security isn't that difficult," said Raj Samani, chief scientist at McAfee. The UK's National Health Service was one of the most high-profile victims of May's global WannaCry ransomware virus outbreak, with a proportion of hospitals taken offline -- some of which didn't have systems restored for weeks. An investigation following the incident found that NHS trusts had been warned to apply critical patches to prevent systems being exposed to the EternalBlue Windows vulnerability which WannaCry used, but that many failed to do so. 

---

Quote for the day:

"Great achievers are driven, not so much by the pursuit of success, but by the fear of failure." -- Larry Ellison

---

Daily Tech Digest - December 04, 2017

HDMI 2.1 has arrived: Here's everything you need to know

The new standard won't impact the average user today or even in the near future, but new hardware coming to market within the next year and into the next decade will deliver better experiences with movies, games, virtual reality, and more. Increased bandwidth is the most salient improvement HDMI 2.1 delivers. We're talking a staggering 48 gigabits per second, compared to the 18Gbps that HDMI 2.0 can handle. That bandwidth bump makes possible all of the larger numbers you'll see in the rest of this story: 8K and 10K video resolution, 4K resolution with a 240Hz refresh rate, and so on. You'll need a new cable--as in the render above, it will be labeled Ultra High Speed HDMI--but that's a small price to pay for what's delivered. HDMI 2.1 also supports VESA's Display Stream Compression (DSC) for even greater bandwidth. In fact, some of the higher resolution/frame rate combinations you see listed in the chart below can only be realized when DSC is in use.

Start Up Baby – How becoming an intrapreneur at SAP broadened my perspective

Many business or product ideas fail because the creator is simply too much in love with his/her own idea. There are countless stories of startups with amazing ideas, loaded with features and functions. But the business with the most features and functions doesn’t necessarily win in the market. And if the business model or pricing is not right, it will be dead on arrival. Test-driving different business models and pricing structures may be necessary before you get it right. Your elevator pitch is key to ensuring what your business is about. You or the customer? Practice, practice, practice your elevator pitch to anyone and everyone who will listen. Do this so that you can get to the value and essence of your business. Make sure that your elevator pitch is about the customer, not about what you want to get out of it. In practicing your elevator pitch, don’t get emotional about honest feedback.

Limit the Internet of Things for Security's Sake

As Foreign Policy reported at the end of last year, the IoT is “already massive and is expected to more than triple in size by 2020 to nearly 21 billion devices. For a cyber-defender, this means that hackers will not only have three times as many targets — they will also have three times as many vectors from which to attack any given target. This creates vast new challenges for network security and complicates the already murky legal and technical landscape for attributing who is responsible for an attack.” Looked at from the perspective of cyber warfare, this is terrifying. A cyber attack that targets your fridge may not sound so scary, but what about one that overloads your electrical system, or takes remote control of your car? No internet-connected device, in short, is ever completely safe. This has long been realized in the security community, and is why critical or dangerous infrastructure employ an “air gap”: these systems are separated from wider networks by hardware devices.

Microsoft drops Edge browser into iOS and Android for free

The apps bring features including a user's Favorites, Reading List, New Tab Page, and Reading View across both their PC and phone, making it easier to continue browsing or researching for work on any device. It also means that work done on your phone while traveling or commuting is immediately available on your PC as well, to continue working or save for later, Belfiore wrote. As ZDNet's Mary Jo Foley noted, with these features, Microsoft is looking to help keep Windows PCs relevant in a world where more computing is done on mobile devices. Due to customer feedback, Microsoft also added roaming passwords to the Edge apps. Users can now save a new password on their phone, and it will follow them to their PC as well. Microsoft also added the dark color theme to both the phone and PC app offerings. Microsoft Edge is now available for iOS in the Apple Store and for Android in the Google Play Store.

Proposed snoopers’ charter changes inadequate, say rights groups

Responding to the proposed changes, the Open Rights Group welcomed the addition of independent authorisation for communications data requests, but said the government has missed the main point of the December 2016 CJEU ruling. Adding independent authorisation for communications data requests will make the police more effective, as corruption and abuse will be harder, said Jim Killock, executive director of the Open Rights Group. But he said the government has evaded the main point of the Watson judgment, which is that it cannot keep data on a blanket basis.  “Without narrowing what they keep to specific places, incidents or investigations, these changes will not meet the standards set by the courts,” said Killock. “Combined with the so-called Request Filter [covered in the code of practice], which could be a power for a police search engine for retained data, this will remain an incredibly intrusive surveillance power, unparalleled in democratic countries.”

