Daily Tech Digest - July 23, 2019

How to establish a security culture within IT

In the current age of widespread security awareness, almost every enterprise has established a security program. A security program consists of policies established by the CISO or ranking security leader, operational controls that enforce the policies, work rules and procedures that implement the controls, tools that support the rules and procedures, and a security operations team that employs the tools to monitor the rules and procedures and audit the consistency and effectiveness of the controls. This sounds complicated but the key components of a successful security program are well understood by most IT shops and have been implemented to one degree or another in most enterprises. A security program and a security culture are two different things. In a security culture employees have an informed understanding of the cybersecurity threats that confront their companies. They understand the motivations and intents of the malicious actors that operate within their industries or markets. Cybersecurity issues and concerns are routinely discussed in normal business meetings such as quarterly business reviews, business strategy sessions, budget planning meetings, M&A evaluations, etc.

Google debuts better transcription, endless streaming, and more in Contact Center AI

Increased contextual awareness and enhanced speech-to-text aren’t the only new natural language understanding improvements coming down the Contact Center AI pipeline. Google debuted in beta today “richer” manual speed adaptation and entity classes, in addition to expanded phrase limits, endless streaming, and more. There’s a trio of new features within SpeechContext parameters, the collection of Cloud Speech-to-Text settings and toggles that tailor transcriptions to businesses’ and verticals’ vernaculars. SpeechContext classes — prebuilt entities reflecting concepts like digit sequences, addresses, numbers, and money denominations — optimize ASR for a list of words at once. As for SpeechContext boost, it helps adjust speech adaptation strength while cutting down on the number of false positives — i.e., when a phrase wasn’t mentioned but appears in a transcript. Lastly, SpeechContext now supports up to 5,000 phrase hints per API request, increasing the probability uncommon words or phrases will be captured by ASR.

Data breach costs on the rise and the financial impact will be felt for years ⁠— IBM

Those organisations that experience data breaches, whether large or small, and aside from the reputational damage will experience the financial impact of a data breach for years. The report found that while an average of 67% of data breach costs were realised within the first year after a breach, 22% accrued in the second year and another 11% accumulated more than two years after a breach. The ‘longtail’ costs were higher in the second and third years for organisations in highly-regulated environments, such as healthcare, financial services, energy and pharmaceuticals. “Cybercrime represents big money for cybercriminals, and unfortunately that equates to significant losses for businesses,” said Wendi Whitmore, Global Lead for IBM X-Force Incident Response and Intelligence Services. “With organisations facing the loss or theft of over 11.7 billion records in the past three years alone, companies need to be aware of the full financial impact that a data breach can have on their bottom line and focus on how they can reduce these costs.”

Major Improvements Are Coming To Blockchain In 2020

Everyone in the enterprise world already has a blockchain strategy. If they don’t have one now, they risk the chance of staying behind or simply missing an opportunity. For the last few years, the benefits and correlated risks of fully adopting blockchain technology have been estimated, analyzed, and discussed at large. One thing is clear – despite the potential for a big upside, embracing a newly developed technology presents numerous risks that shouldn’t be underestimated. Blindly introducing new technology stack into an already working production environment means exposing that environment to potentially dangerous security breaches, hacks and data loss. So, where we are now? Most blockchain protocols claim some level or maturity … but are they, in fact, sufficiently mature? Are they ready for full on-premise deployment in large-scale enterprises? Will CIOs and other business executives enjoy the same comfort as that of the tooling they already have? Let’s review what it takes to move a blockchain protocol from open source to enterprise.

New Cyber Security Directive Forces Federal Agencies to Patch Vulnerabilities Twice as Fast

Agencies that fail to patch vulnerabilities during the required time window are given three days to get a complete remediation plan in place. They are asked to provide a reason as to why they cannot update in time, to document any intermediary mitigation methods they put in place and provide an estimate of when their systems will be patched. Though these requirements do apply to all federal agencies (with the exception of the Pentagon and intelligence agencies), the DHS has stated that some systems that are no longer receiving security updates will be exempt from these rules. Under the terms of the new cyber security directive, administrative penalties are possible for agencies that fail to respond in a timely manner. CISA is a recent reorganization of the National Protection and Programs Directorate (NPPD), tasked with protection of both the nation’s physical and cyber infrastructure. Under the Cybersecurity and Infrastructure Security Agency Act of 2018, the department has been restructured with a renewed emphasis on cyber security.

From fashion to Fintech — how Manchester’s leading the way in digital tech

It’s not just startups and scaleups that are attracted to the bright lights of Manchester. Major digital players are being drawn to the North West and away from London thanks to lower rents and a large pool of graduate talent. GCHQ has chosen to locate its new cutting-edge intelligence facility in Manchester. Moonpig has announced it will open a new tech hub in Manchester city centre, designed to “turbo-charge” innovation and personalisation for its business. The Hut Group is building a one million sq ft business campus at Airport City south of Manchester, the largest development of its kind in the UK, and fellow online retail giant Amazon is rumoured to be taking another 91,000 sq ft of space in Manchester. Greater Manchester has become a main stage for leaders in the industry. It is one of the UK’s most successful city-regions; home to more than 2.8 million people and with an economy bigger than that of Wales or Northern Ireland. 

