Daily Tech Digest - November 05, 2018

One concern that often arises in statistics is erroneous signals. A small bias in a sensor, for example, can cause AI systems to see an effect that isn’t real. The likelihood of a system picking up on an errant signal rises with the volume of data collected; a tiny bias in a sample is far more likely to be noticed by AI when using the volume of data common with today’s machine learning systems. Even data of reasonably high quality can lead to erroneous results, potentially leading companies down an unproductive path. This is part of the reason why data scientists are in such high demand. Their ability to implement the right algorithms is clearly important, but it also takes human judgment to make sense of the results AI systems produce. Determining whether a signal is a real effect can be a challenging task. The power of machine learning is largely due to its ability to learn on its own. In order to get started, however, ML systems need to be trained with a set of data, and this data set needs to be of especially high quality, as even small problems can spoil the algorithms from the beginning.


Six Ways CIOs Can Drive DigitalTransformation

Even though the vast majority of companies—91 percent—that use data and analytics have experienced increases in revenue, only a third see themselves as leaders in customer experience. This gap highlights how underutilized data and analytics continue to be in the business world. Researchers from the MIT Center for Digital Business define digital transformation as “the use of technology to radically improve performance or reach of enterprises.” In a 2014 survey of 157 executives at 50 companies, researchers found the best-performing companies combined digital activity with strong leadership to leverage technology for transformation. According to the researchers, these companies had reached digital maturity—a differentiator that led them to outperform their competition. The key areas where the MIT Center for Digital Business saw executives digitally transforming their processes were customer experience, operational processes, and business models. Additionally, as Forbes and Hitachi’s survey shows, these are also areas where IT leadership can lead the way. To be successful with digital transformation,


Grow rapidly into a continuous delivery pipeline


To continuously deploy to live users, organizations must consider the quality of the code and visibility into each update's effects. Testing should be part of a CI/CD strategy, but test is never an exact replica of production. "You can't replicate that scale, and you can't put customer data into a [traditional] staging environment," said James Freeman, head of professional services at Quru, a consultancy focused on open source technologies. Things test fine and pass to production, then they go live and fall over. "You've got to put good process behind deployments," Freeman said in a presentation at AnsibleFest 2018 in Austin, Texas. Ibotta uses blue/green deployment to handle the multitude of microservices updates per day. Blue and green setups mirror each other and trade off as staging and production environments. The team can quickly revert to a previous version of code without creating a bottleneck. The blue/green changeover currently serves as a gate between development/test and production. 


Picking the right team members to drive digital transformation success

To get the most out of a digital transformation initiative, an organization needs to commit to it for the long haul. It has to follow a plan, execute on specific goals, measure progress, incorporate feedback and keep improving, cycle after cycle, stage after stage. But to arrive at the project’s later stages, the organization has to get started. It needs to get buy-in for the project at all levels, and this needs to be driven by a hand-picked “adoption team.” Assembling the right people for this team can push a project well along the track. Picking the wrong people, or neglecting to create an adoption team at all, can doom the project before it gets out of the gate. What roles do the various members play? How do you find the right people? And how far should this team take the project before others move in to drive key aspects of the project in its later stages? Here are some thoughts to guide your digital transformation planning.


Meaner, more violent Stuxnet variant reportedly hit Iran

cyber attack virus meltdown
There were no additional details about the capabilities of this destructive “new generation of Stuxnet;” unsurprisingly, Israel’s Mossad intelligence agency refused to discuss if it played any role in the attack. Although Foreign Policy previously revealed how “botched CIA communications” ended up costing the lives of Chinese agents, Yahoo News reported that Iranian intelligence officials simply Googled to find the CIA’s communication channel; via Google, Iran reportedly found numerous websites used by the CIA as covert communications channels which led to Iran rounding up 30 people earmarked as CIA spies. 30 more people recruited as CIA agents in China were killed after China allegedly did some Googling to find secret CIA websites which acted as “transitional” communications.Those compromised sites on the web, which had been indexed by Google, may have also “endangered all CIA sources that used some version of this internet-based system worldwide.”


Solving Canada’s startup dilemma

The not-so-good news is that Canada and its startup cities are losing ground to startup hubs such as New York and London; Beijing and Shanghai; Bangalore and Mumbai; Berlin, Amsterdam, Stockholm, and Tel Aviv. More worrying, Canada is failing to take advantage of the United States’ weakening position, which is attributable in part to its tighter immigration policies. While the U.S. continues to generate the largest amount of startup and venture capital activity, its share of the global total has been falling steadily, from more than 95 per cent in the mid-1990s to about two-thirds in 2012, and a little more than half today. But the country that has gained the most ground is China, which now attracts nearly a quarter of global venture capital investment. Exactly why Canada is lagging is unclear. A growing number of Canadian commentators suggest that the influx of large U.S. and Asian tech firms into Canada is sucking up tech talent that would have otherwise gone to local start-ups.