SIFMA, Others to Regulators: No New Cybersecurity Rules Needed

“Laws already exist that make cyber misconduct a federal crime,” Vollmer points out. “Broker-dealers, public companies, and investment advisers are not resisting solutions to the threat of hacking; they are in favor of protecting against cyberintrusions. Cyberintrusions are very costly to businesses. They need cost-effective and workable solutions. If those existed, we have every reason to believe that regulated members of the securities markets would be prepared to adopt them without the compulsion of a law.” Some pro-consumer advocates would like to see increased cyberrules on businesses, especially after the Equifax breach and similar attacks. But, in November, Securities Industry and Financial Markets Association (SIFMA) President and CEO Kenneth Bentsen told the House Subcommittee on Financial Institutions and Consumer Credit that he favors “regulatory harmonization.”

Open source innovation is now all about vendor on-ramps

Google in particular has figured out how to both open-source code in a useful way and make it pay. As Server Density CEO David Mytton has underlined, Google hopes to “standardize machine learning on a single framework and API,” namely TensorFlow, then supplement it “with a service that can [manage] it all for you more efficiently and with less operational overhead,” namely Google Cloud. By open-sourcing TensorFlow and backing it with machine-learning-heavy Google Cloud, Google has open-sourced a great on-ramp to future revenue. My question: why not do this with the rest of its code? The simple answer is “Because it’s a lot of work.” That is, Google could open-source everything tomorrow without any damage to its revenue, but the code itself would provide other providers and enterprises only limited ability to increase their revenue unless Google did all the necessary prep work to make it useful to mere mortals not running superhuman Google infrastructure.

Vava Dash Cam review: Great video and ground-breaking features

The Vava Dash looks like nothing so much as a overly thick, rounded hockey puck—in a good way. Really. It couples magnetically to a suction mount, which allows it to be rotated a full 360 degrees to capture any non-frontal exterior or interior hi-jinx you feel should be preserved for posterity.  The only thing even slightly untoward about the arrangement is that the suction mount is quite sticky and picks up nearly every piece of hair or lint in the area if you drop it. Use a fair amount of force when you affix it to the windshield, and if you drop it, clean it using warm water only—no soap or chemicals. Or perhaps permanently attach the mount with double-sided sticky tape once you’ve determined the optimal location. As the camera is easily detachable, it would be nice if Vava offered a more permanent mounting solution.

Fintechs must curb privacy invasion, says Privacy International

According to Privacy International, the increase in consumer information harvested by fintech firms has been largely unchecked, particularly in developing countries, while serving the interests of companies and industries, which are mostly located in developed countries. New sources of data, including text messages and call logs, are increasingly being used to decide a consumer’s suitability for various financial products, including loans, the report reveals. If current trends continue, Privacy International believes it will become increasingly difficult, and eventually impossible, for people to use financial services without having to allow access to the most intimate information about themselves. The report is based on research that analyses the India Stack initiative, built on the Aadhaar identification number in India, and credit scoring apps and services in Kenya.

What is a scrum master? The agile development leader defined

The scrum master role has evolved to help development teams practice scrum, evolve the process, and improve its collaboration. Scrum masters’ primary responsibility is to service the team by demonstrating the values that make teams successful. They participate in team discussions by asking questions, making sure all voices are heard, ensuring the team is comfortable taking appropriate risks, and educating team members on scrum practices. Scrum masters are often responsible for managing blocks escalated by the team, organizing efficiently run demo meetings, and facilitating the discussion at retrospective meetings. ... Most important, they facilitate the collaboration required to identify problem statements, review implementation options, and recommend solutions when both product owner and team have to collaborate to make a successful product or service delivery to customers.

---

Quote for the day:

"Leave every person you interact with feeling better about themselves; feeling loved & appreciated." -- Wright Thurston

---