7 mobile security threats you should take seriously in 2019

A staggering 91% of cybercrime starts with email, according to a 2018 report by security firm FireEye. The firm refers to such incidents as "malware-less attacks," since they rely on tactics like impersonation to trick people into clicking dangerous links or providing sensitive info. Phishing, specifically, grew by 65% over the course of 2017, the company says, and mobile users are at the greatest risk of falling for it because of the way many mobile email clients display only a sender's name — making it especially easy to spoof messages and trick a person into thinking an email is from someone they know or trust. Users are actually three times more likely to respond to a phishing attack on a mobile device than a desktop, according to an IBM study — in part because a phone is where people are most likely to first see a message. Verizon's latest research supports that conclusion and adds that the smaller screen sizes and corresponding limited display of detailed information on smartphones (particularly in notifications, which frequently now include one-tap options for opening links or responding to messages) can also increase the likelihood of phishing success.

How botnets pose a threat to the IoT ecosystem

Although there is no silver bullet solution for mitigating the risk of botnets, there are a number of helpful best practices. “When deploying an IoT device of any type, the three most important questions need to be: Have we configured strong credential access? What is our update strategy for firmware changes? What URLs and IP address does the device need for its operation?” says Tim Mackey, senior technical evangelist at Synopsys. “When IoT devices are deployed within a business environment, best practice dictates that a separate network segment known as a VLAN should be used. This then allows for IT teams to monitor for both known and unknown traffic impacting the devices. It also allows teams to ensure that network traffic originates from known locations. “For example, if a conference room projector is accessible via Wi-Fi, the network the device uses should be restricted to only internal and authenticated users. Public access to the device should always be restricted. ...”

Digital Transformation Challenges IT Leaders

For many organizations, legacy technology could ultimately become a hindrance to everyday business operations, Lequin warned. "The larger the enterprise, the likelier the challenge of implementing change quickly, potentially cutting into the bottom line," he observed. Lequin believes that large enterprises can help build agility by pushing decision making out to the edge, using technologies such as artificial intelligence (AI) to transform loads of data into working intelligence that will give them the ability to move faster and more readily adapt rapidly changing demands. Enterprise technology is expanding ever more quickly. "It’s an exciting time to be involved in the industry," Lequin said, pointing to key long-term trends, such as robotic process automation (RPA), which automate workloads and frees-up teams to focus on value-add projects. Half of the enterprises responding to the Intelligent Technology Index cited advanced analytics, AI, and machine learning (ML) as critical to their transformation projects. "Technologies that optimize the use of data will be key difference makers moving forward," Lequin stated.

Security pros are paranoid. Maybe we should all follow suit

It’s a war out there – a fight between companies that want to leverage technology to improve the condition of humankind, and the bad actors, cyber criminals, nation states, hackers, and black hats who want to make a little cash, gain a little notoriety, or potentially destabilize a western economy. I’m in the business and I’m actually more worried than ever about the threats we face. The attackers are able to evade detection, disappear without a trace, automate their attacks, never leave the same set of fingerprints and fool even the savviest among us with spear phishing and social engineering schemes. This anxiety, even among us who know what state-of-the-art security software is capable of, was reinforced by a survey that Lastline completed at the 2019 RSA conference in San Francisco. We surveyed 136 random security professionals and the term that best comes to mind when reviewing the results is “paranoid.” These are smart people who understand what they’re fighting against, and as a result they’re distrustful, worried, and yes, paranoid.

---

Quote for the day:

"The great leaders have always stage-managed their effects." -- Charles de Gaulle

---

Daily Tech Digest - July 22, 2019

Will complexity kill Kubernetes?

Kubernetes, unlike Hadoop, is an easier system with which to become familiar, in part because of where it can run. As Gareth Rushgrove writes, “You can run Kubernetes locally much, much easier (Docker Desktop, Kind, MicroK8s) than the other similar examples. Lowering the barrier to entry makes it easier to become familiar, which combats perceived complexity.” It also helps, as Cloud Native Computing Foundation executive Chris Aniszczyk stressed, that while “distributed systems are inherently complex, the upside with Kubernetes is that every major worldwide cloud provider and multiple vendors offer a managed conformant/certified version of it (no forks) which helps most users with complexity of managing at scale.” Even so, perhaps the right question, Tamal Saha indicates, is whether “Kubernetes [is] complex given the problem it tries to solve.” For him, the answer is no. That is the same answer to the question, “Will Kubernetes get Hadooped?” Kubernetes is already well past that stage.

Microsoft tells enterprises to be on Edge

In a special enterprise-focused section of the Edge Insider site, Microsoft has posted a .zip-format file that contains all the files - including ADMX and ADML files, and an HTML document - for using group policies on Windows and macOS machines to configure Edge in a managed environment. Last month, Microsoft had previewed those same files and most of the group policies. It wasn't easy to find the files, though, since Microsoft had hidden them in a post on the Insider forum. The current collection of group policy objects (GPOs) also includes those for managing Edge updates, something missing from the bunch previewed in June. One update-related policy, UpdateDefault, for example, lets administrators specify whether and how workers' copies of Edge use the Microsoft Edge Update service, a spin-off of the updater that handles Office. Policy configurations include disabling updates entirely, allowing manual updates and offering only periodic background updates. Other policies can be set so that some or all users are allowed to, for instance, update the beta and stable channel builds of the browser, but not the rougher dev and canary versions.

