Daily Tech Digest - February 17, 2018

The Three Do’s of DDoS protection

Attackers have been putting DDoS firmly in the IT and Network consciousness – and they did it by substantially raising the bar for just how big and disruptive a DDoS attack can now be. ... DDoS attacks are not just growing in strength and frequency, but also diversifying in whom they target and the diversity of DDOS attacks, application layer as well as volumetric. You no longer need to be a big organisation to be impacted by DDoS – everyone is now a target. And as more of us conduct our business on internet-based systems, the risk of costly disruption grows. Attacks are backed by significant malicious resources, and are most effectively countered by the service provider that connects you to the Internet. DDoS attacks can strike at any time; potentially crippling network infrastructure and severely degrading network performance and reachability. Depending upon the type and severity of an attack on a website or other IP-accessible system, the impact can result in thousands or even millions of dollars of lost revenue.

When Streams Fail: Implementing a Resilient Apache Kafka Cluster at Goldman Sachs

Gorshkov reminded the audience of latency numbers that every programmer should know, and stated that the speed of light dictates that a best-case network round trip from New York City to San Francisco takes ~60ms, Virginia to Ohio takes ~12ms, and New York City to New Jersey takes ~4ms. With data centers in the same metro area or otherwise close, multiple centers can effectively be treated as a single redundant data center for disaster recovery and business continuity. This is much the same approach as taken by modern cloud vendors like AWS, with infrastructure being divided into geographic regions, and regions being further divided into availability zones. Allowing multiple data centers to be treated as one leads to an Apache Kafka cluster deployment strategy as shown on the diagram below, with a single conceptual cluster that spans multiple physical data centers.

Can Cybersecurity be Entrusted with AI?

Will AI be the bright future of security as the sheer volume of threats is becoming very difficult to track by humans alone. May be AI might come out as the most dark era, all depends upon Natural Intelligence. Natural Intelligence is needed to develop AI/machine learning tools. Despite popular belief, these technologies cannot replace humans (My own personal opinion). Using them requires human training and oversight. As the results reveal, AI is here to stay and it will have a large impact on security strategies moving forward but side by side with Natural intelligence. Cybersecurity state as on date is too much vulnerable but implementation of AI systems into the mix can serve as a real turning point. These systems come with a number of substantial benefits. These benefits will help prepare cybersecurity professionals for taking on cyber-attacks and safeguarding the enterprise.

What’s Driving India’s Fintech Boom?

Industry analysts expect that payments will be a pathway to other areas such as lending, insurance, wealth management and banking. “Most people in India lack credit history. Digital payments give them a credit history which can be leveraged in other areas,” explains Prantik Ray, professor of finance at XLRI – Xavier School of Management. Ravi Bapna, professor of business analytics and information systems at the Carlson School of Management, University of Minnesota, adds: “Innovative data-driven and behavioral risk management models can overcome barriers that arise from lack of widespread and robust credit scoring of individuals.” Rajesh Kandaswamy, research director-banking and securities at Gartner, points out that in mature geographies, payment mechanisms are already evolved and basic banking services are a given. However, in countries like China and India, digital payments are evolving in tandem with the growth in ecommerce.

In a digital world, do you trust the data?

Trust is now a defining factor in an organization's success or failure. Indeed, trust underpins reputation, customer satisfaction, loyalty and other intangible assets. It inspires employees, enables global markets to function, reduces uncertainty and builds resilience. The problem is that - in today's environment - trust isn't just about the quality of an organization's brands, products, services and people. It's also about the trustworthiness of the data and analytics that are powering its technology. KPMG International's Guardians of trust report explores the evolving nature of trust in the digital world. Based on a survey almost 2,200 global information technology (IT) and business decision-makers involved in strategy for data initiatives, this report identifies some of the key trends and emerging principles to support the development of trusted analytics in the digital age.

The Great Disruption of Your Career

Seriously; even coffee shops are now using affordable facial recognition technology with basic CRM to create an amazing experience for customers... "Hi Tony, your triple-shot decaf, skim, soy latte is on its way... did you manage to go water-skiing on the weekend?" Perfect... I'll be able to keep my head down deleting spammy emails while rocking away to Spotify... no need place an order in advance or give eye contact or interact with anyone while securing my morning caffeine fix :-) White collar professions are not immune to the employment apocalypse. Combinations of technology with offshoring to lower cost markets are already biting like a savage dog at your crotch. Do you lay awake at night wondering how you can make yourself indispensable? What do you really do that cannot be automated?

Designing, Implementing, and Using Reactive APIs

Reactive programming is a vast subject and is well beyond the scope of this article, but for our purposes, let’s define it broadly as a way to define event driven systems in a more fluent way than we would with a traditional imperative programming style. The goal is to move imperative logic to an asynchronous, non-blocking, functional style that is easier to understand and reason about.  Many of the imperative APIs designed for these behaviors (threads, NIO callbacks, etc.) are not considered easy to use correctly and reliably, and in many cases using these APIs still requires a fair amount of explicit management in application code. The promise of a reactive framework is that these concerns can be handled behind the scenes, allowing the developer to write code that focuses primarily on application functionality. The very first question to ask yourself when designing a reactive API is whether you even want a reactive API! Reactive APIs are not the correct choice for absolutely everything.

