Daily Tech Digest - August 05, 2019

Is your enterprise software committing security malpractice?

An analytics firm called ExtraHop examined the networks of its customers and found that their security and analytic software was quietly uploading information to servers outside of the customer's network. The company issued a report and warning last week. ExtraHop deliberately chose not to name names in its four examples of enterprise security tools that were sending out data without warning the customer or user. A spokesperson for the company told me via email, “ExtraHop wants the focus of the report to be the trend, which we have observed on multiple occasions and find alarming. Focusing on a specific group would detract from the broader point that this important issue requires more attention from enterprises.” ... In every case, ExtraHop provided evidence that the software was transmitting data offsite. In one case, a company noticed that approximately every 30 minutes, a network-connected device was sending UDP traffic out to a known bad IP address. The device in question was a Chinese-made security camera that was phoning home to a known ​malicious IP address​ with ties to China.

DevOps and Cloud Mean the End of QA as You Know It

Continuous Testing is commonly lumped together with “shift left.” However, to deliver the right feedback to the right stakeholder at the right time, Continuous Testing needs to occur throughout the software delivery lifecycle – and even beyond that to production (e.g., monitoring information from production and feeding that back from the quality perspective). Just as the name indicates, Continuous Testing involves testing continuously. Simply starting and finishing testing earlier is not, by definition, Continuous Testing. How do you reach this level of continuous quality and Continuous Testing? The path forward is different for every team. Some might focus on automating traditionally manual processes while others might wrestle with orchestrating and correlating all the various test automation tools they’ve come to master. The challenge is getting to the point where you can report on whether an overarching application or project involving all these different teams – with different cadences, architectures, tool stacks, structures, and challenges – has an acceptable level of risk.

Most UK university applicants at risk of email fraud

Setting Dmarc policies to “reject” is the only guaranteed way of preventing email spoofing, which has long been blamed for fraud victims being duped by social engineering techniques. Opting to set to set the policy to “none” will merely alert the domain owner of potentially suspicious activity, but will warn not the recipient of fraudulent emails. Setting the policy to “quarantine” also notifies the domain owner and potentially offers some protection by sending the email to “spam” or “junk” folders, but the result depends on the delivery policy of the email provider and therefore does not provide guaranteed protection.  This means in the run up to the announcement of A-level results on 15 August 2019 and immediately thereafter, the majority of those communicating with universities about course placements could be targeted by fraudsters with emails that appear to come from universities.

GAO Blasts Cybersecurity Efforts of Federal Agencies

The GAO undertook the study to not only determine to what extent the agencies had instituted key elements of a risk management program, but also to find out what challenges these agencies were facing in putting those elements in place. The study also reviewed steps the Office of Management and Budget and the Department of Homeland Security have taken to address their risk management responsibilities. Investigators found was that while all but one agency - the General Services Administration - had installed a cybersecurity risk executive, 16 agencies had not fully established a cybersecurity risk management strategy that outlined boundaries for risk-based decisions. "The risks to IT systems supporting the federal government and the nation's critical infrastructure are increasing as security threats continue to evolve and become more sophisticated," according to the GAO report. "These risks include insider threats from witting or unwitting employees, escalating and emerging threats from around the globe, steady advances in the sophistication of attack technology, and the emergence of new and more destructive attacks. ..."

The Balance Of Power: Self-Service And IT

To prepare data you need to hold an analytic purpose in mind, however tentatively formed. Otherwise you’re not even experimenting or exploring, you’re just playing. Equally, to analyze data is investigate not only its aggregations and patterns, but its structure too. And the more you learn about the structure of data, the more you might tweak it, reshape it, indeed wrangle it to reveal more patterns. Whether you are comparing start and end dates of a process to analyze an elapsed time, or arranging demographic data sets into appropriate age-groups to find useful correlations, or simply concatenating name fields to create a more useful identifier, the distinction between analyzing and wrangling is a weak one; especially so with self-service technologies, because rather than being a cumbersome exchange of requirements between business and IT, this new, empowered analysis typically happens on the desktop of one savvy, and satisfied, business user.

Lack of resources top challenge to IT security

After a lack of resources, respondents cited a lack of experience as their top challenge (37%), followed by a lack of skills (31%). Ultimately, security professionals feel their budgets are not giving them what they need, the survey report said, with only 11% saying security budgets were rising in line with, or ahead of, the cyber security threat level, while the majority (52%) said budgets were rising, but not fast enough. Asked about the source of cyber security threats, 75% said people are the biggest challenge they face in cyber security, followed by processes (12%) and technology (13%). This may explain the need for more resources even as budgets increase, the report said, noting that the people issue is a far more complex one to deal with. Yet at the same time, the report said there are signs of improvement, with more than 60% of IT professionals saying that the profession is getting better – or much better – at dealing with security incidents when they occur, and only 7% saying the profession is getting worse.