HMRC makes cloud and data progress 

According to the department, achievements of the new Data Governance Board so far include the introduction of “foundational” elements, such as a data audit on its high-risk systems and services to identify risks of non-compliance with the General Data Protection Regulation (GDPR), whereby asset owners are informed about the risks around non-compliance and take responsibility for managing them. HMRC’s Voice ID service is an example where a specific risk of non-compliance has been identified as the department collected data with consent from five million UK taxpayers. An enforcement notice to delete the unlawfully collected data was then issued in May 2019 by Information Commissioner’s Office (ICO). The ICO’s instruction was to delete the data within 28 days. According to HMRC, the process was about 40% of the way through when the enforcement notice was issued and the deletion was completed one week before the deadline of 6 June 2019.

Private channels slated to launch in Microsoft Teams this fall

Private channels would help businesses streamline how users are organized within Teams. For example, instead of having an "IT Department" team and an "IT Director" team, Chapman University could have one team for the entire department with a private channel for its managers. Microsoft reaffirmed its commitment to private channels in a keynote address at the Enterprise Connect conference in March, saying the feature would launch sometime in 2019. The company is currently testing private channels with a limited group of beta customers. Microsoft has blamed the delay on the technical difficulty of engineering private teams. The company needs to make private not only the chats but also the files, which requires tinkering with the integration between Teams and Office 365 apps such as the file storage service SharePoint. "We can only speculate as to why it's taking so long," said Raúl Castañón-Martinez, analyst at 451 Research. "Regardless, Microsoft needs to make this issue a priority."

AI Ethics Come Into Focus as the Workplace Evolves

Prominent risks can emerge associated with ethical AI design, development, and deployment. For example, companies are already using AI to automate tasks, with some aiming to reduce their workforces in the process. The survey also noted that 36% of respondents saw job cuts from AI-driven automation rising to the level of an ethical risk. Even jobs that are not eliminated may be affected in some way by AI, prompting some organizations to find ways to use the technology to increase opportunities for employees while mitigating negative effects. Bias is another area of risk. AI systems learn from the datasets with which they are trained. Depending on how a dataset is compiled or constructed, the potential exists that the data could reflect assumptions or biases—such as gender, race, or income—that could influence the behavior of a system based on that data. Generally, these systems’ developers intend no bias, but many have reported AI-driven instances of bias or discrimination in application areas such as recruiting, credit scoring, and judicial sentencing.

Life after artificial intelligence

Is it moral to augment our abilities with technology if we use those enhanced abilities to end suffering? This isn’t some half-baked grad school discourse, but a question that deserves our thoughtful consideration. AI methods and technologies are improving on a daily basis, so there’s a moral and ethical reckoning waiting for us right around the corner. We’ll have to answer questions exactly like this one sooner instead of later. “Morality” broadly refers to the lowest common denominator of appropriate behavior for the planet’s 7.5 billion people. This is a suboptimal understanding of such an important concept because it allows for massive suffering, but if we had access to a higher level of intelligence, we could use it to address and end that suffering. I think we’ll furthermore see the end of the 40-hour workweek, and I’m not even talking about grand political ideas like basic income. The nine-to-five paradigm is a myth that was invented by humans, and it tends to stand in the way of us achieving personal goals and ambitions. With a new brand of intelligence automating low-level cognitive tasks across the board, we’re going to inevitably generate more downtime in our workdays.

The tech startup scene in India: growing fast as a mobile first economy

India was a bit late to the tech party. But in the last few years, the country has ramped up its efforts. “In terms of growth, the numbers are more impressive than any other economy in the world,” said Turakhia. This rapid growth has led to a mobile revolution — and that has “opened up the possibility of a lot of B2C-focused tech plays around e-commerce, whether that’s transportation, mobility or retail,” he explained. These type of things have played out in the US, UK and elsewhere for some time now — e-commerce in these regions, for example, has been in the mainstream for the last three to five years. Compared to more mature economies “there are cultural and structural differences in a mobile first economy,” Turakhia continued. He also pointed to the whole notion of B2B SaaS as a particular focus in India — the majority of engineering and product development takes place in-house, while sales and marketing is a global activity. “We built our banking technology by leveraging India as a human resource,” said Turakhia, referring to on of his own companies, Zeta.

Network Management: 4 Questions You Need to Ask Yourself

Just like any other business-critical technology, it’s important for enterprises to manage each network in their infrastructure. Network management policies ensure that a network team can strategically examine their network at every stage on a multi-layered level. Studying the efficiency of your network and adapting network administration, operation, and provisioning to meet your current business goals is essential for proper network performance. By managing their network, enterprises can meet all those criteria. Network management practices help enterprises intelligently design and operate their networks. It encompasses a series of concepts and ideas that enterprises can employ to effectively maintain every network they operate. While the specific management functions your company focuses on will depend on your business needs, there are some aspects of network management that everyone should adopt. Below, we’ve listed 4 network management questions that your business needs to ask itself if it hasn’t already.

Kubernetes underpins Docker container technology dominance

The big mission of containers turned out to be something totally different than that of VMs. As we evolve toward componentized applications that consist of synchronized, separately hosted components that work cooperatively to do something, these individual components are small, relative to the whole application. VM overhead -- a different OS for every VM instance -- means that, in most cases, the software component you're trying to run uses significantly less resources than the system software that you're trying to run them with. You're wasting more than half of your total resources on multiple copies of an OS. In componentized applications, the mission became, 'I need to do this really efficiently in terms of resources,' so container technology came to focus on these componentized applications. VMs focus on IaaS and true multi-tenancy. And that's what changes the dynamic, because for containerization, there are other considerations that are so much more critical than the minimal potential differences in security.