Wireless Reshaping IT/OT Network Best Practices

IoT, its accompanying cloud services and Big Data analytics, routinely deliver immense and unheard-of amounts of data from devices and sensors. That means network architectures continue to adapt and will change dramatically to implement the data flow from these sensors. That also means networks will become outward focused, as the amount of data acquired from edge devices dwarf the amount of data produced inside the network. Previously, network architecture for wireless used a design that had a wireless access point directly and quickly connected to wired Ethernet. Network backhauls were always wired. However, in more recent times, companies with sprawling multi-building campuses, manufacturing, or process plants, have been using wireless backhauls. Some of these are using WiMAX (IEEE 802.16) as broadband microwave links. Others are designed as optical. These wireless backhauls are significantly less expensive to install, and provide secure data transmission.

GDPR: The Data Subject Perspective

The discussion that followed highlighted a key point: the value of the data means that stakes are high. Organizations are understanding how much value can be driven by intelligent use of data. My opinion is that many individuals have sold themselves short in negotiations around use of personal data. This is because individual data subjects have had limited knowledge, power or influence at a negotiating table that doesn’t really exist – unlike the agreement process for other contracts in which both parties are normally well informed. GDPR implication: The key is intelligent use of data. Personal data which is not managed correctly will have less impact on an organization’s bottom line, and will become a burden under GDPR. Organizations should review their data collection mechanisms and consider data minimisation, and data masking technology to implement privacy by default and design.

A business guide to raising artificial intelligence in a digital economy

The report highlights a need for a fundamental shift in leadership that is required to cultivate partnerships with customers and business partners, and to further accelerate the adoption of artificial intelligence as the fuel for enterprises to grow and deliver social impact. Accenture's 2018 report ...  highlights how rapid advancements in technologies -- including artificial intelligence (AI), advanced analytics and the cloud -- are enabling companies to not just create innovative products and services, but change the way people work and live. This, in turn, is changing companies' relationships with their customers and business partners. "Technology," said Paul Daugherty, Accenture's chief technology and innovation officer, "is now firmly embedded throughout our everyday lives and is reshaping large parts of society. This requires a new type of relationship, built on trust and the sharing of large amounts of personal information."

---

Quote for the day:

"A wise man gets more use from his enemies than a fool from his friends." -- Baltasar Gracian

---

Daily Tech Digest - February 16, 2018

5 Eearly Warning Signs Of Project Failure

One of the first (and biggest) warning signs that your project may be headed for failure is an internal culture that is resistant to change. Projects bring about improvements in workflows and new operational best practices, often with an increased use of technology. These changes can create a significant amount of fear, as employees assume the end result will mean job losses or major disruption to their individual working world. Many projects have been internally sabotaged right from the start as result of these fears. How can you tell if you have a culture that is resistant to change? Employees who are resistant to change are often reluctant to share information and exhibit negative attitudes towards the project and its benefits, either through direct communication or body language and facial expressions. Alleviating these fears by creating a culture that embraces change is key.

A quick-and-dirty way to predict human behavior

Machine learning and AI technologies are everywhere. One of the top uses is to predict human behavior. Luckily, people are creatures of habit. Moreover, when given the freedom to do anything they want, most people will do what everyone else is doing (I’m paraphrasing a badly remembered quote). That makes is kind of easy to predict what people will do next, at least statistically. Imagine you go to a website and start rating things. First you rate a cat picture, then a baseball, and then a Magpul FMG-9. There were also a few things you didn’t rate on the same page. Assuming that someone else made similar rankings as you, we can probably “guess” what you’d rank the other things. ... The algorithm that many recommendations are based on is called Alternating Least Squares (or some form of it). With ALS, you use a training set or, if you have a lot of users, you can use some of them as the training set to rate the others.

HP expands its Device-as-a-Service offering to include Apple

Through its DaaS offering, HP determines the contractual relationship enterprises want to have, whether it's with a value-added reseller, a global systems integrator or a direct relationship with HP, "and then we provide it back to you within a utility model or a per-user, per-device pricing model," said Jonathan Nikols, global head of HP's Device-as-a-Service. For example, the cost of a contract would include an SLA on how fast the turnaround time on a device repair and replacement should be – whether it's next day or in four days. When an end user's device breaks or needs replacing, they file a help-desk ticket just as they would with any IT shop; the ticket is automatically routed to the HP DaaS service. The service also handles employee on-boarding and off-boarding. Mixed-device environments are the norm now, HP said, making it increasingly difficult and costly for organizations to manage multiple device types, OSes and vendors.