What is a firewall? How they work and all about next-generation firewalls

A firewall is a network device that monitors packets going in and out of networks and blocks or allows them according to rules that have been set up to define what traffic is permissible and what traffic isn’t. There are several types of firewalls that have developed over the years, becoming progressively more complex over time and taking more parameters into consideration when determining whether traffic should or should not be allowed to pass. The most modern are commonly known as next-generation firewalls (NGF) and incorporate many other technologies beyond packet filtering. Initially placed at the boundaries between trusted and untrusted networks, firewalls are now also deployed to protect internal segments of networks, such as data centers, from other segments of organizations’ networks. Firewalls are commonly deployed as appliances built by individual vendors, but they can also be bought as virtual appliances – software that customers install on their own hardware.


The Four Things Startups Need Their Lawyers to Know

“The first thing we do, let’s kill all the lawyers.” This declaration from Shakespeare’s Henry VI is made by Dick the Butcher, a gang member plotting to overthrow the King of England who is afraid the honorable lawyers might gum up the works. I was recently reminded of this line when a startup I invested in was acquired and the company’s founder shared with me that he was aghast at the legal bureaucracy he encountered at his new parent corporation. The lawyers were not adept at delivering speedy, practical solutions, and the founder was forced to spend far too much time micromanaging or working around them. This mismatch is hardly unique. Over the past few years, several well-funded startups have pursued a get-big-fast strategy to maximize early-mover advantages. But when there is a rush to hire throughout the organization, a company can easily end up with lawyers who, by nature or training, are ill-suited to its particular business climate.


Hackers are increasingly destroying logs to hide attacks

"We've seen a lot of destruction of log data, very meticulous clean-up of antivirus logs, security logs, and denying IR teams the access to data they need to investigate," an IR professional said. In fact, according to the Carbon Black report, 72 percent of all its partner IR professionals saw counter-IR operations in the form of destruction of logs, which appears to have become a standard tactic in the arsenal of most hackers. But in some cases, hackers took log destruction and other counter-incident response operations to a new level, and in some cases, their actions resulting in more lasting damage. "Our respondents said victims experienced such attacks 32% of the time," Carbon Black said in its report. "We've seen a lot of destructive actions from Iran and North Korea lately, where they've effectively wiped machines they suspect of being forensically analyzed," an IR professional said.


Build Agility with Design Sprints

Constraints and bottlenecks can be discovered anytime before, during or even after the sprint. Some examples may be cross-departmental involvement, governance structures, approval boards, brand restrictions, finance or legal approval, etc. The list is long, and the sprint process can be adapted to your context, but I’d caution against doing so just to avoid conflict. Some healthy conflict of ideas may be necessary to improve your organisation’s responsiveness. ... This revelation was counter to the traditional belief that you start by changing culture in order to affect behaviour. In addition, Rita Gunther McGrath, author of The End of Competitive Advantage and an authority on strategy, innovation and entrepreneurship, has highlighted that the key for management in the digital era is the ability to experiment and to rapidly learn from those experiments. Considering all human systems are complex adaptive systems, viewing any organisational change efforts through the lens of Dave Snowden’s Cynefin framework would certainly support an experimental, probe-sense-respond approach.



Quote for the day:


"Don't blow off another's candle for it won't make yours shine brighter." -- Jaachynma N.E. Agu


Daily Tech Digest - November 03, 2018

fiber optics
“It fits the scale of existing fiber technology and could be applied to increase the bandwidth or potentially the processing speed of that fiber by over 100 times within the next couple of years,” RMIT Prof. Min Gu said. “This easy scalability and the massive impact it will have on telecommunications is what’s so exciting.” Fiber isn’t going anywhere. Even if wireless becomes more important, such as in 5G networks, fiber is still needed for backhaul. The school doesn’t say what speed it has gotten or will obtain other than using the 100x figure. But, in part, it’s a new miniaturization of the equipment that’s the big deal. Previous experiments by various academic teams dating back to at least 2013 have involved larger equipment for transmission and decoding. RITT says the former gear would not have been practical for current telco environments. RITT, however, says the newly shrunken spiraling, speed-inducing equipment is nanoscale.



Canada's Mandatory Breach Notification Rules Now in Effect

Canada's Mandatory Breach Notification Rules Now in Effect
Hunton says the OPC has clarified that statement in its final guidance. "In general, when an organization (the 'principal') provides personal information to a third-party processor (the 'processor'), the principal may reasonably be found to be in control of the personal information it has transferred to the processor, triggering the reporting and record-keeping obligations of a breach that occurs with the processor," the law firm notes. "On the other hand, if the processor uses or discloses the same personal information for other purposes, it is no longer simply processing the personal information on behalf of the principal; it is instead acting as an organization 'in control' of the information, and would thereby have the obligation to notify, report, and record." Takeaway: Organizations must assess all breaches on a case-by-case basis, as well as ensure they have the right contractual obligations in place to ensure that any third parties that handle its data take appropriate steps to secure it, Hunton says.


Google says 'exponential' growth of AI is changing nature of compute

img0223.jpg
The demand from the Google Brain team that leads research on AI is for "gigantic machines" said Young. For example, neural networks are sometimes measured by the number of "weights" they employ, variables that are applied to the neural network to shape its manipulation of data. Whereas conventional neural nets may have hundreds of thousand of such weights that must be computed, or even millions, Google's scientists are saying "please give us a tera-weight machine," computers capable of computing a trillion weights. That's because "each time you double the size of the [neural] network, we get an improvement in accuracy." Bigger and bigger is the rule in AI. To respond, of course, Google has been developing its own line of machine learning chips, the "Tensor Processing Unit." The TPU, and parts like it, are needed because traditional CPUs and graphics chips (GPUs) can't keep up. "For a very long time, we held back and said Intel and Nvidia are really great at building high-performance systems," said Young. "We crossed that threshold five years ago."