Hexagonal Architecture in Java

Hexagonal architecture is a model or pattern for application design. It is also known as a ports-and-adapter architecture. The core logic is embedded inside a hexagon, and the edges of the hexagon are considered the input and output. It divides the application into the inside and outside parts. Inside parts are the core logic of the application. The outside part could be the UI, database, messaging connectors, etc. Thus, the application's business logic is isolated from outside concerns. Communication between the two happens using so-called ports and adapters. ... Application users want to connect to the system or core application. The application has exposed the inbound ports; however, application users are presented with primary adapters, which use the inbound port to connect to the system. The system, in turn, uses the outbound port to connect to some external system for its data needs, etc. An outbound port is implemented by secondary adapters to expose a way to connect to the external system.

---

Quote for the day:

"Real friendship is shown in times of trouble; prosperity is full of friends." -- Euripides

---

Daily Tech Digest - July 21, 2019

Top 9 Ways Artificial Intelligence Prevents Fraud

What’s needed to thwart fraud and stop the exfiltration of valuable transaction data are AI and machine learning platforms capable of combining supervised and unsupervised machine learning that can deliver a weighted score for any digital business’ activity in less than a second. AI is a perfect match for the rapid escalation of nuanced, highly sophisticated fraud attempts. Fraud prevention systems can examine years and in some cases, decades of transaction data in a 250-millisecond response rate to calculate risk scores using AI. Taking this more integrative, real-time approach to AI across a digital business yields scores that are 200% more predictive according to internal research completed by Kount. They’ve recently announced their next-generation AI-driven fraud prevention solution as well as a new scoring feature, Omniscore. Omniscore incorporates the most predictive components of both supervised machine learning and unsupervised machine learning and additional predictive factors into one score.

What is bias in AI really, and why can’t AI neutralize it?

The whole point of machine learning is to infer the relationships between objects when, unlike the tides, it isn't already clear to human beings what those relationships are. Machine learning is put to use when linear regression or best-fit curves are insufficient -- when math can't explain the relationship. But perhaps that should have been our first clue: If no mathematical correlation exists, then shouldn't any other kind of relationship we can extrapolate be naturally weaker? Does a relationship exist, for instance, between a certain tech journalist with a goatee and any recorded inferences from suspected, goatee-wearing watch-list terrorists? And if there does exist such a relationship, should it? Bias, at least in everyday discussion, is exemplified by evidence of a relationship where there shouldn't be one -- for example, the annual divorce rate in Ohio and the national consumption rate per capita of margarine. If bias is endemic, then by definition it must be a pattern. And neural networks are supposed to be good at detecting patterns.

Digital innovations and disruptions- a panacea for today's evolving fintech landscape

Emerging technologies are changing the way we live, shop, travel and make transactions. Technologies such as machine learning and artificial intelligence are making our lives effortless and secure. Emerging technologies like blockchain and smart contracts have helped companies like IndiaLends to enhance the security of consumer data and make the digital lending process more transparent. "For the identification of the borrowers, blockchain has been serving as a huge solace. Users can enter the data on the digital platform which is verified, protected with the help of passwords and encryption and then passed on to the blockchain. Users can also choose which information to be shared with which lender," says Gaurav Chopra, CEO and Founder, IndiaLends- a digital lending and borrowing marketplace. To ensure that the entire lending process is transparent and clear to its customers, smart contracts come into play. And this is, in fact, more feasible for it. Instead of using cumbersome electronic data storage systems, the company can record all the information on blockchain.

DoD Announces the Cybersecurity Maturity Model Certification (CMMC) Initiative

The CMMC is expected to designate maturity levels ranging from “Basic Cybersecurity Hygiene” to “Advanced.” For a given CMMC level, the associated controls and processes, when implemented, are intended to reduce risk against a specific set of cyber threats. Notably, DoD will assess which CMMC level is appropriate for a particular contract and incorporate that level into Sections L and M of the RFP as a “go/no go” evaluative determination. This assessment of appropriate maturity levels on a procurement basis is akin to the Cyber Security Model that the United Kingdom’s Ministry of Defence (“MoD”) currently employs for all MoD contracts. In general, contractors will be required to be certified by a third-party auditor. The FAQs on the website note that certain “higher level assessments” may be conducted by government assessors, including requiring activity personnel, the Defense Contract Management Agency (“DCMA”), and the Defense Counterintelligence and Security Agency (“DCSA”). The website does not, however, explain what qualifies as a higher level assessment.

Could RegTech Be In Line For A FinTech Boom?

Identity Management & Control facilitates counterparty due diligence and Know Your Customer (KYC) procedures. Alongside Anti Money Laundering (AML) and anti-fraud screening and detection. Identity management is the second biggest sector in terms of the number of firms and is hugely important in a wide range of ways especially when growing and taking on new customers and clients. Compliance pertains to real-time monitoring and tracking of the current state of compliance and upcoming regulations. Compliance is the largest RegTech sector with a large scope and responsibility. Companies from this sector are charged with meeting key regulatory objectives to protect investors and ensure that markets are fair, efficient and transparent. They also seek to reduce system risk and financial crime. As regulations change when we do leave the EU, this will likely be one of the key sectors to face some of the challenges that arise. Transaction Monitoring provides solutions for real-time transaction monitoring and auditing. It also includes leveraging the benefits of distributed ledger through Blockchain technology and cryptocurrency.