Who should buy a Ryzen APU, and who shouldn't

If you're asking yourself, "should I buy a Ryzen APU?" for a new budget gaming PC, the short answer is yes, probably. That's because for building a ground-up, entry-level gaming machine, the Ryzen APU is the best game in town, and possibly the only game for DIY builders, in the face of wallet-busting GPU prices. But for everyone? Well, no. There is no one-size fits all answer, so read on to learn who should buy the Ryzen APU—and who shouldn't.  ... AMD's new APUs have essentially enough CPU and GPU power to enable satisfying gaming at 720p to 1080p. Both APUs combine quad-core Zen x86 cores with up to 11 Vega graphics cores, and the Ryzen 5 2400G also has SMT. The integrated graphics basically offers from double to triple the gaming performance of Intel's HD 630 graphics, which is inside everything from an $85 Pentium to a $380 Core i7.

How your company can prevent a data breach – and what to do if one occurs

As any executive whose company has suffered a data breach knows, the true costs of cybercrime are devastating, far-reaching and continue long after business functions have been restored. Between investigation and repair costs, customer notification requirements, contractual liabilities and workflow continuity, worldwide spending to mitigate the impact of cyberattacks is projected to reach an unprecedented $90 billion this year. Then there are the indirect costs, which include legal fees and public reputation rebuilding. This last component is particularly crucial, since a recent Gemalto survey revealed that 70 percent of consumers said they would cut ties with a company that had suffered a cyberattack. Indeed, businesses are anticipated to bear the brunt of cybercrime’s growing financial burden.Over half of last year’s cyberattacks targeted corporations; and among all small businesses, 58 percent had been personally hit by data breach.

Juniper Networks Expands Portfolio for Secure Multicloud Computing

“The promise of multicloud is to deliver an infrastructure that is secure, ubiquitous, reliable and fungible and where the migration of workloads will be a simple and intuitive process,” said Bikash Koley, chief technology officer at Juniper Networks. “For IT to be successful in becoming multicloud-ready, it is critical organizations consider not only the data center and public cloud, but also the on-ramps of their campus and branch networks. Otherwise, enterprises will face fractured security and operations as network boundaries prevent seamless, end-to-end visibility and control.” A Juniper-commissioned study by PwC found that workload migration is underway in the next three years across every core functional area, such as customer service, systems management, marketing, compute bursting, business applications, DevOps and backup and recovery.

Bitcoin thieves use Google AdWords to target victims

The fraudsters established "gateway" phishing links that appeared in search results when potential victims searched Google for cryptocurrency-related keywords, such as "blockchain" or "bitcoin wallet." These links, bolstered by the purchase of Google AdWords, would then send victims to malicious domains, which would serve phishing content depending on the IP address and likely language of the visitor. According to the team, the hackers are focusing on countries where access to traditional banking may be difficult, such as Estonia, Nigeria, Ghana, and a number of other African countries. When access to banking is difficult, cryptocurrency, as decentralized assets recorded on the Blockchain, may empower users financially. However, it seems that the cybercriminals behind the campaign also know there may be more interest from residents of these countries, and so, this idea has decided the focus of phishing campaigns.

Google's Android P will make it easier for OEMs to copy iPhone X

Google's intent on making Assistant more visible in Android comes as the personal digital assistant market is becoming too crowded, forcing potential competitors out. While Amazon's Alexa and Microsoft's Cortana are available as downloadable apps, Samsung's built-in and much maligned Bixby assistant continues to linger, though The Verge has called for Bixby's death. Cortana was conspicuously absent at CES 2018, leading ZDNet's Larry Dignan to declare the trade show "Cortana's Funeral." Facebook announced the discontinuation of their virtual assistant, M, in January. For screen cutouts, it is yet to be seen if this design trend will continue to persist, or if this will wind up as a fad similar to 3D phones. While Apple's use of the technology is notable, it seems unlikely that manufacturers are holding back on shipping phones for lack of OS-level support. Of note, Sharp also produced a handful of 3D smartphones available primarily in Japan.

Nokia is re-evaluating its wearables division

Once a global leader in mobile, the company failed to embrace the smartphone revolution, selling to Microsoft, which then shuttered the whole thing entirely. Of course, the Nokia name is back in the smartphone space, but that comes under a licensing deal through HMD — a company founded by former execs from the company. Interestingly, recent numbers show that the brand has actually been doing pretty well. Wearables, on the other hand, have stagnated, forcing brands to exit the space, sell or shutter entirely. The herd has thinned over the past year, and even top names like Fitbit have struggled to keep their head above water. For Nokia, acquiring a company like Withings no doubt seemed like a quick way to hit the ground running — but the timing was rough on this one. Hopefully this doesn’t mark the end of the Withings/Nokia Health line, which made some really solid and innovative devices.

Cloud sync vs backup: Which disaster recovery works better for business continuity?