A time-saving typing tool that works anywhere in Chrome

Chrome Text Expander
The tool is called Text Blaze, and while it's technically still in beta, it's been working incredibly well for me both on Chrome OS and within Chrome on Windows. It's super-easy to set up, too: Once you've installed the extension and connected it to your Google account (which is what allows your snippets to sync automatically and always be available on any device where you're signed in), you just open your dashboard — by clicking the Text Blaze icon in your browser's address bar or by visiting this link — and there, you can create and manage all of your text replacement snippets. Creating a new snippet is as simple as clicking the blue "+" button in the upper-left corner of the screen. You can also edit any existing snippet (including a series of sample snippets provided when you first install the program) by clicking its title in the "My Snippets" column on the screen's left side.


How 5G aims to end network delays that slow everything down


There's evidence 5G is getting the promised low latency links. "We are between 1 to 2 milliseconds," Rygaard said of Nokia's tests of latency between phones and cell towers. A millisecond is a thousandth of a second, about the time a baseball is in contact with a bat that's hitting it. There will be other delays in the system, such as software actually doing something with the data that's traversing the network, but the 5G fundamentals appear to be in place. "We're seeing the very low single digit milliseconds," Fuetsch said. That's more than the 1-millisecond latency goal 5G proponents have sought for years, but it also includes communications deeper into the network, not just between a phone and cell tower. And it's a big improvement over today's 4G networks with latencies more than 10 times slower, according to real-world measurements from mobile analytics company OpenSignal. On top of that, future versions of 5G will be able to guarantee that latency.


Thousands Of Swedes Are Inserting Microchips Under Their Skin


So many Swedes are lining up to get the microchips that the country's main chipping company says it can't keep up with the number of requests. More than 4,000 Swedes have adopted the technology, with one company, Biohax International, dominating the market. The chipping firm was started five years ago by Jowan Osterlund, a former professional body piercer. After spending the past two years working full time on the project, he is currently developing training materials so he can hire Swedish doctors and nurses to help take on some of his heavy workload. "Having different cards and tokens verifying your identity to a bunch of different systems just doesn't make sense," he says. "Using a chip means that the hyper-connected surroundings that you live in every day can be streamlined." ... "I see no problem for [it] becoming mainstream. I think it's something that can seriously make people's lives better," Varszegi says.


free wifi secure network public wifi chain links
WPA3 provides improvements to the general Wi-Fi encryption, thanks to Simultaneous Authentication of Equals (SAE) replacing the Pre-Shared Key (PSK) authentication method used in prior WPA versions. This allows for better functionality so WPA3-Personal networks with simple passphrases aren’t so simple for hackers to crack using off-site, brute-force, dictionary-based cracking attempts like it was with WPA/WPA2. Of course, it will still be just as easy for someone to guess a very simple password when they’re attempting to directly connect to the Wi-Fi with a device, but that’s a less practical cracking method. The encryption with WPA3-Personal is more individualized. Users on a WPA3-Personal network can’t ever snoop on another’s WPA3-Personal traffic, even when the user has the Wi-Fi password and is successfully connected. Furthermore, if an outsider determines the password, it is not possible to passively observe an exchange and determine the session keys, providing forward secrecy of network traffic.


HHS Tries Again: New Cyber Coordination Center Launched

HHS Tries Again: New Cyber Coordination Center Launched
H-ISAC President Denise Anderson tells ISMG her organization will continue to closely collaborate with HHS on information sharing. "The H-ISAC has been actively engaged with the HCCIC and now the HC3," she says. "We will continue to work with HHS as well as our other strategic partners in government and industry to support the sector with situational awareness, threat mitigation and incident response." The ability of HHS to respond to cyber incidents is critically important, and in the past year has been limited, says Jim Routh, chief security officer at health insurer Aetna and an H-ISAC board member. "Coordination across the sector in collaboration with DHS is essential and represents an opportunity for continuous improvement. This [HHS] announcement represents a step forward, but the healthcare sector needs more maturity in capability. The H-ISAC has always and will always support the HHS commitment toward cyber incident response." HITRUST, best known for its Common Security Framework, also has been working for several years with the federal government


The first is learning to think like a data scientist. We don’t speak about this often enough, but it is really hard to acquire good data, analyze it properly, follow the clues those analyses offer, explore the implications, and present results in a fair, compelling way. This is the essence of data science. You can’t read about this in a book — you simply have to experience the work to appreciate it. To give your team some hands-on practice, charge them with selecting a topic of their own interest (such as “whether meetings start on time”) and then have them complete the exercise described in this article. The first step will lead to a picture similar to the one below, and the rest of the exercise involves exploring the implications of that picture. ... The third skill is conducting a root cause analysis (RCA) and its pre-requisite, understanding the distinction between correlation and causation. Studying the numbers can point to where most errors occur or demonstrate that two (or more) variables go up and down in tandem, but it cannot fully describe why this is. 