Changing attitudes about cyber security

Regardless of what is driving behaviors and decisions, keeping your business safe is paramount if your organization wants to remain competitive and successful. But getting everything in place and preparing your company for something that may never happen can be challenging. Consumers are demanding more transparency on what is being done with their data, while at the same time looking for improved levels of customer service and global access to goods and services. When you put these together, it becomes clear that organizations need to align and connect all areas of their business. As a result, many are investing significant resources and budget into digitization and implementing improved technologies. The customer experience is being digitized, including omni-channel, multi-platform and AI-supported technologies, back-end processes are being harmonized, and supply chains are being enhanced through increased levels of transparency.

Explainable Artificial Intelligence & The Limits Of Human Deliberative Process

There’s considerable research that demonstrates humans’ lack of insight into their own deliberative processes. People are generally willing to concede that they don’t know where their own creative breakthroughs come from. But when it comes to more ordinary achievements of the mind, our mental processes seem more understandable. Say you’re asked to name a brand of gum. You respond with “Wrigley’s Doublemint.” Why? “Because that jingle from their early ‘90s ad campaign is still stuck in my head,” you might offer. Or if asked why you chose to buy a particular pair of socks, you’ll reason, “they were the best combination of high quality and low price.” Similarly, on the battlefield, warfighters can sometimes explain why they made a particular decision, while in other cases, they may acknowledge an inexplicable sort of divine inspiration. Mike Jaco, former Navy SEAL and author of The Intuitive Warrior, voices the latter when he explains, “by fine-tuning my intuition as a Navy SEAL, I was able to predict and avoid attacks to protect myself and my fellow soldiers.”

Increasing Access To Blockchain And Ledger Databases

Managed Blockchain manages certificates and track operational metrics, such as usage of compute, memory, and storage resources. With Managed Blockchain's voting API, network participants can add or remove members. When a network member requires additional capacity for creating and validating transactions,the member can quickly add a new node using Managed Blockchain's APIs. In addition, Managed Blockchain provides a selection of instance types that comprise varying combinations of CPU and memo. This gives you the flexibility to choose the appropriate mix of resources to support your nodes. Users pay according to their usage and don't worry about any upfront costs for infrastructure. Managed Blockchain supports two popular blockchain frameworks, Hyperledger Fabric and Ethereum. Hyperledger Fabric is well-suited for applications that require stringent privacy and permission controls and with a known set of members.

Security, Risks and Governance: Three Pillars for Agile Business

Governance is all about initiatives and strategies for setting the tone. It has to be taken care of at the level of the board, regulator and other nodal agencies. It also involves customers. These days they demand better control over the data. They worry about the safety of their data while sharing it with various entities. It is a natural demand from the community, whether it is customer, regulator, government, law enforcement, etc. It will determine the nature of controls and their design. Bharat Panchal, Senior Vice President, Head – Risk Management, National Payments Corporation of India (NPCI) talks about these issues in the Book Titled “Accelerating Enterprise Innovations”. The following is an excerpt from the same book: As the threat landscape keeps changing, agility in control deployment will be an essential component of cybersecurity strategy. In risk identification, you have to be proactive rather than reactive. This will help figure out the potential chances of breaches. Looking at the larger picture. I believe security, risk and governance are key pillars for any business. 

Phishing Attack Aimed at Stealing Payroll Deposits

Wise says that while it does not believe that it was the intent of the phishing attack to obtain patient information, access to the email boxes may have compromised patient information, such as medical record number, diagnostic and treatment information, and potentially insurance information. "Again, we believe the purpose of this campaign was to divert payroll direct deposits rather than to obtain patient information," the statement notes. Wise Health System has not received any reports of patient identity theft since the date of the phishing incident, the statement adds. ... Tom Walsh, president of consulting firm tw-Security, says that the process for making any changes to employee-related data should always require an authorization. That includes changes involving an employee's bank and account numbers for payroll direct deposits, beneficiaries on life insurance policies and health insurance benefits. "The employee portal makes it easier and more convenient, but the assurance that the HR department is actually communicating with the employee may have been lost for the sake of convenience," he says.

---

Quote for the day:

"A man's character may be learned from the adjectives which he habitually uses in conversation." -- Mark Twain

---

Daily Tech Digest - July 20, 2019

FinServ in the age of AI – Can the FCA keep the machines under check?

There are banks who are also looking at reverse engineering the explainability when the AI algorithm is complex. The FCA and the Bank of England have tried this approach too. A complex model using several decision trees to identify high risk mortgages had to be explained. The solution was to create an explainability algorithm to present the decisions of the black box machine. The pace at which startups are creating new solutions makes it harder for service providers. In recent times I have come across two firms who help banks with credit decisions. The first firm collected 1000s of data points about the consumer requesting for a loan. One of the points was the fonts installed on the borrowers laptop. If the fonts were used in gambling websites, the credit worthiness of the borrower took a hit. As the font installed indicated gambling habits, the user demonstrated habits that could lead to poor money management. The second firm had a chatbot that had a conversation with the borrower and using psychometric analysis came up with a score. The score would indicate the “intention to repay” of the customer. This could be a big opportunity for banks to use in emerging markets.