Backup is the traditional way most businesses protect their digital assets from disaster. At regular intervals, changes in local storage are transferred to either a local backup device or a cloud backup service. Usually, these changes are incremental and go into backup archives. A good backup service will store ongoing snapshots, so it's always possible to go back in time and recover an old document. The gotcha with backup systems is that recovery is often cumbersome. You usually have to launch a backup program on your PC, dig through the various backup instances, and initiate a restore. In most cases, you can't really use or read the files in the backups until they're restored to your computer. Cloud sync, by contrast, takes files that exist on your local computer and moves them into a cloud infrastructure. Most cloud infrastructures encourage you to work on the files in the cloud.

---

Quote for the day:

"A leadership disposition guides you to take the path of most resistance and turn it into the path of least resistance." -- Dov Seidman

---

Daily Tech Digest - February 15, 2018

How cloud computing surveys grossly underreport actual business adoption

Whatever the size of the IT department, all companies are having to fundamentally rethink their applications, with cloud-first increasingly a matter of survival. One example I am familiar with is that of a large enterprise that was trying to figure out how to rearchitect a massive application first conceived in the early 2000s. At the time it was first built, the enterprise had very different needs from today—thousands of users, gigabytes or terabytes of data, customers all sitting in the same region, performance important but not all-consuming. This enterprise built on internal servers and focused on a scale-up model. That's all there was. Today, that same application has millions of users, distributed globally. The data volume is in the petabytes (and approaches exabytes). Performance latency must be measured in milliseconds and, in some cases, microseconds. There is no option but cloud. More applications look like this today than the earlier instantiation of that application.

How AI will underpin cyber security in the next few years

Artificial intelligence (AI) is emerging as the frontrunner in the battle against cyber crime. With autonomous systems, businesses are in a far better place to strengthen and reinforce cyber security strategies. But does this technology pose challenges of its own? Large organisations are always exposed to cyber criminals, and so they need appropriate infrastructure to spot and combat threats quickly. James Maude, senior security engineer at endpoint security specialist Avecto, says systems incorporating AI could save firms billions in damage from attacks. “Although AI is still in its infancy, it’s no secret that it is becoming increasingly influential in cyber security,” he says. “In fact, AI is already transforming the industry, and we can expect to see a number of trends come to a head, reshaping how we think about security in years to come. We might expect to see AI applied to cyber security defences, potentially avoiding the damage from breaches costing billions.”

IBM sees blockchain as ready for government use

There is a growing concern that cryptocurrency could be a threat to the global financial system through unbridled speculation and unsecured borrowing by consumers looking to purchase the virtual money. ... "First and foremost, blockchain is changing the game. In today's digitally networked world, no single institution works in isolation. At the center of a blockchain is this notion of a shared immutable ledger. You see, members of a blockchain network each have an exact copy of the ledger," Cuomo said. "Therefore, all participants in an interaction have an up-to-date ledger that reflects the most recent transactions – and these transactions, once entered, cannot be changed on the ledger." For blockchain to fulfill its potential, it must be "open," Cuomo emphasized, and based on non-proprietary technology that will encourage widespread industry adoption by ensuring compatibility and interoperability.

7 threat modeling mistakes you’re probably making

The Open Web Application Security Project (OWASP) describes threat modeling as a structured approach for identifying, quantifying and addressing the security risks associated with an application. It essentially involves thinking strategically about threats when building or deploying a system so proper controls for preventing or mitigating threats can be implemented earlier in the application lifecycle. Threat modeling as a concept certainly isn't new, but few organizations have implemented it in a meaningful way. Best practices for threat models are still emerging says Archie Agarwal, founder and CEO of ThreatModeler Software. "The biggest problem is a lack of understanding of what threat modeling is all about," he says. There are multiple ways to do threat modeling and companies often can run into trouble figuring out how to look at it as a process and how to scale it. "There is still a lack of clarity around the whole thing."

Skype can't fix a nasty security bug without a massive code rewrite

Security researcher Stefan Kanthak found that the Skype update installer could be exploited with a DLL hijacking technique, which allows an attacker to trick an application into drawing malicious code instead of the correct library. An attacker can download a malicious DLL into a user-accessible temporary folder and rename it to an existing DLL that can be modified by an unprivileged user, like UXTheme.dll. The bug works because the malicious DLL is found first when the app searches for the DLL it needs. Once installed, Skype uses its own built-in updater to keep the software up to date. When that updater runs, it uses another executable file to run the update, which is vulnerable to the hijacking. The attack reads on the clunky side, but Kanthak told ZDNet in an email that the attack could be easily weaponized. He explained, providing two command line examples, how a script or malware could remotely transfer a malicious DLL into that temporary folder.

