Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - February 03, 2019

Serverless computing’s dark side: less portability for your apps

Serverless computingâ€™s dark side: less portability for your apps

How that serverless development platforms calls into your serverless code can vary, and there is not uniformity between public clouds. Most developers who develop applications on serverless cloud-based systems couple their code tightly to a public cloud provider’s native APIs. That can make it hard, or unviable, to move the code to another platforms. The long and short of this that if you build an application on a cloud-native serverless system, it’s both difficult to move to another cloud provider, or back to on-premises. I don’t mean\ to pick on serverless systems; they are very handy. However, more and more I’m seeing enterprises that demand portability when picking cloud providers and application development and deployment platforms often opt for what’s fastest, cheapest, and easiest. Portability be dammed. Of course, containers are also growing by leaps and bounds, and one of the advantages of containers is portability. However, they take extra work, and they need to be built with a container architecture in mind to be effective.

Grady Booch on the Future of AI

To put things in perspective, there have been many springs and winters in the development of artificial intelligence. The first winter was in the 1950s during the height of the Cold War. There was a great deal of interest in machine translation in order to translate Russian into some other language. According to an often quoted story, they put in statements such as "The spirit is willing, but the flesh is weak". Translated into Russian and back, the result was "The vodka is strong, but the meat is rotten." Language learning was a lot harder than people first thought. The next spring arose with the ideas of Newell and logic theorist Terry Winograd that used the idea of manipulating small world blocks, which led to some progress. Of course that was the time when Marvin Minsky stated that there will be human level intelligence in three years. No one makes those kinds of claims any more. Computational power and expressiveness were the limits to this approach.

Blockchain and biometrics: The patient ID of the future?

This isn't the first time blockchain has paired with biometrics for identification purposes. Starting back in 2017, Microsoft and Accenture joined to create a blockchain solution that used biometric data to act as digital identification for refugees. Pharmaceuticals have also considered utilizing blockchain to improve track-and-trace serialization. IrisGuard's technology has previously been used by the United Nation Agencies to prevent human trafficking, providing refugees with iris-based registration and e-payment solutions through the High Commissioner for Refugees (UNHCR) and the World Food Programme (WFP), the release said. "Patient identification is a growing problem in today's healthcare system," Chrissa McFarlane, CEO and founder of Patientory, Inc., said in the release. "This technology can help providers identify an individual with unparalleled accuracy, through iris-recognition and data matching. And because it's verified on the blockchain, it's scalable without sacrificing data security—which is one of the main problems with our current healthcare-data infrastructure."

State Machine Design in C

A common design technique in the repertoire of most programmers is the venerable finite state machine (FSM). Designers use this programming construct to break complex problems into manageable states and state transitions. There are innumerable ways to implement a state machine. A switch statement provides one of the easiest to implement and most common version of a state machine. Any transition is allowed at any time, which is not particularly desirable. For most designs, only a few transition patterns are valid. Ideally, the software design should enforce these predefined state sequences and prevent the unwanted transitions. Another problem arises when trying to send data to a specific state. Since the entire state machine is located within a single function, sending additional data to any given state proves difficult. And lastly these designs are rarely suitable for use in a multithreaded system. The designer must ensure the state machine is called from a single thread of control.

Privacy: Several States Consider New Laws

"Each of the 50 states now has its own breach notification laws, with nearly one-half adopting data security and/or data disposal requirements to protect consumers' personally identifiable information from unauthorized disclosure," says privacy attorney David Holtzman, vice president of compliance at security consultancy CynergisTek. "While most states are not taking a sectorial approach to the type of PII that must be protected, New York, Ohio and South Carolina have adopted cybersecurity requirements that target industries that include health plans and insurers," he adds. "A theme seen in state legislation to update breach notification laws in recent years is to set shorter notification periods. Some argue that this would give consumers more time to take action to protect themselves against the threat of financial fraud or identity theft by notifying major credit reporting agencies." Privacy attorney Kirk Nahra of the law firm Wiley Rein notes: "The states continue to examine the possibilities for increasing privacy and data security protections, both in currently regulated areas and in situations where federal law is not directly applicable through a specific law or regulation."

The 3 Secret Types of Technical Debt

Unfortunately, the cost of repaying debt is much higher by that point, just because of the compound interest you have to pay back that was consolidated into the debt. In other words, 2 hours invested in repaying technical debt 6 months ago, could be equivalent to 1 day of work today to repay the same amount of debt. The problem with this type of approach is it feels you are going fast to start with because you are delivering features and the technical debt is not hurting you as much at the very beginning. The problem is you are putting yourself on the compound interest curve, instead of staying linear. Linear and compound curves look similar at the start, very different later on. In most cases, you want to avoid ending up in this category. An example of where this type of debt is acceptable is when you need to hit a regulatory deadline, where the cost of not hitting the deadline outweighs the cost of repaying the compound debt accumulated later on.