Foundations Of Business Architecture

The work of creating and defining a business architecture is not meant as an academic exercise. A business architecture is based on the organization’s business strategy. The business architecture positions the organization to operate efficiently in pursuit of its goals. As defined, a business venture is about creating value. Value is demonstrated in the form of corporate profits or in returns to owners and shareholders. Corporate goals tend to be high-level and wide. Organizations use various processes and methods for capturing and documenting the corporate goals. The method used in capturing the corporate goals is less important than having the discipline, structure, and communication methods to support the creation and dissemination of the corporate goals across the entire organization. Used most effectively, corporate goals are developed within the context of a larger enterprise wide strategic planning function. Often, the process is used in creating the organization’s data strategy, which may occur during enterprise architecture planning.

The Pipeline Driven Organization - Enabling True Continuous Delivery

"Pipeline driven" means we want to rely more and more on pipelines to make technical decisions (judgements) related to the code and its associated artifacts, and then have the pipeline immediately act based on those decisions as autonomously as possible. ... Continuous Delivery is a software engineering approach in which teams produce software in short cycles, ensuring that the software can be reliably released at any time. I believe that the key to succeeding with continuous delivery is to remove human bottlenecks from the chain of tactical decision making, and enable pipelines to work almost autonomously in deciding and pushing code around, all the way to production, without human fear and doubt getting in the way of receiving fast feedback about the way our code behaves. In order to be able to trust a pipeline enough so that we can rely on its decisions, we need to start teaching our software pipelines to make those tactical judgements without needing humans in the process.

5 Tips for Agile Testing

When both of the teams cooperate closely, they clearly understand the functional requirements of the software even if user stories are described superficially. The developers distribute the tasks to be performed and the order of passing the results to software testing engineers. At this time, the QA specialists start preparing test documentation and clarifying technical issues with the developers.Why is it important? By following the above-mentioned process, you can prevent errors earlier in the development, improve the code quality, and reduce the number of defects. ... According to the Scrum Guide, it should be an external specialist who will have control over the Scrum processes finding out the gaps and detecting all possible risks. Most often, a manager performs this function. Nevertheless, whomever is a Scrum Master on the project – a QA engineer or a developer – the person should be able to smoothly switch the role and carry out appropriate duties. With practice, even experienced software testing engineers with managerial skills successfully coped with this role.

How one bank is using AI, big data and chatbots to create new services

Simon McNamara, chief administrative officer at RBS Group, was brought into the bank in the wake of that episode in September 2013. He says the very reason he was brought into his job was that the executive team believed he was the person to "fix" the bank's IT systems and to create resilience. McNamara refers to "material progress" in regard to achieving that resiliency. It's provided a platform for him and his colleagues to face the challenge of digital disruption in the banking sector head on. In fact, pushing an innovation agenda has been one of his key aims since the day he started – yet it was something that some of his executive peers were reticent should be a focus when he first joined the bank in 2013. "I was actually told by some people that you're not going to be able to do that," says McNamara. "Some people said I was here to fix things and should forget about innovation. And that's literally where we started – and I'm somewhat proud of actually ignoring that advice and building an innovation agenda here, which is second to none in the UK in terms of any financial institution."

Why do 87% of data science projects never make it into production?

“It’s broken because nobody owned it, we didn’t have the data science team to be able to continually iterate on the models, think of it as an asset, and have data operations making sure it’s working well,” Chapo said. “We’re starting to bring those ways of working to life. But it’s hard, because can’t just do it all overnight.” “One of the biggest opportunities for all of us today is to figure out how we educate the business leaders across the organization,” Leff said. “Before, a leader didn’t need to necessarily know what the data scientist was doing. Now, the data scientist has stepped into the forefront, and it’s actually really important that business leaders understand these concepts.” AI is not going to replace managers, she adds, but managers who use AI are going to replace those who don’t. We’re starting to see that awakening of business leaders wanting to understand how machine learning works, and what AI really means for them, and how to leverage it successfully. And those leaders are going to be the most in demand, Leff said. Another essential key to success, Chapo added, is keeping it simple.

As FTC cracks down, data ethics is now a strategic business weapon

To weave ethics into the very fabric of their business strategies and tech systems, startups should adopt “agile” data governance systems. Often combining law and technology, these systems will become a key weapon of data-centric Third Wave startups to beat incumbents in their field. Established, highly-regulated incumbents often use slow and unsystematic data compliance workflows, operated manually by armies of lawyers and technology personnel. Agile data governance systems, in contrast, simplify both these workflows and the use of cutting-edge privacy tools, allowing resource-poor startups both to protect their customers better and to improve their services. In fact, 47% of customers are willing to switch to startups that protect their sensitive data better. Yet 80% of customers highly value more convenience and better service. By using agile data governance, startups can balance protection and improvement. Ultimately, they gain a strategic advantage by obtaining more data, cultivating more loyalty, and being more resilient to inevitable data mishaps.

Will Cyberattacks Lead to Prolonged Conflicts?

"We need to separate what is happening with corporations, where the news is relatively good because the technologies are getting better and it is now possible if you spend enough to defend yourself," says Clarke, a former adviser on intelligence and counterterrorism in three presidential administrations. "We need to separate that good news from the bad news that governments are behaving badly - governments are engaging in increasing cyberattacks and boasting about it." In an interview with Information Security Media Group, Clarke says he's concerned that more cyberattacks of a sufficient gravity will lead to kinetic responses and prolonged conflicts. "We actually have had a government engage in a conventional or kinetic attack because of cyberattacks - the Israelis, frustrated by the cyberattacks on them by Hamas, flew F-16s and bombed the Hamas cyber facility," he points out. Clarke and Knake believe that the key to dealing with future cyberthreats can be distilled to a single word: resilience. 