Cryptomining malware continues to drain enterprise CPU power

“Over the past three months cryptomining malware has steadily become an increasing threat to organizations, as criminals have found it to be a lucrative revenue stream,” said Maya Horowitz, Threat Intelligence Group Manager at Check Point. “It is particularly challenging to protect against, as it is often hidden in websites, enabling hackers to use unsuspecting victims to tap into the huge CPU resource that many enterprises have available. As such, it is critical that organizations have the solutions in place that protect against these stealthy cyber-attacks.” In addition to cryptominers, researchers also discovered that 21% of organizations have still failed to deal with machines infected with the Fireball malware. Fireball can be used as a full-functioning malware downloader capable of executing any code on victims’ machines. It was first discovered in May 2017, and severely impacted organizations during Summer of 2017.

Intel launches new Xeon processor aimed at edge computing

Edge computing is an important, if very early stage, development that seeks to put computing power closer to where the data originates, and it is seen as working hand in hand with Internet of Things (IoT) devices. IoT devices, such as smart cars and local sensors, generate tremendous amounts of data. A Hitachi report (pdf) estimated that smart cars would at some point generate 25GB of data every hour. This can’t all be sent back to data centers for processing. It would overload the networks and the data centers. Instead, edge computing processes the data at its origin. So, smart car data generated in New York would be processed in New York rather than sent to a remote data center. Major data center providers, such as Equinix and CoreSite, offer such services at their data centers around the country, and startup Vapor IO offers ruggedized mini data centers that can be deployed at the base of cell phone towers.

Q# language: How to write quantum code in Visual Studio

Designed to use familiar constructs to help program applications that interact with qubits, it takes a similar approach to working with coprocessors, providing libraries that handle the actual quantum programming and interpretation, so you can write code that hands qubit operations over to one Microsoft’s quantum computers. Bridging the classical and quantum computing worlds isn’t easy, so don’t expect Q# to be like Visual Basic. It is more like using that set of Fortran mathematics libraries, with the same underlying assumption: that you understand the theory behind what you’re doing. One element of the Quantum Development Kit is a quantum computing primer, which explores issues around using simulators, as well as providing a primer in linear algebra. If you’re going to be programming in Q#, an understanding of key linear algebra concepts around vectors and matrices is essential—especially eigenvalues and eigenvectors, which are key elements of many quantum algorithms.

Breaking the cycle of data security threats

First, there’s the lack of mandatory reporting and the limits of voluntary reporting. Second, the lack of real protection for the personal information we’ve entrusted to various companies. Third, the clear indication that CEOs and corporations still aren’t paying enough attention to cybersecurity issues; perhaps because there’s been a startling lack of real penalty for failing to protect information from hackers. Finally, there’s a need to recognize that securing information is hard work on an ongoing basis. It’s a truism of security that no product is a “silver bullet” to put an end to attacks. Another industry truism says security is a journey, not a destination. There are few regulations that require organizations to report data breaches, especially those outside financial services and health care. Is it any surprise that companies are reporting breaches years after they occurred? How many unreported breaches will never surface?

The Top Five Data Governance Use Cases and Drivers

As the applications for data have grown, so too have the data governance use cases. And the legacy, IT-only approach to data governance, Data Governance 1.0, has made way for the collaborative, enterprise-wide Data Governance 2.0. In addition to increasing data applications, Data Governance 1.0’s decline is being hastened by recurrent failings in its implementation. Leaving it to IT, with no input from the wider business, ignores the desired business outcomes and the opportunities to contribute to and speed their accomplishment. Lack of input from the departments that use the data also causes data quality and completeness to suffer. So Data Governance 1.0 was destined to fail in yielding a significant return. But changing regulatory requirements and mega-disruptors effectively leveraging data has spawned new interest in making data governance work.

---

Quote for the day:

"Technological change is not additive; it's ecological. A new technology does not merely add something; it changes everything." -- Neil Postman

---

Daily Tech Digest - February 14, 2018

Microsoft to test blockchain-based self-sovereign ID system

"Today, the Microsoft Authenticator app is already used by millions of people to prove their identity every day. As a next step we will experiment with Decentralized Identities by adding support for them into Microsoft Authenticator," Patel wrote. "With consent, Microsoft Authenticator will be able to act as your User Agent to manage identity data and cryptographic keys." On the new platform, only a user's hashed ID is rooted on a blockchain, while actual identity data is encrypted and stored in an off-chain ID Hub that Microsoft can't see. "Once we have added this capability, apps and services will be able to interact with [a] user's data using a common messaging conduit by requesting granular consent," Patel said. "Initially, we will support a select group of [digital ID] implementations across blockchains and we will likely add more in the future."