How to set yourself apart in the future of work

There’s no way we can think as quickly, or efficiently, as a computer if the primal part of our brain–the amygdala–directs us toward protectionism. Fear has been shown to impair function in the hippocampus, a vital part of the brain that helps regulate mood and memory. It is also key to creative function. Any negative impact on this part of the brain is bad news for your career and can cause you to limit the very qualities that will be key to career resilience in the future. The experience of using voice recognition software can feel more sci-fi than AI, but it’s helpful to remember that AI is still pretty narrow. A robot that can perform surgery can’t make you a coffee. Even the most sophisticated AI cannot answer the question “is this a cat?” whereas a human toddler would know in an instant. If you’re still feeling skeptical, google the dog versus muffin test. You’d have no problem spotting the difference.



Quote for the day:


"If you think you're leading and no one is following you, then you're only taking a walk." -- Afghan Proverb


Daily Tech Digest - November 02, 2018


By taking Horizon open source, Facebook is hoping to see reinforcement learning applied in new ways. The method is typically used in robotics and games. Google used reinforcement learning to teach its DeepMind AI how to navigate a virtual parkour course and researchers at UC Berkeley used the method to teach computers to be curious. Facebook believes it could also help improve large-scale systems and applications. Specifically, the company believes the reinforcement learning platform can prove helpful in dealing with massive data sets. Machine learning systems typically require engineers to create hand-crafted policies to take specific actions -- they need to know what outcome they are trying to achieve before making decisions. Reinforcement learning, on the other hand, can make decisions and adapt its actions based on feedback. Because Horizon was built on open frameworks including PyTorch 1.0, Caffe2 and Spark, it should be available to just about anyone who wants to get their hands on it.



Robotic delivery service hits the streets of Milton Keynes


Starship’s service specifically aims to address some of the most frequent complaints that bedevil conventional parcel delivery firms such as Yodel. These include delayed deliveries, inability to schedule deliveries at a convenient time for the customer and, in some extreme cases, underpaid drivers under pressure to meet unrealistic targets faking missed deliveries. According to data from the IMRG MetaPack Delivery Index, the number of late deliveries across all service types has doubled since 2016, while Citizens Advice claims that people spend an average of two-and-a-half hours sorting out problems each time there is an issue with their delivery. Starship ducks these problems by allowing customers to use the address of its local facility as their delivery address on sites such as Amazon or Asos. Once their parcel has arrived there, they can schedule delivery to their home address – or any alternative address they like, such as their workplace – through an Android or iOS app according to their plans for the day.


How Blockchain Can Revolutionize the Data Systems Powering the Healthcare Industry

How Blockchain Can Revolutionize the Data Systems Powering the Healthcare Industry
Although the underlying technology behind the blockchain paves the way for future disruptions, caution must be exercised on how soon we can expect to see the ubiquitous use of the technology. There would be technical challenges encountered in the process of moving petabytes of records to the blockchain periodically. In terms of storage and transfer speeds, legacy systems are way ahead today, due in part to how nascent the technology still is. A major point of contention arising out of EMR on the blockchain is the ownership of this data. Ideally, a patient’s medical records should be owned by the patient alone, with a consent-based system of sharing. However, governments would have to put policies in place to regulate the transfer and ownership of this information, and define the relationship between the EMR and the various stakeholders involved, such as the patient, doctor, clinic, pharmacy and insurance company. Health Insurance Portability and Accountability Act (HIPAA) regulates the laws pertaining to medical data privacy in the US


Crypto-Locking Kraken Ransomware Looms Larger

The primary target for Kraken is computers running Windows 8, 8.1 and 10. It can also touch shared storage devices on the same network as an infected system. Once it crypto-locks a system, recovering files without paying a ransom is impossible unless victims can wipe systems and restore them from backups. Forum posts written by ThisWasKraken provide more insight into how the affiliate business model works, involving the group that develops Kraken as well as partners who pay to use it. Here's the business model: Partners sign up for $50, and agree to send 20 percent of all ransoms paid to the Kraken team. In return, the partner receives fresh versions of the Kraken malware payload, which are designed to not trigger anti-virus software, every 15 days, according to the report. Partners also receive 24/7 customer support. The interactions between a victim and a Kraken affiliate partner occur over email.


USB Drives Deliver Dangerous Malware to Industrial Facilities: Honeywell

Malware Delivered via USB to Industrial Facilities Can Cause Major Disruption
Honeywell has analyzed data collected from 50 locations across the United States, South America, Europe and the Middle East. The enterprises whose systems were part of the study represented the energy, oil and gas, chemical manufacturing, pulp and paper, and other sectors. Honeywell said its product had blocked at least one suspicious file in 44% of the analyzed locations. Of the neutralized threats, 26% could have caused major disruptions to industrial control systems (ICS), including loss of control or loss of view. Furthermore, Honeywell says 16% of the detected malware samples were specifically designed to target ICS or IoT systems, and 15% of the samples belonged to high profile families such as Mirai (6%), Stuxnet (2%), Triton (2%), and WannaCry (1%). “These findings are worrisome for several reasons. That high-potency threats were at all prevalent on USB drives bound for industrial control facility use is the first concern.