Data Governance Program Team Structure

The need for business data stewards, both the lead business stewards and the line data stewards, is especially important in an incremental approach to data governance. Using this method, the organization usually establishes one or two data stewardship teams to address specific data-related challenges with the support of the small Data Governance Program team, after they are trained in data governance and data stewardship concepts. The data stewards may be asked to support the DG program team in writing policies that apply to their specific issue – and that will be expanded to include the organization in general – under the approval of the Data Governance Council. Additional data stewardship teams should be enacted according to a schedule developed by the DG Program team and the DG Council, for projects identified by the DG Council. This schedule should be assertive, to maintain program momentum and to retain interest across the organization in data governance and data stewardship, while demonstrating value. In the starting projects, and perhaps with smaller organizations, the data stewardship teams may consist of a lead business data steward and one to three line business data stewards, based on the organization’s subject areas.

Q&A on the Book Virtual Leadership

It’s for those who lead virtual teams and those who are part of virtual teams. Even if you don’t consider yourself a leader, you will be able to make a lasting difference in the quality of your virtual work through developing your own virtual leadership. Do you strive to work well with people spread around the globe, or even just around your locality? Do you wonder how to overcome the challenges and frustrations of virtual working? Do you want to see real and lasting benefits for your organization through your virtual work and that of your colleagues? If so, I wrote the book for you, whatever your role and whatever type of organization you work within. Of course, InfoQ caters to the software development community, and readers say that there is a lot in it that is really helpful there. While you are likely to be incredible with technology, it takes more than technology to make virtual teams work well! My background was as a software engineer initially, and many of the case studies are from situations involving IT.

---

Quote for the day:

"You may not control all the events that happen to you, but you can decide not to be reduced by them." -- Maya Angelou

---

Daily Tech Digest - July 19, 2019

How edge computing is driving a new era of CDN

It’s not that long ago that there was a transition from the heavy physical monolithic architecture to the agile cloud. But all that really happened was the transition from the physical appliance to a virtual cloud-based appliance. Maybe now is the time that we should ask, is this the future that we really want? One of the main issues in introducing edge applications is the mindset. It is challenging to convince yourself or your peers that the infrastructure you have spent all your time working on and investing in is not the best way forward for your business.  Although the cloud has created a big buzz, just because you migrate to the cloud does not mean that your applications will run faster. In fact, all you are really doing is abstracting the physical pieces of the architecture and paying someone else to manage it. The cloud has, however, opened the door for the edge application conversation. We have already taken the first step to the cloud and now it's time to make the second move. Basically, when you think about edge applications: its simplicity is a programmable CDN. A CDN is an edge application and an edge application is a superset of what your CDN is doing.

Despite BlueKeep Warnings, Many Organizations Fail to Patch

BlueKeep is a serious vulnerability that could enable attackers to compromise Remote Desktop Services in Windows, which enables access to networked computers via remote desktop protocol. Attackers who successfully exploit the flaw could gain full, remote access to a system, including the ability to create user accounts and give them full administrator privileges, as well as to execute any code. "The vulnerability requires no authentication and is regarded as 'wormable,' meaning that if it were successfully exploited it could be used by self-replicating malware to spread across the internet rapidly," security firm Sophos warns in a new report. "WannaCry and NotPetya used a similarly wormable flaw in Microsoft's SMB v1 to spread around the globe in a matter of hours." One saving grace - so far at least - is that security experts have yet to see any in-the-wild attacks that use BlueKeep. But until companies patch, they remain at risk. "Patching, or rather good cyber hygiene, is an integral component of every company's defense against cyberattacks," Raj Samani, chief scientist at McAfee, tells Information Security Media Group.

Microsoft gets boost in SaaS revenue and pushes Teams platform

The company said its Commercial Cloud business achieved annual revenue of $38bn, and grew by 39% in the quarter with revenue of $11bn, while its Intelligent Cloud business grew by 19% with revenue of $11.4bn. The company also reported growth of 23% in the number of commercial Office 365 seats and strong demand for Windows 10 among commercial PC manufacturers driven by end of support for Windows 7 in January 2020. Satya Nadella, chief executive officer of Microsoft, said: “Every day we work alongside our customers to help them build their own digital capability – innovating with them, creating new businesses with them, and earning their trust. This commitment to our customers’ success is resulting in larger, multi-year commercial cloud agreements and growing momentum across every layer of our technology stack.” During the earnings call, Nadella described Teams as Microsoft’s fastest-growing platform. “There is no question this last fiscal year has been an absolute breakout year for Teams in terms of both product innovation and, most importantly, at-scale deployment and usage,” he said.

Digital technologies and the future of geospatial data

Mapping an area correctly can be a painstaking responsibility, but it's easier with help from drones. They work especially well for geospatial analysis needs due to their maximum altitude capabilities of 400 feet and imaging technology that enables capturing ground image data in higher resolutions than satellites or planes. The versatility of drones makes them fantastic for a wide range of mapping projects. For example, a retail brand might use a drone to get details about terrain in the potential location of a new retail store. Then, construction companies can do something similar by factoring drone mapping data into their plans as new buildings or renovations get underway. One of the main reasons why drones are such a hot topic now is because people associate them with the rapid delivery of things they order from e-commerce stores. Although drones do make things more convenient that way, they are also used when companies plan the most efficient distribution routes. Geospatial mapping data offers information to e-commerce enterprises, whether people receive their shipments with drones or through other means.