FaceApp's Real Score: A Mathematical Face Feature Set

The accusation was debunked. And FaceApp tried to provide reassurance by saying it discards most photos within 48 hours despite its permissive privacy policy. And while there's been a lot of digging, nothing has surfaced to indicate there's anything more nefarious going on. But it's not the photos themselves that are necessarily what's most valuable to Wireless Labs, the Russian company behind FaceApp. It's the mathematical data describing faces that's derived from the photos, which these days is highly sought after information. How FaceApp works is still very much a black box in a cloud computer. Wireless Labs' founder Yaroslav Goncharov told a Russian publication two years ago he became interested in neural networks - that is, training computers to work in ways that mimic the human brain - during a three-year stint at Microsoft. Facial manipulation and recognition technology is progressing rapidly, and there are shortcut ways to do what FaceApp is doing. One academic paper describes a simplified way to age people or add smiles or glasses that doesn't involve deep neural training.

Remote code execution is possible by exploiting flaws in Vxworks

The vulnerabilities affect all devices running VxWorks version 6.5 and later with the exception of VxWorks 7, issued July 19, which patches the flaws. That means the attack windows may have been open for more than 13 years. Armis Labs said that affected devices included SCADA controllers, patient monitors, MRI machines, VOIP phones and even network firewalls, specifying that users in the medical and industrial fields should be particularly quick about patching the software. Thanks to remote-code-execution vulnerabilities, unpatched devices can be compromised by a maliciously crafted IP packet that doesn’t need device-specific tailoring, and every vulnerable device on a given network can be targeted more or less simultaneously. The Armis researchers said that, because the most severe of the issues targets “esoteric parts of the TCP/IP stack that are almost never used by legitimate applications,” specific rules for the open source Snort security framework can be imposed to detect exploits. VxWorks, which has been in use since the 1980s, is a popular real-time OS, used in industrial, medical and many other applications that require extremely low latency and response time.

Scrum & The Toyota Production System, Build Ultra-Powerful Teams

Scrum is a rhythmic planning method. It is opposed to the traditional batch type approach considering that the construction of a computer system requires to have first completed its analysis before proceeding to the development then the tests. This very cumbersome and costly approach has left many projects deadlocked. On the contrary, Scrum breaks this model by cutting out the construction of the product in small batches called sprints. During a sprint, the team analyzes, develops and tests what the client considers most valuable to him. A sprint lasts between 1 to 4 weeks. At the end of the sprint, during the sprint review, an increment of the product is presented to the customer who can thus quickly provide his feedback. The team corrects and adapts the product sprint after sprint and according to customer. Gradually the product takes shape. In addition to this ongoing adaptation to customer needs, Scrum provides a formal structure for improving team practices by introducing the notion of retrospective. It's a special moment at the end of the sprint during which the team looks back on its practices to improve them in the next sprint.

The lean CDO: why it’s time to develop a minimum viable data product

“This shift to product-centric delivery models entails co-locating CDOs into business units and strives for constant improvement rather than siloed project metrics,” continued Faria. Bill Swanton, distinguished research VP at Gartner, added that this shift towards product-centric application models didn’t come about randomly. It goes hand-in-hand with the adoption of agile development methodologies and DevOps. “Business leaders are generally unhappy with the speed with which they get application improvements and how they work. Given that no IT organisation gets anywhere near enough funding to do everything everyone wants when they want it, product-centric approaches allow faster delivery of the most important capabilities needed,” he said. According to Gartner, in a product line management model, product lines are funded based on the business capabilities they support. Common or shared capabilities — such as infrastructure, technology, D&A — are funded based on the anticipated and aggregated needs of the product lines they support.

---

Quote for the day:

"A leader should demonstrate his thoughts and opinions through his actions, not through his words." -- Jack Weatherford

---

Daily Tech Digest - August 04, 2019

A strategist’s guide to upskilling

Upskilling is not the same as reskilling, a term associated with short-term efforts undertaken for specific groups (for example, retraining steelworkers in air-conditioning repair or locksmithing). Reskilling doesn’t help much if there are too few well-paying jobs available for the retrained employees. An upskilling effort, by contrast, is a comprehensive initiative to convert applicable knowledge into productive results — not just to have people meet classroom requirements, but to have them move into new jobs and excel at them. It involves identifying the skills that will be most valuable in the future, the businesses that will need them, the people who need work and could plausibly gain those skills, and the training and technology-enabled learning that could help them — and then putting all these elements together. To someone accustomed to current forms of workforce training, in which resources are constrained and companies generally operate independently of one another, an upskilling initiative might seem massive and unaffordable.