Decision Trees — An Intuitive Introduction

Regression works similar to classification in decision trees, we choose the values to partition our data set but instead of assigning class to a particular region or a partitioned area, we return the average of all the data points in that region. The average value minimizes the prediction error in a decision tree. An example would make it clearer. Predicting rainfall for a particular season is a regression problem since rainfall is a continuous quantity. Given rainfall stats like in the figure below how can a decision tree predict rainfall value for a specific season? ... But being a supervised learning algorithm how does it learn to do so; in other words how do we build a decision tree? Who tells the tree to pick a particular attribute first and then another attribute and then yet another? How does the decision tree know when to stop branching further? Just like how we train a neural network before using it for making predictions we have to train (build) a decision tree before prediction.

Before AI is a human right, shouldn't we make it work first?

Benioff warned that AI-powered countries and companies will be will be "smarter," "healthier," and "richer," while those less generously endowed with AI will be "weaker and poorer, less educated and sicker." I guess he hasn't seen the AI that currently powers the Western world—you know, like IBM's Watson, which one of its engineers characterized as "like having great shoes but not knowing how to walk." Not that IBM is alone—take a walk through the transcripts of public companies' reporting earnings, and you'll see artificial intelligence mentions on a precipitous rise. Look around the real world, however, and finding true artificial intelligence is an exercise in futility. Even the companies packed with PhDs like Google seem to only be able to muster advertising that feels like weak pattern matching. It's one thing to insist that companies like, say, Google, give free access to its algorithms, but quite another to figure out how to do that in practice.

Overcoming RESTlessness

Broad as it was, the idea of using the Web for network-based sharing of data and services beyond the browser was a popular one. Software developers quickly seized on Fielding's work and put it into practice.3 The rise of REST was itself fuelled by a false dichotomy, with SOAP playing the role of bogeyman. Whereas SOAP attempted to provide a method of tunneling through the protocols of the web, the REST approach embraced them. This notion of REST being "of the web, not just on the web" made it a more intuitive choice for software engineers already building web-based solutions. As the SOAP and WS-* ecosystem became more complicated, the relative simplicity and usability of REST won out. Over time, JSON replaced XML as the de facto data format for web APIs for similar reasons. As the usage of the web computing paradigm expanded to new scenarios -- enterprise application integration, cloud provisioning, data warehouse querying, IoT -- so did the adoption of REST APIs.

Scrum Guide Decomposition, Part 2

In the enterprise, it would be difficult (but not impossible) to have a team with all competencies to do all the work simply because teams are siloed into specific competencies. For example, DBA’s, Middleware, specific back-end systems like SAP, and so forth. The enterprise's unwillingness to break apart these silos may hinder them from fully getting the benefits of Scrum. By having team members that are cross-functional, but not necessarily proficient in all competencies, you can avoid delays when someone, for example, is sick or on leave. Someone can continue the work. The team can also share the workload. No single person is carrying the team because they are the only person who knows that competency. The term “Jack of all trades – master of none” comes to mind. Good luck finding people who know everything. It is the team as a whole who becomes the masters. Not individuals. The Scrum Team has proven itself to be increasingly effective for all the earlier stated users, and any complex work.

Quote for the day:

"Dont be afraid to stand for what you believe in, even if that means standing alone." -- Unknown

Daily Tech Digest - February 01, 2019

What is application security? A process and tools for securing software

The faster and sooner in the software development process you can find and fix security issues, the safer your enterprise will be. And, because everyone makes mistakes, the challenge is to find those mistakes in a timely fashion. For example, a common coding error could allow unverified inputs. This mistake can turn into SQL injection attacks and then data leaks if a hacker finds them. Application security tools that integrate into your application development environment can make this process and workflow simpler and more effective. These tools are also useful if you are doing compliance audits, since they can save time and the expense by catching problems before the auditors seen them. The rapid growth in the application security segment has been helped by the changing nature of how enterprise apps are being constructed in the last several years. Gone are the days where an IT shop would take months to refine requirements, build and test prototypes, and deliver a finished product to an end-user department. The idea almost seems quaint nowadays.

India’s largest bank SBI leaked account data on millions of customers

The server, hosted in a regional Mumbai-based data center, stored two months of data from SBI Quick, a text message and call-based system used to request basic information about their bank accounts by customers of the government-owned State Bank of India (SBI), the largest bank in the country and a highly ranked company in the Fortune 500. But the bank had not protected the server with a password, allowing anyone who knew where to look to access the data on millions of customers’ information. It’s not known for how long the server was open, but long enough for it to be discovered by a security researcher, who told TechCrunch of the leak, but did not want to be named for the story. SBI Quick allows SBI’s banking customers to text the bank, or make a missed call, to retrieve information back by text message about their finances and accounts. It’s ideal for millions of the banking giant’s customers who don’t use smartphones or have limited data service.

DCMS funding fuels cyber diversity drive

The Crucial Academy Diversity in Cyber Security project is a Brighton-based initiative aiming to retrain veterans in cyber security, and is focused on female, neurodiverse and BAME candidates. Neil Williams, CEO of Crucial Group, said the funding will help support its initiative, and that, as a veteran, he understands the importance of projects such as Crucial. The QA: Cyber Software Academy for Women runs across several cities in the UK, including London, Bristol and Manchester, training women for cyber security roles. The Blue Screen IT: Hacked project will use the funding to scale a project that already exists, giving people, including those from poorer socio-economic backgrounds, neurodiverse and special needs talent, the skills needed for a cyber career. As well as train people in cyber, the project will also aim to create a “network of community Security Operations hubs”, according to Michael Dieroff, CEO of Bluescreen IT.