Does net neutrality still matter in our post-web world?

When the phrase was coined, it was in the context of a debate in the US Congress over the idea of a possible nationwide license for broadband service providers. States and municipalities were responsible for granting such licenses to limited geographies, and Republicans in the House were looking for new sources of revenue. Under the provisions of a never-passed law called the COPE Act, ISPs would be given incentives to purchase nationwide licenses instead of more localized ones. One such incentive was a waiver of enforcement of any laws or regulations restricting ISPs' right to divide their pipelines into "good/better/best" service tiers. There was substantive opposition, but Sen. Ron Wyden (D – Oregon) raised the stakes to a moral issue. At issue, he argued, was the small publisher's and garage-based enterprise's right to conduct their business on the same Internet like Google and eBay, as equal players in a digital market. Politically speaking, the concept of net neutrality has been as malleable as sediment from an Oregon mudslide.

Is SQL Beating NoSQL?

What we need is an interface that allows pieces of this stack to communicate with one another. Ideally, something already standardized in the industry. Something that would allow us to swap in/out various layers with minimal friction. That is the power of SQL. Like IP, SQL is a universal interface. But SQL is in fact much more than IP. Because data also gets analyzed by humans. And true to the purpose that SQL’s creators initially assigned to it, SQL is readable. Is SQL perfect? No, but it is the language that most of us in the community know. And while there are already engineers out there working on a more natural language-oriented interface, what will those systems then connect to? SQL. ... SQL is back. Not just because writing glue code to kludge together NoSQL tools is annoying. Not just because retraining workforces to learn a myriad of new languages is hard. Not just because standards can be a good thing. But also because the world is filled with data. It surrounds us, binds us. At first, we relied on our human senses and sensory nervous systems to process it.

Container security improves overall enterprise IT posture  

Once apps reach the production Kubernetes environment, security policies enforced through Aqua allow all developers and IT ops pros read-only access to their activities. This improves and speeds up application development, and lets IT pros troubleshoot faster than they could with VMs -- in the past, Recurly's security staff more carefully restricted such access without automated whitelisting tools available for containers. Also, since containers separate application processes from the underlying host, admins can more strictly lock down the host itself with tools such as Google's Container-Optimized OS. "We are heavily running immutable hosts today, so even if you break out of a container and get on a host, good luck," Hosman said. "You can't run anything, install anything, or pivot to anything, and if we restart the host, everything just resets." Recurly's goal is to move away from human responses to alerts, whether they refer to IT monitoring or container security issues, and toward a remediation response to issues through code.

Microservices: Myth, Madness, or Magic?

The reality is, you almost always don't need microservices to achieve the above "holy grail", you just need a decent architecture. So let's redefine microservices: Microservices: Yet another concept to fix the bad architecture created by bad software developers and to make money for big businesses that feed on the bad software practices of others. An article on Medium writes "Conceptually, Microservices extend the same principles that engineers have employed for decades."2 Wrong. These principles have existed for decades, but "employed?" Hardly ever. Similarly, a post on New Relic states: "When using microservices, you isolate software functionality into multiple independent modules that are individually responsible for performing precisely defined, standalone tasks. These modules communicate with each other through simple, universally accessible application programming interfaces (APIs)."3 Wait, we need microservices to achieve this? Wasn't this the promise of OOP? Isn't this the promise of every newfangled framework like MVVM, Angular, and so forth?

Microsoft to explore using Rust

"A developer's core job is not to worry about security but to do feature work," Thomas said. "Rather than investing in more and more tools and training and vulnerability fixes, what about a development language where they can't introduce memory safety issues into their feature work in the first place? That would help both the feature developers and the security engineers-and the customers." Microsoft looking into Rust, as a safer alternative to C++ isn't actually such a big deal. The OS maker has been looking for safer C and C++ alternatives for years. In June 2016, Microsoft open-sourced "Checked C," an extension to the C programming language that brought new features to address a series of security-related issues. Microsoft looking into Rust before any other memory-safe language is also not a bad decision. Besides being superior to C# in regards to better memory protections, Rust is also more popular with developers these days and might be easier to recruit for. ... Developers love it because of its simpler syntax and the fact that apps coded in Rust don't yield the same amount of bugs, allowing developers to focus on expanding their apps, instead of doing constant maintenance work.

Data governance in the age of AI: Beyond the basics

Ensure governance team members have defined roles, including tactical and high-level strategy responsibilities, Smithson says. Split data champions into two groups: data stewards, who make recommendations about formulas or algorithms, for example, and director- or VP-level data owners who make the decisions, Walton adds. And put roles and responsibilities into job descriptions. “The job responsibilities come from the workflows and the tasks that need to be accomplished.” Those job descriptions should fall into two buckets, he says: data quality assurance and information consistency. For the former, tasks include identifying a data quality issue, remediating that issue with a workflow change, for example, and monitoring to ensure the effectiveness of the data governance initiative. For the latter, tasks include creating a business measure to support key performance indicators, to modify it when business rules change, and to sunset any items that are no longer relative. A bonus tip: Tie data owners’ bonuses to data quality. “That will get people’s attention,” Walton says.

---

Quote for the day:

"Leadership is the art of giving people a platform for spreading ideas that work." -- Seth Godin

---