With the continuing evolution of AI, the opportunity to begin applying it to real world problems is here. Since there are multiple entry points for applying AI, the key is to determine an approach that creates both short term results and builds a long-term asset. Part of achieving that goal is determining where and how to leverage AI, and like all other investment decisions where to apply your scarce resources and where to leverage other tools or services to drive business outcomes. It’s also critical to think about where you have unique data assets and how to bring those into play as part of your overall AI journey and strategy. As you consider your next AI project start with the business outcome you are trying to drive, the depth of AI experience and the level of AI customization needed will help you determine where best to start. As I often say, “it is too early to do everything with AI but too late to do nothing” so get started and we look forward to seeing what you develop.



Microsoft chief urges industry to focus on ethics and privacy


“Privacy is a human right,” he said. “All of us will have to treat privacy as a human right. GDPR [General Data Protection Regulation] is a great start, it sets the standard for how people need to see privacy globally.” Nadella called on the industry to share malware data to ensure the most vulnerable members of society and small to medium-sized enterprises [SMEs] can remain safe in cyber space.  “The challenges of cyber security affects common citizens and SMEs, it requires nation starts and industry to be part of that,” he said. “All tech vendors can use the data to protect customers.” Nadella also urged delegates to adopt new technology quicker, which he described as “tech intensity”. “Computing is getting deeply embedded in the world, every part of our life is being digitised,” he said. “There isn’t an industry that is not being fundamentally changed by digital technology.


Can AI Bank On Blockchain To Power Science & Medicine's Future Progress?


AI is capable of quickly sifting through hundreds of datasets and is many orders of magnitude more efficient than a human brain at doing so. However, it is also more resource-intensive. But researchers cannot afford to be liberal with their use of computers due to the nearly prohibitive costs of maintaining a centralized source of processing power for the amount of time it takes to map a human genome. Even at roughly one hour. And, for some perspective, just two years ago it took 26 hours - with the cost of outsourcing this power bill being substantial. The power demand of AI is also too large to be feasible for our current, regardless of its potential applications. And, in a broader sense, this inefficiency puts a ceiling on innovation. It is also worth bearing in mind that by 2025 the global data sphere has been projected to grow to 163 zettabytes. And, the current computational paradigm is not scalable or intelligent enough to handle this massive influx of information.


Employee engagement: 10 best practices for improving your culture

Employee engagement: 10 best practices for engaging your workforce
Effective leaders know that employee engagement can be a competitive edge, as engagement drives better customer outcomes, better employee retention and increased productivity. "With today's increased competition for top-notch talent, and the huge costs to retrain new staff, engagement becomes more important than ever,” says Gabe Zichermann, author, public speaker and serial entrepreneur with expertise in employee engagement. “When engagement is low things can get off track really quick and it can spread like wildfire,” Zicherman adds. “Best practices are usually the process that falls apart when engagement is low, though best practices are what produce ideal outcomes." ... It’s important to recognize employee engagement as a strategic priority and act accordingly, says Vennard Wright, CIO at Washington Suburban Sanitary Commission (WSSC) Water. When Wright took over as CIO of the utility in early 2017, no such strategy existed; morale and engagement were low, people were afraid to take risks and there weren’t clear expectations in place. Wright set out to change that.


Ways to Help Smart Cities Initiatives Overcome Public Sector Obstacles

Many of the latest technologies -- such as Internet of Things (IoT) platforms, big data analytics, and cloud computing -- are making data-driven and efficiency-focused digital transformation more powerful. But exploiting these advances to improve municipal services for cities and urban government agencies face unique obstacles. Challenges range from a lack of common data sharing frameworks, to immature governance over multi-agency projects, to the need to find investment funding amid tight public sector budgets. The good news is that architectural framework methods, extended enterprise knowledge sharing, and common specifying and purchasing approaches have solved many similar issues in other domains. ... The most fundamental difference is in the motivation. If you are in a commercial enterprise, your bottom line motivation is money, to make a profit and a return on investment for the shareholders.



Quote for the day:


"Leadership is the art of giving people a platform for spreading ideas that work" -- Seth Godin


Daily Tech Digest - October 31, 2018


When designing an AI product, always keep in mind that the machine learning will have the worst consequences. Therefore, the “go back” solution under the worst results is usually as important as, and often more important than the design under the best results. Once the user has a disappointing, frustrated mood, they will easy to give up this feature or even the entire product, and it is difficult to deal with. Therefore, a more important principle is that if you have insufficient confidence in machine intelligence, please choose a “go back” solution for the user when designing the product. How to clearly communicate to the user the benefits of artificial intelligence and how to provide elegant solutions for errors that may arise at any time is a challenge for designers. ... All of the “intelligent” products on the market have a long way to go before true intelligence. At this stage, the most important thing for artificial intelligence products is to build user trust, perhaps starting with small tasks such as accurately forecasting the weather, playing the correct music, and setting the alarm clock the user wants.



Passion For Banking Innovation Fueled By Fintech, Big Tech Disruptors


To be competitive in the changing financial marketplace, banks and credit unions must provide mobile and online banking solutions that exceed peoples’ expectations. While consumers are increasingly satisfied with basic digital services provided by most traditional institutions, there are higher expectations around how institutions must help people reach their financial goals. Meeting higher digital banking expectations could provide a way for banks and credit unions to monetize financial solutions, much as Amazon provides a higher, monetized option with Amazon Prime. The key will be to actually provide an enhanced level of value that digital consumers crave. Unfortunately, while financial institutions hold a massive amount of consumer data, very few draw insights from that raw material — certainly not in a way that significantly improves the customer experience. Without a differentiated experience, the door is open for those organizations that can combine advanced technologies with real-time insights and contextual messaging and engagement.