Don't Measure Unit Test Code Coverage

Some people use code coverage metrics as a way of enforcing the habits they want. Unfortunately, habits can't be enforced, only nurtured. I'm reminded of a place I worked where managers wanted good code commit logs. They configured their tool to enforce a comment on every commit. They most common comment? "a." They changed the tool to enforce multiple-word comments on every commit. Now the most common comment was "a a a." Enforcement doesn't change minds. Instead, use coaching and discipline-enhancing practices such as pairing or mobbing. To build up tests in legacy code, don't worry about overall progress. The issue with legacy code is that, without tests, it's hard to change safely. So the overall coverage isn't what matters; what matters is whether you're safe to change the code you're working on now. So instead, nurture a habit of adding tests as part of working on any code. Whenever a bug is fixed, add a test first. Whenever a class is updated, retrofit tests to it first. Very quickly, the 20% of the code your team works on most often will have tests. The other 80% can wait.

Meet The Chatbots That Will Make You Feel Better, One Text At A Time

The AI is trained to hold actual conversations rather than being a response generating program, like the early ELIZA. X2AI’s Tess is being used to support health care professionals like psychologists in clinics and hospitals across the US and Europe by giving patients access to 24/7 therapy support. They’ve also most notably collaborated with organisations and aid agencies in Lebanon to help Syrian refugees cope with their unimaginable situation. The Karim chatbot provides a mental healthcare service in an area where it is not available and now has one of the largest structured Arabic conversation data sets in the world. Similarly, Woebot Labs recently launched the first scientifically backed mental health therapy chatbot. You can chat with Woebot via Facebook Messenger for a two-week free trial, before then signing up to a $39 a month service. Stanford University researchers published a study showcasing how Woebot was able to help alleviate depression and anxiety over two weeks in its users.

Don’t Collect Biometric Data Without Providing Notice

Interestingly, a lot of lawsuits and would-be lawsuits fail because the plaintiff is unable to show harm. For example, if a biometric identifier were stolen and the thief used that identifier to steal a prototype from a manufacturer, that manufacturer could show harm since there was a cost associated with developing the prototype, likely a cost associated with developing the associated intellectual property, lost revenue, etc. However, the Rosenbach v. Six Flags case isn’t about a security breach, it’s about a lack of disclosure. Under BIPA, plaintiffs don’t have to show actual harm in order to receive a monetary award. For BIPA case defendants, the effect is “unjust enrichment” because plaintiffs are getting money for nothing. “It’s not always huge businesses that get hurt by this and get sued,” said Kay. “A number of top tier companies were among the first entities sued. The second wave over the past two years has been mostly focused on finger scanning by employers. Some of them are big national companies [including] hotel chains, airlines and restaurant franchises.

Android Pie: 30 advanced tips and tricks

Looking to do a little housekeeping and clear away all your recently used apps from Pie's Overview list? Swipe up once from the nav bar to open the Overview interface, then scroll all the way to the left of the app-representing cards. Once you've moved past the leftmost card, you'll see a "Clear all" command that'll do exactly what you desire. Android Pie tries to predict what you're likely to need next and then offer up specific actions — commands within apps, like calling a particular person or opening a certain Slack channel — at the top of your app drawer. If you see a shortcut there that strikes you as being especially useful, you can touch and hold it and then drag it onto your home screen for permanent ongoing access. You can also find any shortcut offered within Pie's app drawer by pressing and holding the icon for the associated app and looking at the menu of options that appears. You can touch and hold any item from that menu to drag it onto your home screen for future use, too.

What is digital health? Everything you need to know about the future of healthcare

The industry's aims are diverse and complicated: preventing disease, helping patients monitor and manage chronic conditions, lowering the cost of healthcare provision, and making medicine more tailored to individual needs. What makes the healthcare industry interesting is that those aims could potentially stand to benefit both patients, as well as their healthcare providers. By gathering more data on markers of health, from activity level to blood pressure, it's hoped that digital health will allow individuals to improve their lifestyles and maintain good health for longer, and so need fewer visits to their physician. Digital health tools could also help identify new illnesses or the worsening of existing ones. By enabling doctors to step in earlier during the course of a disease, digital health tools could help shorten the length of a disease, or help ease symptoms before they really take hold.

Cisco goes after industrial IoT

6 industrial iot oil rig oil drilling cranes

The industrial IoT rollout has enabled the network edge to extend its natural boundaries into places that traditional IT and network support hasn't had to have a lot of complexity and innovation, noted Vernon Turner, Principal and Chief Strategist at Causeway Connections. “Now that there is a lot of application development and deployment being done at the 'Extended Enterprise,’ it is only natural that a company such as Cisco follows with its capabilities in software, Turner said. "In particular, the ability to drive intent-based network functionality is critical for industrial-based workloads that now demand traditional IT-based attributes such as security, scale and flexibility.” One of the stumbling blocks for success is the customer experience of end-to-end integration and delivery of services. “For example, there can't be natural breaks between sensor-based data being generated by a shop-floor robot on a production line and the enterprise back-office systems for parts and material because of either different networks and different data systems – they both need to be delivered in a seamless manner,” Turner said.