Are CIOs truly prepared for the next economic downturn?

Moving responsibilities can take time and is disruptive to the overall operation of the IT organization. Multiply that by many individuals and one can quickly see how disruptive organizational changes can be to their culture. Organizational moral drops and added energy must be inserted to stabilize the remaining organization to ensure consistent operations. To prepare for the next decline, organizations must consider a more flexible organizational model that accommodates cross-functional knowledge while breaking down the silos. Focus on functions and parts of the organization that would remain should a dip occur. These functions should include those most directly tied to the intellectual property and critical functions of the company. Use contingent labor or outsourcing agreements to augment additional areas. Contingent labor allows for the ability to scale up or down as demand changes. The second aspect is to avoid long-term commitments. Look out for hard commitments that would limit flexibility to change contracts. Examples include contingent labor, outsourcing, licensing and spending thresholds. Negotiate contract options with flexibility should an economic decline hit. Vendors will be reluctant to agree to this language in their contract. Consider a compromise where commitments are made but have out-clauses should negative economic conditions prevail.

What is the CCPA and why should you care?

With every new law, regulation or standard, there are the details that one must comply with, in addition to repercussions of those issues. That alone could fill a few articles.  One of those areas to consider is if your insurance policies will protect you for CCPA related issues. CCPA has a major effect in that area, and some of the areas you need to get your insurance department involved in, which includes professional liability/E&O, directors & officer’s policies, cyber-insurance, employment practices liability, and other areas. A part of your CCPA readiness assessment, ensure that all of the areas where CCPA can impact are identified and brought up to compliance. Like the state, CCPA is huge. Read the details and it’s easy to see that CCPA requires firms to make major infrastructure changes. CCPA mandates a significant amount of new processes around data collection. It requires significant reengineering and rearchitecture how personal data is handled. And like the mountain of the same name in California, CCPA is mammoth. If you think you are in scope for CCPA, take a few days to read everything you can on the topic. The more educated you are about the act, the better you can deal with it. 

The Military-Style Surveillance Technology Being Tested in American Cities

When it comes to law enforcement, police are likewise free to use aerial surveillance without a warrant or special permission. Under current privacy law, these operations are just as legal as policing practices whereby an officer spots unlawful activity while walking or driving through a neighborhood. Say an officer sees marijuana plants through the open window of a house. Because the officer is in a public space—a road or sidewalk—he or she doesn’t need permission to see the illicit plants, or a warrant to photograph the scene. The only caveat to police aerial-surveillance activities is that they must employ publicly accessible technology, a term that has been defined, somewhat vaguely, in a small number of court cases. In two cases from the 1980s stemming from investigations in which police used cameras aboard helicopters to spot marijuana plants, the Supreme Court ruled that the law-enforcement agencies had not violated the Fourth Amendment, because both helicopters and commercial cameras are generally publicly available.

How AI can support cybersecurity leaders

Humans consume and process information through reading, watching, and participating in discussions. In a similar manner, AI can be used to train computers in the “language of security” using techniques such as large-scale natural language processing (NLP). This greatly helps in harvesting cybersecurity information to help security analysts work more efficiently and faster. AI and analytics enable a Security Orchestration to automatically block threats, correct problems, respond to attacks and automate low level alerts based upon prior examples or similar historical threats. But it doesn’t stop there – in addition to responding faster, AI can be used as a trusted advisor, capable of offering best practice recommendations. For example, AI can be used to take automatic action when a risky user is detected by either verifying the user and/or suspending the user. It can help reduce the time for the access certification process by providing guidance on risk, taking automatic action on low risk certification and allowing the security personnel to focus on high risk access certifications.  

A dismal industry: The unsustainable burden of cybersecurity

the way to improve security is to make the company boards accountable, and they will pressure the executives to take the right steps -- in a similar way that the Sarbanes-Oxley legislation made directors accountable for company financial reports. However, a lot of companies had trouble finding board members following Sarbanes-Oxley. This could happen again if board members are made accountable for cybersecurity breaches, which seems like an impossible task given the media coverage of larger, more disturbing attacks. Fear, uncertainty, and disaster is a traditional marketing tactic in the IT industry, and cybersecurity companies are happy to focus on the dire need for more spending on their wares and their services.  The scare tactics have been effective, with significant rises in cybersecurity budgets of around 15% annually, says Rothrock. But this takes away money from other IT projects -- projects that could improve revenues. It's an ever-larger black hole of money and human resources that cannot be invested in productivity.