Fileless Malware: Not Just a Threat, but a Super-Threat

Those invisible aliens may not have landed on earth just yet, but invisible malware — called fileless malware or in-memory malware — is wreaking havoc and bringing intergalactic war-style destruction to IT systems the world over. Like an invisible alien, fileless malware can strike from multiple directions, without victims even being aware they were targeted, until it's too late. Fileless malware — in which hackers call malware routines remotely and load them into memory in order to compromise or steal data — is not new, but hackers increasingly have turned to that type of attack. According to McAfee, fileless threats with PowerShell malware grew by 119% in the third quarter of 2017 alone, and they have been such a rousing success that hackers plan to greatly expand their use this year, security experts are convinced. But fileless malware is just one of numerous threats and attacks that are now in vogue;

3 common pitfalls of microservices integration—and how to avoid them

Microservices are all the rage. They have an interesting value proposition, which is getting software to market fast while developing with multiple software development teams. So, microservices are about scaling your development force while maintaining high agility and a rapid development pace. In a nutshell, you decompose a system into microservices. Decomposition is nothing new, but with microservices you give the teams developing services as much autonomy as possible. For example, a dedicated team fully owns the service and can deploy or redeploy whenever they want to. They typically also do devops to be able to control the whole service. They can make rather autonomous technology decisions and run their own infrastructure, e.g. databases. Being forced to operate the software typically limits the number of wired technology choices, as people tend to choose boring technology much more often when they know they will have to operate it later on.

Untrained employees can undercut cybersecurity efforts

“If employees don't understand what their responsibilities are when interacting with a company computer system, it's going to be difficult for them to truly protect it," said Mark Burnette, partner at Brentwood-based LBMC Information Security. "They might unknowingly do something that would put the company's data at risk.” Employees may have the company’s best interests at heart, but at the end of the day, it truly comes down to employers to educate them. According to Burnette, the single biggest step employers can take is to routinely provide multifactor authentication. That means using something more than just a password to access sensitive data. The most common form of this is some sort of token, like a key fob with a rotating password or a code sent via SMS to a cell phone.  “This is something companies have to get ahead of. They cannot rely on their users to always catch it. In many cases, the attacks are so good that anyone would fall for them,” he said.

The sudden death of the website

Now, almost every website looks the same — and performs poorly. Offline, brands try to make their store experiences unique to differentiate themselves. Online, every website — from Gucci to the Gap — offers the same experience: a top nav, descriptive text, some pictures and a handful of other elements arranged similarly. Google’s rules have sucked the life out of unique online experiences. Of course, as e-commerce has suffered, Google has become more powerful, and it continues to disintermediate the consumer from the brand by imposing a terrible e-commerce experience. There also is a hidden knock-on effect of bad website design. As much as 90 percent of calls placed to a company’s contact center originate from its website. The journey looks like this: Consumers visit a website to get answers, become confused and have to call. This has become an epidemic, as contact centers field 268 billion calls per year at a cost of $1.6 trillion.

5 Top Threats While Using Social Media Accounts

With your physical life becoming integrated with your cyber life, social media has become the important tool to keep in touch with your work and friends. With the advent of social networks like Facebook, WhatsApp Twitter, YouTube, FourSquare, and Google+, we have changed the way we interact with our bosses, colleagues, and friends. Social media plays a significant role in our lives and by default they are also a high risk for security threats. Cyber risks are directly proportional to popularity. The more popular any App or service is, the more risks it has from cybercriminals. Take Facebook for instance. With over billion users, it is the most hacked social media network. To make sure that your social media account doesn’t get hacked, you need to know the threats you face from cybercriminals to better prepare your self. Here are the top five security threats currently out there to help you stay safe online.

Chrome 68 to condemn all unencrypted sites by summer

Google's campaign to call out HTTP websites as unsafe began in 2014, with the search giant ramping up the effort in September 2016, when it told users Chrome 56 would shame pages that didn't encrypt password or credit card form fields. Chrome 56 debuted in late January 2017, and immediately started to apply the "Not secure" label to pertinent pages. The push for always-HTTPS - backed by Google and others, including Mozilla, maker of Firefox - has worked, Schechter argued. Eighty-one of the web's top 100 sites, she asserted, now used HTTPS by default, while 68% of Chrome traffic on Windows and Android (by pages) and 78% on both macOS and Chrome OS was encrypted. That was up significantly from September 2016, when Schechter said half of all Chrome desktop page loads were being served via HTTPS. Eventually, Chrome's "Not secure" label will be accompanied by a red-for-danger icon.

Israel is becoming an artificial intelligence powerhouse

As has been the case in other tech sectors, including Cybersecurity and Fintech, Israeli AI startups are generating quite a buzz. Broadly speaking, Israeli tech startups have continued to attract tremendous interest from investors, raising a total of $5.24 billion in 2017, an increase of 9 percent from the previous year. Yet, broken down by sector, it is astounding that a staggering $1.1 billion of investment, nearly 20 percent of the aforementioned total, was directed towards AI companies. Driven by multi-sector demand for AI technology, activity in the sector is broad and encompasses all industries, with Israeli AI firms developing solutions across a wide cross section of verticals including Technology, Industrial, Automotive, Enterprise, Healthcare, Fintech, and Marketing. Given the breadth of activity, it is not surprising that Israeli AI startups are receiving global acclaim. Last year, seven Israeli AI companies appeared on CB Insight’s list of “the most promising artificial intelligence companies in the world”.

The Difference between Data Scientists, Data Engineers, Statisticians ...