How organizations need to react to new data privacy challenges

Development of inventories of personal data is likely the biggest trend, given how important they were to GDPR compliance in 2018 and how important they’ll be for CCPA compliance this and next year. They’re sometimes called “data maps,” and they’re crucial for understanding where personal data is located in an organization down to the server level, how it’s being protected, and with whom it’s being shared. ... The best data protection technology ever invented is an alert employee. The best way to get alert employees is through routine training in best practices. That include topics such as: what qualifies as personal information, how to recognize phishing and similar attacks, and who to ask when you have questions. I believe the majority of employees understand the gravity of the threats to personal information and expect their employers to acknowledge this and act accordingly.

Quote for the day:

"The leader has to be practical and a realist, yet must talk the language of the visionary and the idealist." -- Eric Hoffer

Daily Tech Digest - January 31, 2019

Singapore releases guidelines for deployment of autonomous vehicles

Permanent Secretary for Transport and chairman of the Committee on Autonomous Road Transport for Singapore, Loh Ngai Seng, said plans were underway to launch a pilot deployment of autonomous vehicles in Punggol, Tengah, and Jurong Innovation District in the early 2020s, and TR 68 would help guide industry players in "the safe and effective deployment" of such vehicles in the city-state. Enterprise Singapore's director-general of quality and excellence group Choy Sauw Kook said: "In addition to safety, TR 68 provides a strong foundation that will ensure interoperability of data and cybersecurity that are necessary for the deployment of autonomous vehicles in an urban environment. The TR 68 will also help to build up the autonomous vehicle ecosystem, including startups and SMEs (small and midsize enterprises) as well as testing, inspection, and certification service providers."

Network programmability in 5G: an invisible goldmine for service providers and industry

5G promises many disruptive functionalities, such as ultra-low latency communication, high bandwidth/throughput, higher security, and network slicing, all of which embed the potential to address new business opportunities not addressed by service providers today. But another functionality not always mentioned--and that has equal business potential--is network exposure, which can enable new levels of programmability in telecom core networks. Programmability in 5G Core networks allows providers to open up telecom network capabilities and services to third-party developers allowing them to create new use cases that don’t exist today. This is possible thanks to standardized APIs on the new network architecture for 5G. With APIs, a new frontier for business innovation in telecom will surge. Application developer partners will focus on new services applications, while telco service providers will focus on a new dimension of experience called “developer experience” and increase its position in the OTT value chain.

Internet Of Things (IoT): 5 Essential Ways Every Company Should Use It

Strategic decision making is where the senior leadership team identifies the critical questions it needs answering. Operational decision-making is where data and analytics are made available to everyone in the organization, often via a self-service tool, to inform data-driven decision at all levels. More and more companies make IoT-enabled products which connect them directly to their customers’ behaviours and preferences. For example, Fitbit knows how much we all exercise and what our normal sleeping patterns are. Samsung can collect usage data from their smart TVs. Elevator manufacturer Kone learns how their customers are using their elevators and Rolls Royce knows how airlines use the jet engines they make. Even companies that don’t make IoT devices can often gain access to data from other people’s devices, just think app makers that are able to collect user data because of the data collection and connectivity capabilities of the smart phones or tablets that run them. Used correctly, companies can leverage these insights to make quicker and better business decisions.

No-deal Brexit could lead to data issues, MPs told

The no-deal Brexit planning notice warns that the legal framework for transferring personal data from organisations in the EU to organisations in the UK would have to change when the country leaves the EU. This means that although businesses will be able to continue to send personal data from the UK to the EU, and would “at the point of exit continue to allow the free flow of personal data from the UK to the EU”, it may not be the same for the other way around. “We’ve been saying for a while that we would like the adequacy discussions to start as soon as possible. But the EU, as with everything else, is saying they won’t start the discussions until we are a third country. So, I’d be surprised if a decision could be made in under a year,” Derrington told the committee. There are also issues relating to legacy data, which was transferred from the EU to the UK before Brexit.

DARPA explores new computer architectures to fix security between systems

A better solution, then, in today's environment is to accept that users need or want to share data and to figure out how to keep the important bits more private, particularly as the data crosses networks and systems, with all having varying levels of, and types of, security implementations and ownership. The GAPS thrust will be in isolating the sensitive “high-risk” transactions and providing what the group calls “physically provable guarantees” or assurances. A new cross-network architecture, tracking, and data security will be developed that creates “protections that can be physically enforced at system runtime.” How they intend to do that is still to be decided. Radical forms of VPNs — an encrypted pipe through the internet would be today’s attempted solution. Whichever method they choose will be part of a $1.5 billion, five-year investment in government and defense electronics systems. And enterprise and the consumer may benefit. “As cloud systems proliferate, most people still have some information that they want to physically track, not just entrust to the ether,” says Walter Weiss, DARPA program manager, in the release.