Welcome to the City 4.0

Applied to cities, digitalization can not only improve efficiency by minimizing the waste of time and resources, but it will simultaneously improve a city’s productivity, secure growth, and drive economic activities. The Finnish capital of Helsinki is currently in the process of proving this. An early adopter of smart city technology and modeling, it launched the Helsinki 3D+ project to create a three-dimensional representation of the city using reality capture technology provided by the software company Bentley Systems for geocoordination, evaluation of options, modeling, and visualization. ... The three-dimensional mesh created by Bentley’s reality modeling software is linked to the IoT-enabled infrastructure components via Siemens’ cloud-based IoT operating system called MindSphere. Thus the city’s underlying infrastructure layer, such as energy, water, transportation, security, buildings, and healthcare, provides data that is fed into a common data layer in order to enable analytics and preventive as well as prescriptive measures. MindSphere is capable of managing huge quantities of data.


The Bitcoin White Paper's Birth Date Should Give Us All a Scare


The bitcoin paper was initially greeted with skepticism by the handful of people who actually read it, and even after Bitcoin was operationalized on January 3, 2009, it was largely ignored for the first year of its existence. Bitcoin hardly got off to an auspicious start. However, Bitcoin steadily attracted more use and interest, and a growing group of people began to see that the innovation created by Satoshi's solution to the long bedeviling 'double-spending problem' in computer science could also serve as a cornerstone for creating a new and better financial system. As I suggested in 2014, regulatory reform would fail to fundamentally address the root causes of the financial crisis and other problems embedded in traditional finance. Regulations enacted in the wake of a crisis are too often easily rolled-back once the waters have calmed, and it can be difficult to sustain over time the momentum of social movements focused around obtuse subjects like financial system reform.


Crash Course: SAML 101 and Identity Federation (With Ping Identity)

Crash Course: SAML 101 and Identity Federation (With Ping Identity)
Single sign-on allows users to input their credentials once and have it apply to all relevant applications. More specifically, federated identity uses single sign-on to establish employee and user identity, and then—as the user attempt to access applications—the solution transparently and securely shares their credentials with the application. This allows users and employees to skip the usual log-in step and enjoy a seamless digital workplace experience. SAML is part of this standards-based identity federation. SAML alleviates log-in issues by enabling single sign-on and the secure exchange of authentication and authorization information between security domains. At its most basic, when a user attempts to access a service provider with an identity federation solution, the federation software creates a SAML authentication request and delivers it to the appropriate identity provider. The identity provider authenticates the user and creates its own SAML assertion representing the user identity and attributes.


Why businesses must take a strategic view of automation


To drive automation initiatives, Capgemini said business leaders need a bold vision and a clear roadmap to build momentum and bring the organisation behind them. The report stated: “Automation is a technology solution to business transformation, and hence both business and technology leadership should be engaged actively from day one. Automation needs to be tackled as an end-to-end strategic transformation programme as opposed to a series of tactical deployments. “Also, to maximise the benefits and ROI [return on investment] of automation investments, it is essential that processes and business models are standardised and optimised before they are enabled by automation, robotics, and artificial intelligence.” Capgemini also urged businesses to consider establishing a centre of excellence for automation to help drive change across the business.


Emotet malware gang is mass-harvesting millions of emails in mysterious campaign

Ever since last summer, Emotet has been growing, and growing, and growing --both in capabilities and in the number of victims it has infected. The malware has become so ubiquitous nowadays that the US Department of Homeland Security has issued a security advisory over the summer, warning companies about the threat that Emotet poses to their networks. The danger comes from the fact that Emotet has a multitude of smaller modules that it downloads once it gains an initial foothold. Some of these modules, such as its SMB-based spreader that moves laterally throughout networks, can wreak havoc inside large organizations. Furthermore, Emotet also never comes alone, often dropping even more potent threats, such as the TrickBot infostealer, remote access trojans, or, in the worst case scenarios, even ransomware. Notorious is the case of the city of Allentown, where an Emotet infection has spread in every corner of the city's network and downloaded even more malware, and, in the end, the municipality decided to pay nearly $1 million to rebuild its infrastructure from scratch.


Right-to-repair smartphone ruling loosens restrictions on industrial, farm IoT

farmer tractor
The new ruling may not give farmers ownership of their farming data, but at least they now have the right to ignore the DRMs and fix their own machines — or to hire independent repair services to do the job — instead of paying “dealer prices” to the vendors’ own repair crews. Per Motherboard, the new ruling “allows breaking digital rights management (DRM) and embedded software locks for ‘the maintenance of a device or system … in order to make it work in accordance with its original specifications’ or for ‘the repair of a device or system … to a state of working in accordance with its original specifications.’” From my perspective, this is indeed a win, but far from a complete victory. Farmers still aren’t allowed to hack into their own tractors to turn them into drag racers (that might be fun to watch!), but at least they can do whatever they need to do in order to make sure the machines aren’t falling down on the job.