A data engineer is someone who is dedicated towards developing, constructing, testing, and maintaining architectures, such as a large scale processing system or a database. The main difference between a data engineer and its often confused alternative data scientist is that a data scientist is someone who cleans, organizes, and looks over big data.  You might find the use of the verb “cleans” in the comparison above really exotic and inadvertent, but in fact it has been placed with a purpose that helps reflect the difference between a data engineer and data scientist even more. In general, it can be mentioned that the efforts that both these experts put in are directed towards getting the data in an easy, usable format, but the technicalities and responsibilities that come in between are different for both of them.  Data engineers are responsible for dealing with raw data that is host to numerous machine, human, or instrument errors. 

Financial services firms most adept at making balanced security investments

The report also notes while cyberattacks have a greater financial impact on the financial services industry than on any other industry, financial services firms continue to make prudent and sophisticated security technology investmentsthat contribute to reducing the cost of breaches significantly. The greatest proportion of financial services firms’ cyberdefense spending is for more advanced solutions like security intelligence systems, followed by automation, orchestration and machine-learning technologies. “While the cost of cybercrime for financial services companies continues to rise, our research found that these companies have considerably more balanced and appropriate spending levels on key security technologies to combat sophisticated attacks than do those in other industries,” said Chris Thompson, a senior managing director at Accenture who leads financial services security and resilience in the company’s Security practice.

---

Quote for the day:

"When Things Fall Apart " is when we usually have the most to learn about ourselves. -- Oprah Winfrey

---

Daily Tech Digest - February 12, 2018

Thousands of websites hijacked by hidden crypto-mining code after popular plugin pwned

The malicious code was first spotted by UK-based infosec consultant Scott Helme, and confirmed by The Register. He recommended webmasters try a technique called SRI – Subresource Integrity – which catches and blocks attempts by hackers to inject malicious code into strangers' websites. Just about every non-trivial website on the planet loads in resources provided by other companies and organizations – from fonts and menu interfaces to screen readers and translator tools. If any one of these outside resources is hacked or tampered with to perform malicious actions, such as mine crypto-coins, all the websites relying on that compromised resource will end up pulling the evil code onto their pages and into visitors' browsers. SRI uses a fingerprinting approach to stop vandalized JavaScript from being imported into webpages. If an internet dirtbag changes a third-party provider's source code, the alteration is detected and blocked by the individual websites using this signature technique.

After dismissing security flaw, Amazon patches Key smart lock anyway

The hack effectively blocks the bolt from locking once it's opened, allowing the hacker to later walk right into the victim's home. MG shared specifics of the bug with ZDNet, which he asked to withhold until Amazon fixed the flaw. He published his own write-up after Amazon dismissed the bug last week. "I posted the [proof-of-concept] video with technical details redacted," said MG. "Amazon reached out to me the same day and I started helping them understand the attack." "There was a window of time I didn't hear back for about half a day, meanwhile Amazon PR started talking about the attack and saying it was a non-issue," he added. "Annoying... but I promised Amazon that I would withhold technical details until they released a fix." "A day later, would completely explain the entire attack to Forbes even though a fix wasn't rolled out," he said. When reached, Amazon spokesperson Kristen Kish said the attack was "not a real-life delivery scenario" because "the security features built into the delivery application technology used for in-home delivery are not being used in the demonstration."

How IoT Security Is Integral To Gaining And Retaining Consumer Trust

Technology is only adopted when it actually gets enmeshed with our everyday life; considering this, IoT still has a long way to go. As for the future, it is impossible to offer precise predictions as to what devices will be developed. As a paradigm, IoT should further simplify our lives by utilizing connected devices. On the one hand, IoT opens up exciting new business opportunities and a trail for economic growth. On the other hand, it also opens the door to a variety of new security threats. Since IoT involves networking of “things” or objects that are relatively new and their product design doesn’t always consider security an important factor. Most of the IoT products in the market are often sold with old and unpatched embedded operating system and software. It is generally observed that purchasers of these IoT devices often fail to change the default passwords or fail to select sufficiently strong passwords. IoT also faces a greater number of possible threats as compared to earlier internet technologies due to the various reasons

What It Takes to Transform Your Firm

“If you set the bar too low, that sounds like incrementalism,” she says. Modest steps over a protracted timeline tend to exhaust an organization, making it difficult to reach the finish line. In her view—somewhat counterintuitively—firms that set a lofty target, one with the power to inspire the organization, may stand the best chance of ultimately achieving it. But lofty targets must remain rooted in a company’s core purpose. “Up front, you’ve got to have clarity on why you’re in the business that you’re in,” she says. “If you’re not sure why you’re doing what you’re doing, it’s going to be very hard to set up a transformation that will support your brand position.” Before any transformation, the executive, marketing, and strategy teams should discuss implications for the business model and the brand, outlining in detail how the proposed new direction complements the company’s core purpose. Is this a natural and logical change?