There's more to WSL than Ubuntu

By integrating WSL with the updated Windows command-line environment, it's possible to integrate it directly with any application that offers a terminal. You can write code in Visual Studio Code, save it directly to a Linux filesystem, and test it from the built-in terminal, all without leaving your PC. And when it's time to deploy to a build system, you don't need to worry about line-ending formats or having to test code on separate systems. Support for SSH also ensures that you've got secure remote access to any Linux servers, in your data center or in the cloud. If you're using WSL to develop and test server applications, then you'll probably want to install SuSE Enterprise Server. It's a popular Linux server, and can be configured to handle most server tasks. With WSL now supported on Windows Server, you can use it to build test environments for cloud applications before deploying them on Azure or another public cloud. SuSE bundles a one-year developer subscription, which gives you more support resources than its standard community-based support forums.

Why we need less people, more skills for digital transformation

Why we need less people, more skill image

The fundamental argument comes down to value. Often in business, a corporate mentality exists in which executives boast about the number of people they have working for their company or on a project because they believe that provides the best value for their clients. This attitude has existed for more than two decades yet companies are still failing to understand that this might not provide the best value for their business or clients. Companies need to do more research to understand what works for them as an individual business, and often this means they don’t need to hire lots of people. Rather, they need the right people. While it may seem reassuring to have a large team working on an expensive project, often the work is easier, smoother and quicker when led by a small team who are highly-skilled, have good experience and who can be there working on the ground together, not spread around or working remotely. This may be more expensive at first, but it is worth it in the long term.

The FTC's cyberinsurance tips: A must-read for small business owners

Dan Smith, president, co-founder, and COO of Zeguro, a cybersecurity company that has grabbed the attention of investors, admits in this PYMNTS article the company came under a spear-phishing attack recently. It was unsuccessful, but it pointed out a very real need. Most small businesses do not think they need cyberinsurance (only 4% in the US currently have it) or do not know it's available. Smith adds that another problem area is that brokers providing the insurance are not spending enough time explaining it or may not understand it themselves.To fix the situation, Smith, in the PYMNTS article, announced that Zeguro will be partnering with the QBE Insurance Group to offer tailored cyberinsurance solutions. According to Smith, the idea is to use the company's expertise and acquired cybersecurity intelligence to craft the appropriate cyberinsurance solution for each client. Insurance on any level is a complicated subject, and then add the complexity of trying to secure a digital infrastructure from cybercriminals—using a partnership like Zeguro and QBE Insurance Group seems like good business.

What programming languages rule the Internet of Things?

Clearly, there’s a consensus set of top-tier IoT programming languages, but all of the top contenders have their own benefits and use cases. Java, the overall most popular IoT programming language, works in a wide variety of environments — from the backend to mobile apps — and dominates in gateways and in the cloud. C is generally considered the key programming language for embedded IoT devices, while C++ is the most common choice for more complex Linux implementations. Python, meanwhile, is well suited for data-intensive applications. Given the complexities, maybe IoT for All put it best. The site noted that, “While Java is the most used language for IoT development, JavaScript and Python are close on Java's heels for different subdomains of IoT development.” Perhaps, the most salient prediction, though, turns up all over the web: IoT development is multi-lingual, and it's likely to remain multi-lingual in the future.

How to accelerate digital identity in the UK

To encourage the reuse of a digital identity, the critical first step involves striking the right balance in the initial creation of a digital identity, based on the appropriate level of trust and friction for a first-time interaction. Digital services must be designed with the appropriate initial levels of trust, subsequently increasing levels of trust when required. It is a mistake to start with the maximum level of trust, which may be too high for the service. Instead, enhance trust as and when required. Digital identity standards allow services to map their increasing identity trust requirements effectively. Digital identity should be used at the point of need, with appropriate controls where absolutely necessary to complete the task. There is evidence that motivated users achieve high levels of success in verifying their identity in the right circumstances. The UK identity standards, built in response to real-world threats and risks, are world-leading, support the European Union’s eIDAS equivalence, and are closely aligned to the US NIST 800-63-A standard.

Quote for the day:

"Leading people is like cooking. Don_t stir too much; It annoys the ingredients_and spoils the food" -- Rick Julian

Daily Tech Digest - January 30, 2019

Cisco serves up flexible data-center options

Cisco has now extended ACI with ACI Anywhere to the cloud – specifically Amazon AWS and Microsoft Azure environments. The idea is that customers will have the flexibility to run and control applications anywhere they want across private or public clouds or at the edge and while maintaining consistent network policies across their entire domain. “There is nothing centered about data centers anymore,” said Roland Acra, senior vice president and general manager for Cisco’s Data Center Networking business. “IT teams have been forced to make a hard choice: stay with their on-premises data centers with a rich set of tools of their choice for automation or assurance or security; or move to the cloud, where a different set of capabilities can make consistent compliance a true challenge. ACI Anywhere removes that challenge and places workloads where it makes the most sense regardless of the platform or hypervisor.” ACI Anywhere would, for example, let policies configured through Cisco’s SDN APIC use native APIs offered by a public-cloud provider to orchestrate changes within both the private and public cloud environments, Cisco said.