Medical Device Security Best Practices From Mayo Clinic

"Because of the way that some of these devices are built so well, from a physical standpoint, you can use some of these machines for 10 or 20 years," he says in an interview with Information Security Media Group. "We're going to have to figure out how we can manage the software over that lifespan as well and make sure that that stays secure." If that cannot be done, he says, "we're going to have to figure out some way to be able to just box things off into a separate area where we've got them isolated, we've increased the monitoring of them and are able to use a lot of other compensating controls." Everyone is looking for a silver bullet - an easy solution to device security, he acknowledges. "We have companies all the time calling us trying to sell us a whole box of silver bullets. But it's going to take a combination of user education - so that people who use these devices on patients have a better cybersecurity awareness - and healthcare delivery organizations implementing compensating controls and having good security practices, as well as the vendors having security by design."


Cybersecurity culture: Arrow in CIOs' quiver to fight cyberthreats

The companies that we've seen successfully change their culture have someone who owns [cybersecurity] culture," Pearlson said after a talk at the SIM Boston Technology Leadership Summit held at Gillette Stadium in Foxborough, Mass., on Tuesday. "Their job is to make sure that the word and the behaviors and the values and the attitudes and the beliefs are adjusted and informed." An important piece of advice: The executive tasked with fostering a cybersecurity culture should be separate from the chief information security officer, because the CISO has a much bigger portfolio, Pearlson said. Pearlson, along with MIT Sloan colleagues Matt Maloney and Keman Huang, gave CIOs at the SIM event a glimpse into their recent research on cybersecurity, which includes learning as much as they can about how attackers interact on the dark web and how to defend against strikes that target weaknesses in people and software.



Quote for the day:


"Challenges in life always seek leaders and leaders seek challenges." -- Wayde Goodall


Daily Tech Digest - October 30, 2018

How to craft effective data science job descriptions
“Recruiters often write things like, ‘Must have a technical degree, three years of experience, and deep knowledge of Apache Hadoop.’ This is a mistake, even if you really want someone with these attributes,” Bartram says. “For a high-skill role like data science, the goal is to convince applicants who might be on the fence that your company and your role are interesting and worth their time.” This is especially important not just because the market is so hot, but because, Nicholson says, “A lot of the necessary skills are industry- and company-specific. Organizations use different languages, prefer certain vendors’ tech stacks and specific proprietary tools, so that is up to the hiring teams to know which ones.” Instead focus on the mission of your company, what the role will accomplish, and any technical details of the exciting problems candidates will get to solve, Bartram says. “For data science in particular, it can work great to write about the interesting data sets that the candidate will have access to — data science candidates love to geek out over cool data sets,” he says.



Wexflow: Open source workflow engine in C#


Wexflow is a high performance and extensible workflow engine with a cross-platform manager and designer. The goal of Wexflow is to automate recurring tasks without user intervention. With the help of Wexflow, building automation and workflow processes become easy. Wexflow also helps in making the long-running processes straightforward. Wexflow aims to make automations, workflow processes, long-running processes and interactions between systems, applications and folks easy, straightforward and clean. The communication between systems or applications becomes easy through this powerful workflow engine. Wexflow makes use of Quartz.NET open source job scheduling system that is used in large scale entreprise systems. Thus, Wexflow offers felixibility in planning workflow jobs such as cron workflows. ... Wexflow provides a GUI for managing workflows that can be installed on a Linux system. To run Wexflow on Linux, Wexflow server must be installed on a Windows machine. Wexflow provides a self hosted web service that allows to query Wexflow Engine.


Understanding mass data fragmentation

cloud data warehouse
For most companies, data isn’t the fuel that powers digital transformation — it’s the biggest obstacle because of something I’m calling mass data fragmentation (MDF), which is a technical way of saying that data is currently scattered all over the place and unstructured, leading to an incomplete view of data. Data is fragmented across silos, within silos and across locations. Adding to the problem is that most companies have multiple copies of the same data. Some data managers have told me that about two-thirds of their secondary storage is comprised of copies, but no one knows which copies can be kept or deleted, forcing them to keep everything. If bad data leads to bad insights, then fragmented data will lead to fragmented insights, which can lead to bad business decisions. Digital natives such as Amazon and Google are data-centric and architected their infrastructure to avoid the MDF issue. This is why those businesses are agile, nimble and always seem to be at the forefront of market transitions. They have access to a larger set of quality data and are able to gain insights that other companies can’t.


Three keys to a cybersecurity culture that will stick

When it comes to cybersecurity, though, businesses are faced with a classic conundrum: How much money and resources should be spent on something that hasn’t – and may never have – happened? It’s easy to blame your employees for being susceptible to spear phishing attempts, but if they weren’t given proper training to spot them, then the fault lies elsewhere. And that’s just the tip of the iceberg. According to a recent ISACA/CMMI survey on cybersecurity culture, more than 70 percent of companies have specific policies in place for password management, automated device updates and device security, as well as employee training and proper communication workflows in place. However, only 40 percent of respondents say that their organizations’ efforts to create a culture of cybersecurity with substantial employee buy-in have been more than moderately successful. ... The most common support request at that time was for us to allow people to use their old passwords again – because people didn’t want to have to come up with a new one for each site they log into.