Hybrid Databases for Real Time Online Transaction Processing and Analytics

In the conventional data warehouse model, though, the latency between the time that a transaction has occurred and when it is extracted, transformed, and loaded into the data warehouse prevents any immediate analysis that can influence actions in real time. In essence this model limits any options that would allow the use of the data for complex analysis that might provide useful insights to inform someone of an immediate manual action or to trigger an automated reaction to a customer interaction. And as organizations seek to differentiate their customer centricity initiatives by establish strong customer relationships that are supported by automating reactions to customer interactions though system touch points, there is a need to eliminate this latency and facilitate more immediate analytics so that opportunities for customer engagement and revenue generation are not missed That being said, there are developing options to finesse this impediment.

Time to stop sweating

"Organisations, especially in the mid market, haven't spent a huge amount on IT really since the banking crisis. Money was tight after that and there was uncertainty around spending," he said. "A lot of people have held back but it's got to the point now where sweating has now become in some cases impactful on the business growth and the sustainability of the business," he added that the brakes were now coming off on some investments in order for the customer to remain effective. "It isn't an open cheque book and it still has to be done with the right level of due diligence and checks on it and it has to be linked very closely to aligning it to the business value," he said.  Retail and hospitality are having to react to a growing number of different payment methods, review apps and changing customer expectations. As a result the investment is going into making sure the technology can help firms deal with those changes.

10 top ways IT and data pros are boosting their careers

It's often been said that with technology, the only constant is change, notes Peter Tsai, a B2B technical marketer and IT content writer at Spiceworks in his blog. Therefore, if you're not consistently learning, you’re standing still while the world of tech passes you by. It's no wonder that the majority of IT pros we talked to said learning new things will be a priority this year. ... They say the best things in life are free, but it's also true that money talks, Tsai explains. Staying gainfully employed was probably the second most popular response in our poll, because you need cash to pay for things like food, shelter, video games, and Star Wars tickets. ... In a Spiceworks career study, 67% of IT pros said that tech certifications can help increase job opportunities, Tsai explains. Additionally, 55% said that having a tech certification can help you negotiate a higher salary. Also, some IT recruiters screen candidates based on certs. Therefore, many IT pros want to earn credentials that give their CVs a better chance of moving to the top of the stack.

The Elephant In The Room Is Ransomware

How many times have I heard this catastrophic scenario that predicts the end for tape (again)? It’s Monday, and your manager asks you to delete someone’s personal data from your backup copies because the data protection officer received an email asking the company to follow the “right to be forgotten.” So, you grab a coffee and start figuring out where to find the data—but how can you delete a single file in a tape? You can’t. You’ll need to wipe the entire tape. Should you restore everything? Delete the personal information and backup the remaining data again? Sounds complex. Now imagine that this happens many times per day because of this new regulation—the GDPR. Kind of scary, right? It seems like we’re living in a world where backup software doesn’t use catalogues to track what data is stored where—a world where you need NSA tools to just make a file inaccessible to the public or internal users. But let’s imagine another scenario. It’s Sunday morning and you find that part of your systems have been encrypted by a ransomware attack. You decide to use your backups…until you discover the criminals encrypted your backups first.

How to ensure your IT and security teams stay aligned amid digital transformation

The rapid adoption of new, unfamiliar technology can leave companies vulnerable during the transition, and security teams can feel like they are in the dark as they wait for new systems to be implemented. With the risk of surveillance feeds going down during a technology migration, it’s no wonder that these security experts are nervous about a major shift to cloud and IoT solutions. On the other end of the spectrum, IT teams regularly assess rapidly evolving project requirements and are used to supporting business initiatives with new networks, servers and cloud technology. But managing additional video surveillance tools eats up IT bandwidth, and keeps technology teams from pursuing work such as IoT integration and the implementation of machine learning technology. Because the IT team is tasked with maintaining on-premise servers, they are responsible for designing and executing network upgrades as dictated by the security team’s needs.

How BPM Ensures Future Digital Success For Enterprises

BPM is a vital component of any device that has IoT connectivity. IoT devices excel at sensing, alerting, augmenting reality, and generally interacting seamlessly with the wearer, but are somewhat lacking in areas such as system integration, data processing and process logic. BPM fills this gap by integrating people, processes, tools, systems and devices. BPM’s role in IoT is to determine what is to be done with data received from other devices. BPM supports time sensitive, dynamic business processes, and takes advantage of the real-time data coming out of and going back into IoT devices. Growing adoption will result in more data and more connected devices. Digitalization using BPM involves using digitized data to enable organizations to make quicker decisions, enable optimization of processes and, ease the life of users. BPM provides the ability to integrate processes that involve devices, systems, and humans. Advanced BPM solutions provide access across devices with responsive user experiences, allowing access-driven information sharing across the enterprise.

---

Quote for the day:

"Managers maintain an efficient status quo while leaders attack the status quo to create something new." -- Orrin Woodward

---