Unconfigured IoT is a security risk, warns researcher

Many IoT devices work initially in an access point mode, so users can connect to the device using a smartphone to reconfigure it to become a client on the wireless network by entering the network security key, thereby making it much more secure. But businesses and consumers will often elect not to connect appliances to the internet, believing this is safer. ... “This means that if the device remains unconfigured, it will remain in the default state, making it even more vulnerable than if it were connected to the internet and configured,” said Munro. “Although this opens up another set of vulnerabilities, organisations and consumers are becoming increasingly aware of these vulnerabilities and are therefore more likely to be aware of the risks and how to mitigate them.” But with an unconfigured device, attackers could use a war driving or access mapping attack, which would make it easy to compromise these devices, said Munro, because the attacker could identify a target wireless network using a geolocation site, such as wigle.net, that shows wireless access points in any given location and enables account holders to search its database for unconfigured IoT devices.

Serverless computing’s dark side: less portability for your apps

Success or Burnout? Q&A on How Personal Agility Can Help

Personal Agility is a simple coaching framework; it is based on just six powerful questions, a weekly event for asking the questions, and an “information radiator” to help you understand and act upon the answers. You can do it yourself without needing agreement or permission from anyone else! The key question “What really matters?” provides guidance for deciding how to spend your time. The next question, “What did you accomplish last week?” helps you understand where you are and to feel good about yourself and what you’ve done! The next questions help you to figure out what is (or is not) important to do this week. “What could you do?” looks at possibilities; “Of those things, which are important or urgent?” helps you to identify the essentials; finally, “Which ones do you want to get done this week?” helps you set a course with realistic objectives, so you can make steady progress to achieve bigger goals. Finally “Who can help?” is a classic coaching question that helps you get unstuck.

IT leaders must address integration to support business ecosystem

The survey found that almost half (48%) of organisations want to modernise their IT in order to compete more effectively in today’s digital business landscape. Respondents said modernisation is key to consolidating disparate technologies, automating data transaction processes and gaining visibility into their critical data flows. However, the research found that modernisation is one of the enterprise’s biggest challenges. According to Cleo, while the surveyed IT decision-makers understand the limitations and high maintenance cost of legacy technologies, they also recognise the systems’ importance to day-to-day operations. In Cleo’s experience, a major part of digital transformation is balancing old and new technologies, which means integrating legacy systems with modern applications cost-effectively and without disruption. For this reason, enterprises must simultaneously maintain legacy systems while adopting newer cloud services and software-as-a-service (SaaS) solutions to engage in and support how business is done today, it said.

How to Estimate Software Projects in A Test-Driven Development Environment

A good project manager intentionally limits the amount of information available to participants for discussion. The less information is provided, the lower the chance of an error. If we look back at the above description, what’s in it for us in it? First, it helps us define the user. In our case, it’s a registered user who has previously placed an order on the website. Second, the required functionality should have time and data limitations. Third and very importantly, the action that the user performs is atomic. Sequences or non-linear sequences of actions indicated in the description of the functionality are the roads straight to hell. And for all the participants involved, not just for the customer! Subjectively speaking, the ideal user stories imply that the user needs a minute or less to become aware of how to perform this or that action. In this case, by “aware” we mean that a user has already performed the same or very similar action in a different application.

Japan's IoT Security Strategy: Break Into Devices

Identifying potentially vulnerable IoT devices that face the internet can be accomplished using search engines such as Shodan, which allow for search queries based on certain parameters. Once a device has been found, taking it to the next level - attempting to log into the device - is generally a criminal offense in most countries. That presumably is the case in Japan as well and the reason why the law had to be modified to make it legal for the survey (see: Could a Defensive Hack Fix the Internet of Things?). With the law changed and permission to proceed, it should be easier to identify vulnerable devices. The larger problem is trying to resolve the vulnerabilities. Fixing vulnerabilities that lead to large botnets has been vexing. A decade ago, attackers commandeered large networks of desktop computers via browser and operating system vulnerabilities. Law enforcement agencies and private companies found success in shutting down the command-and-control servers for those botnets. But it left the problem of cleaning up infected devices, which usually involved the owners of those devices installing security patches.