Cyber security – why you’re doing it all wrong


Let’s start with strategy – the overarching mission. How many organisations have such a thing? A few. How many are built through business engagement? Even fewer. Security strategy is generally written from a position of prejudice and as a means of gaining budget to mature the organisation’s posture. For a strategy to be sound, it should be preceded by a warts-and-all look at the effectiveness and maturity of the as-is position and a clear line of sight of where it needs to get to. This requires a deep understanding of the business within which security operates, alongside measuring the effects of the myriad security jigsaw pieces across the organisation. This almost never happens. If it did, security teams would recognise that investment needs to be made primarily and almost solely on fixing the crap that is already there. How can this be? Well, let’s go through some of the jigsaw pieces that just about every organisation will have in its security picture.


Software and beer: What open source and craft brewing have in common

ballast-point.png
Just as IBM and Microsoft want to cash in on the mainstreaming of open source, global giants of the beer industry want to tap into the hottest growth segment of their market. Not surprisingly, there has been significant consolidation over the past few years. But if you look at a bottle or can or go on the website of Ballast Point, you won't see any mention of the company being part of the Constellation Brands empire. Nor will you see that Goose Island is one of 100+ bands owned by ABInBev. The craft brewing industry has its fair share of angst about whether brewers that are no longer independent realty fit the category. There's a lot of concern that the power of global giants will push distributors away from independent brands. In the same way, were GitHub or Red Hat to be viewed as captive subsidiaries of Microsoft and IBM, much of their value proposition would evaporate. It could lead to forking, such as what happened with MySQLafter Oracle acquired its parent, Sun Microsystems. Admittedly, the IBM/Red Hat Deal has another value proposition for IBM that drove it to pay roughly a third of its market cap that went beyond the pure open source angle: the inclusion of OpenShift, that could make IBM, a distant challenger in the public cloud



While phishing campaigns traditionally are synonymous with email, social media is also a popular medium for using fraudulent information and lures to convince victims to click on a link to input credentials or download malware-embedded files. These attacks can be very targeted, such as Iranian-linked Cobalt Gypsy, which has created fake personas to connect with individuals in the Middle East and United States. Once the connections are made, over time, individuals are convinced to download malicious files onto corporate computers. These kinds of social media-enabled attacks have doubled in the last year, and are proving an effective way to steal financial information and credentials, or to deploy malware. Given the limited resources required and the potential for high returns, nation-state tactics are diffusing out to criminal groups as well. Today’s criminal phishing campaigns are much more sophisticated than the scams of yesteryear


Outsourcing, like most business technology processes, benefits from human input to provide insight and context, which will help SMEs to see real value in a managed service contract. This requires the right forums to be in place, such as a monthly service report reinforced by regular meetings. These might look at issues such as whether SLAs have been set correctly. On paper, the outsource provider may not be meeting some of them, but open, face-to-face discussions bring an understanding of why this is the case. A four-hour SLA to set up a new user may not be achievable for complicated roles that require complex access rights, for example. Appropriate communications resolve this, rather than leave a series of SLA red flags. SMEs are often faced with situations where everything is a priority, such as client relationships, IT, human resources (HR) and marketing. Therefore, it can make more sense to consider a more advisory or consultative IT security service to help senior management to understand what is important for their organisation, and to gain an external perspective on what good looks like.


Careful planning is key to mitigate the risks of moving to the cloud

There is no "one size fits all" set of methods to manage risks in the cloud. The risks are unique to each environment and use case. When your organization has a specific use case, your team can build controls around it. Develop your own cloud control framework based on those identified security risks. Consider current applicable regulations as you do—including SOX, PCI, PII and GDPR. For guidance, look at previous risk models and at best practices on cloud risks. Be alert to control overlap when developing your framework to avoid multiple controls addressing the same risk. Leverage your cloud service provider and internal risk/security experts to mitigate these risks as part of your overall migration plan. Finally, never underestimate the value of identifying your risks, or the time it will take to do it right. Cloud service providers, such as Amazon Web Services, take a "building blocks" approach by providing tools that can help you gain compliance in the cloud, but they do not manage compliance directly. Furthermore, the same cloud service providers make it exceedingly simple for individual teams to begin their migrations independent from the organization.


21% of all files in the cloud contain sensitive data

cloud contain sensitive data
Cloud services bring a momentous opportunity to accelerate business through their ability to quickly scale, allowing businesses to be agile with their resources and provide new opportunities for collaboration. Cloud services like Box and productivity suites like Office 365 are used to increase the fluidity and effectiveness of collaboration. However, collaboration means sharing, and uncontrolled sharing can expose sensitive data. ... To secure sensitive data in cloud storage, file-sharing and collaboration applications, organizations must first understand which cloud services are in use, hold their sensitive data, and how that data is being shared and with whom. Once organizations have gained this visibility, they can then enforce appropriate security policies to prohibit highly sensitive data from being stored in unapproved cloud services and provide guardrails that prevent noncompliant sharing of sensitive data from approved cloud services, such as when data is shared with personal email addresses or through an open, public link.



Quote for the day:


"Your first and foremost job as a leader is to take charge of your own energy and then help to orchestrate the energy of those around you." -- Peter F. Drucker