CEOs and software

Neither software leaders nor CIOs can catapult their software organizations into the digital era without the right CEO support. CEO actions, or lack thereof, can stymie progress toward the software capability that digital business demands. Why? Software success depends on factors that only CEOs control. CEO control starts with funding for software initiatives — buy, build, and everything in between, plus modernization of outdated software. We track software leaders’ views on the top 10 barriers to improved software delivery (see Figure 1), with the barriers owned by CEOs highlighted in red. ... Software Delivery Speed Is Stuck“Things are moving so fast in our market,” said the CEO of a professional services firm. “I live in terror of being left behind.” Speed of software delivery is a leading indicator of health and vitality in a software-delivery organization and a signal that a software team’s digital transformation is underway. During the past five years, developers have made almost no progress in their ability to deliver software quickly

How traffic scrubbing can guard against DDoS attacks

A growing number of enterprises are investing in DDoS solutions, especially cloud-based DDoS mitigation services, with a shift away from a service-provider-centric market. A DDoS attack is one of the most complex threats that businesses can face. The goal of the individual hacker, organised criminals or state actors is to overwhelm a company’s network, website or network component, such as a router. To begin with, organisations have to determine whether a spike in traffic is legitimate or is an attack. “Without a solid understanding of baselines and historic traffic trends, organisations are unlikely to detect an attack until it is too late,” said Sherrel Roche, senior market analyst at IDC’s Asia-Pacific business and IT services research group. Landbank, the largest government-owned bank in the Philippines, has taken the step of implementing F5’s BIG-IP local traffic manager to understand its application traffic and performance better, as well as to gain full visibility into customer data as it enters and leaves an application. This enables the security team to inspect, manage and report fraudulent transactions as soon they are spotted.

DevOps Adoption Practices

Many organizations start with an environment that is full of variables: different processes, different environments, different tools, and several permutations of configurations and data. All this makes automation hard and reduces your ability to learn as each variable could be the cause of the problem. The first step is to look at all those variables and see what you can remove. Can you align the patch levels across environments? Can you deploy the same version of the application across environments? Some variables can only be removed later on, but understanding what all the variable pieces are and doing a clean-up first will make later efforts easier. ... Someone once told me: "You cannot automate what you cannot document." After all, automation is a form of documentation of a process. What is even more important is that automating a bad process just creates more problems. I also think that writing down a solution forces you to think it through in a way that verbal communication or just starting to write code does not.

Quote for the day:

"A leadership disposition guides you to take the path of most resistance and turn it into the path of least resistance." -- Dov Seidman

Daily Tech Digest - January 29, 2019

Enterprise digital transformation leaves data security behind

Thales suggests that in the rush to adopt new solutions — of which the majority of survey respondents said sensitive data is used in tandem with digitally transformative technologies — encryption and protection is not as high on the priority list. While sensitive corporate or customer data is linked to new digital solutions in 97 percent of cases, fewer than 30 percent of these same respondents said that encryption is being used within these environments. According to the survey, enterprise players that are aggressively overhauling their systems with new technologies are skating on the thinnest ice, with 28 percent running the highest risk of experiencing a data breach by ignoring suitable security standards in their enthusiasm. However, there are a few areas in which encryption usage is in above-average use. In total, 42 percent of organizations using IoT, 47 percent of businesses using container technology, and 45 percent of companies which have adopted Big Data solutions use encryption in some form or another.

Digital banking can give a boost to your bank’s bottom line.

By expanding their digital footprint, banks can reduce costs and boost financial performance while meeting consumer demand for a more streamlined and personalized customer experience. The closer you get to digital native, the more substantial the cost reductions and the greater the corresponding increase in ROE. That doesn’t mean going digital native is the right answer for every bank. Whatever you choose, the solution needs to be in line with your long-term strategy. After all, each bank has a different set of core capabilities, and not all banks are prepared for a full digital transformation. The right answer for one bank might be the wrong answer for another. ... The simplest approach is to modify the front end only, focusing on the primary ways a customer interacts with a bank. Largely a cosmetic fix, the bank designs an appealing mobile app and web interface but keeps the organization’s workflows, culture, and back-end infrastructure intact. We understand the appeal of this approach. For an organization that needs a quick win, it’s certainly the fastest route.

Pro Tips for Developer Relations

One thing I like to do from time to time is what I call a Mashup Presentation. It requires zero content creation but requires demo creation. When I do something like this, it involves simply curating existing content from other presentations, and then work on a demo that uses most if not all pieces described in the material. It is a good way to compact and connect interesting topics and present to developers, so they don’t need to figure out the intrinsic connections between the ideas. Plus, consumes less time. A second tip is to contact the regional sales field when traveling, to find opportunities to meet with customers/prospects. May sound salesy, but it actually shows itself as a great source of real-world ideas to be covered in the future. Plus, it brings the advocate down to Earth. Finally, I like to reuse as much material as possible, whether from myself or from others. What matters is presenting something that will be never-heard-of to the audience, doesn’t matter if it is something that was created in 2001. To me, advocacy is more about bringing information than "creating information."

What the fintechs think about open banking’s progress?

“Banking data is shared via APIs, which allows two pieces of software to talk to each other and share information. Whilst these APIs already exist, there is technically a long way to go before they can be used widely. This is the limiting factor on the uptake of open banking currently, and as the technology improves, more services and products will spring up. The initial uptake of open banking has been more of a trickle than a flood. That said – there is lots of support and encouragement in existence to help providers and users start to explore the possibilities of Open Banking. Fluidly has recently been the winner of a £200,000 prize fund organised by Nesta. The fund is specifically aimed at companies who are transforming small business banking via Open Banking. Funds like this will accelerate the uptake of Open Banking as it helps to get new products built more quickly and raises the profile of what’s now available for consumers and businesses.”

McLaren: Digital transformation on and off the track

A great example of how this transformation impacted our business is how it empowered the technology underpinning our racing team. On each Formula 1 car there can be up to 300 sensors that communicate from once per lap to 150 times a second. That data which reached terabytes per race is now sent via a hyper-converged infrastructure from the pitlane garage to engineers, strategists and drivers. That trackside infrastructure has to be robust enough to be installed operated and then moved to over 21 global locations. The same data is transferred in real-time back here to the McLaren Production Centre. Within the cool calm centre of our mission control, the data becomes the driving force behind our simulations, strategy options and data-driven precisions. This system of data-driven collaboration relays on our cloud-based apps and infrastructure and storage solutions. In McLaren, regarding IT, we look to apply these principles across our group and have found that it can be applied to many other businesses.

Three Elements Of Next-Generation Data Management For Financial Services

A data hub can help you gain a holistic view of data assets, manage data across the full IT landscape, and integrate data into a unified view. By building the platform around a data hub, you can increase transparency of and access to all data assets, which increases agility and the speed of innovation. Critical data hub functionality includes: Open architecture foundation, allowing the hub to connect data no matter where it is physically located – in the cloud, on-premise, in Hadoop, or on cloud object storage; Data sharing and discovery across the enterprise; Single view for data asset management, supporting data analysis and governance (including pipelining, orchestration, and monitoring); Elimination of the need for centralization of data and mass data movement to a single data store; Support for complex data processing operations, such as machine learning-based analysis; Governance and orchestration for data refinement and enrichment; and Metadata catalog management, improving the visibility of data assets across the landscape. As financial services leaders increasingly realize that more trusted, connected, and intelligent data contributes to digital transformation,

The DDoS that wasn’t: a key takeaway for web domain security

Typical traffic forwarded to the domain before the incident contained both GET and POST requests. However, the 'malicious' traffic was only sending a stream of POST requests. "Examining all the POST requests hitting the customer's URL showed that the User-Agent fields were not being forged or otherwise altered, boosting the confidence researchers had for their conclusion that a Windows-oriented tool was responsible for this massive flood of requests," the cloud service provider says. To give the firm time to work out what was doing on, SOCC was able to mitigate most of the strange requests over the next 28 hours, leading to the discovery that the traffic smashing the URL was "the result of a warranty tool gone haywire." Buggy code, and not a botnet, was the problem. The warranty tool's errors meant that it sent constant POST requests to the domain automatically and with enough frequency to potentially take down the website. A fix was created and deployed quickly by the vendor at fault for the tool which resolved the issue.

Data Loss Prevention – Human error, insider threats and the in-between

While employees in the modern workplace are getting increasingly technologically savvy, and are finding new tools to improve their productivity, they aren’t always aware of the security implications of their actions. Many of our customers are leveraging Microsoft Information Protection solutions to classify, label and protect their data. To minimize the impact on end users and their ability to be productive, these organizations often choose to empower their users to label documents themselves, by providing automatic suggestions but not auto-labeling or -protecting documents. A user can inadvertently label a document containing highly confidential information with a low sensitivity label that applies minimal access restrictions. Since the file is already encrypted, it will not be scanned by the DLP solution, but might still be accessible to unauthorized people. A bigger threat with a much higher potential for damage, is the malicious insider.

How secure is Android? Separating the myths from the facts

Google’s effort has been to continually harden the Android platform. Security is an ongoing enterprise, evidenced by new innovations like an improved security model for biometrics and industry-leading capabilities that protect sensitive information on a secure, dedicated chip. An important top-line defense is through Android’s monthly security updates. Devices that are part of the Android Enterprise Recommended program receive the monthly Android security patch, guaranteed within 90 days of release. Another key innovation is the Titan M chip found in Pixel 3. The chip is integrated into Android’s Verified Boot process, ensuring the bootloader, the program that validates and loads Android, is running the correct version. This prevents bad actors from moving the device to a more vulnerable version of Android clandestinely. While debuting on the Pixel, the security community will be able to audit Titan through the open-source firmware. Google Play Protect, the world’s largest mobile threat-detection service, defends against Internet-borne threats and potentially harmful apps (PHAs).

Cybersecurity Staffing in Crisis: What Can You Do?

Many enterprises find it easy to think of cybersecurity professionals as stemming exclusively from the STEM fields. In many ways this makes sense; IT security obviously builds itself on technology and algorithms, which would be second nature to those interested in the hard sciences. However, being too selective in the security hiring process contributes to the cybersecurity staffing crisis; it means enterprises turn away perfectly qualified candidates for not having the “right” degrees. STEM skills can strengthen your cybersecurity posture, of course. However, your InfoSec team requires other skills such as collaboration, communication, adaptability, and creativity to be fully well-rounded. What matters in a candidate may not be the knowledge of information technology but the capability of learning about technology in a productive manner. Additionally, you need to make sure you draw upon a diverse pool of information security professionals. Drawing only from a homogenous pool contributes to the cybersecurity staffing crisis.

Quote for the day:

"Leadership involves finding a parade and getting in front of it." -- John Naisbitt