Today's AI 'Revolution' Is More Of An Evolution

The brittleness of today’s systems means companies must also devote considerable resources towards understanding the situations under which they may fail and constructing the necessary cushioning to minimize the impact of such failures on the applications themselves. This can take the form of hand-coded rulesets for the most mission-critical decisions or combining deep learning and classical models, with special handling of cases in which the two diverge beyond a certain threshold. Despite these limitations, deep learning is finding no shortage of applications in the enterprise, automating many tasks that had historically been strongly resistant to codification due to their noisy data, complex patterns or multimedia source data. Yet these applications are typically located outside of the limelight. In contrast to the splashy research demonstrations playing video games or teaching robots how to learn to walk, production deployments today tend to be far more mundane and located in less visible places, from image filtering to chat bots to routing systems. Each deployment displaces human workers that once filled those jobs or reduces the need to hire new workers, but its introduction is typically little publicized and little noticed outside those it immediately effects.

Whistleblower vindicated in Cisco cybersecurity case

The exploit Glenn, 42, discovered would have given an attacker full administrative access to the software that managed video feeds, letting them be monitored from a single location, the lawsuit says. It could also potentially allow unauthorized access to sensitive connected systems. That meant an intruder might have taken control of or bypassed physical security systems such as locks and fire alarms, which are regularly connected to camera systems. "An unauthorized user could effectively shut down an entire airport by taking control of all security cameras and turning them off," the suit says. Airports affected included Los Angeles International and Chicago's Midway, it says. "You could penetrate the entire system. And you could do that without any trace. And have complete backdoor access to the system whenever you wanted," said Michael Ronickher, an attorney representing Glenn with the firm Constantine Cannon LLP.

Trading Strategies Using Deep Reinforcement Learning

Reinforcement learning (RL) is about taking suitable action to maximize reward in a particular situation. It is employed by various software and machines to find the best possible behavior or path it should take in a specific situation. Reinforcement learning differs from supervised learning because, in supervised learning, the training data has the answer key with it so the model is trained with the correct answer itself, whereas in reinforcement learning, there is no answer, but the reinforcement agent decides what to do to perform the given task. In the absence of a training dataset, it is bound to learn from its experience. RL refers to a goal-oriented algorithm, that is, algorithms that seek to achieve a complex objective or to maximize the reward through a sequence of steps, such as obtaining the highest score in an Atari game. The elements that conform to this approach are states, a reward function, actions, and an environment in which the agent interacts. Deep Reinforcement Learning is essentially the combination of deep neural networks and reinforcement learning. In this case, we speak of a special type called Q-Learning.

How IoT is revolutionizing facilities data management

It is important to note, however, that data gathered by IoT can accumulate quickly, which can be a double-edged sword. The point of IoT is to be able to analyze all this accumulated data and generate meaningful insights from them. That’s what puts the “smart” in smart technologies. But at unfathomable levels of data that IoT devices are expected to generate, this is easier said than done. This is both the challenge and opportunity for facilities managers who are dealing more and more with IoT-enabled smart buildings and equipment within their operations.When used to collect facilities-related data – such as equipment outputs, electrical consumption, or asset function, for instance – large volumes and varieties of information are sent rapidly to central, Internet-based hubs. Without the proper infrastructure in place, it’s easy for these datasets to become siloed and rendered difficult to utilize. Therefore, rethinking how both how your data is stored and how it’s analyzed is a central requirement if you plan to implement IoT as part of your facilities management analytics strategy.

---

Quote for the day:

"Leadership is about carrying on when everyone else has given up" -- Gordon Tredgold

---

Daily Tech Digest - August 02, 2019

Digital Transformation: Are you digitally distraught or digitally determined?

Online orders are rarely a roadblock in B2B sales. The challenge of self-service lies in presenting complex product information and pricing in a system that’s fast, intuitive and capable of recommending the best solutions for a given customer. Businesses often buy products from manufacturers with varied configurations, order sizes and contract terms. Seemingly similar deals can vary in significant ways, and market prices in B2B aren’t always visible. Nonetheless, buyers expect to find pricing information as easily as they might look up product specs online. ... An online B2B purchase is likely to involve pricing algorithms, product databases, chatbots, market data, automated email and detailed customer profiles built across marketing, sales and support. AI can help instantly identify the optimal next steps for customers by analysing thousands of data points gathered during this process. Customers already expect companies like Netflix and Amazon to anticipate what they need. The same will soon be true of product configurations, add-ons and services. As online transactions become the majority of manufacturers sales, successful implementation of AI will become critical to success.

How industry cloud technology is changing healthcare

There is a role for both large providers and smaller ones to help the healthcare sector make the digital transition. Large cloud computing providers have superior computing power, but not the industry expertise and dedicated support to work with healthcare clients, according to Gartner analysts Gregor Petri and Anurag Gupta. This creates a significant opportunity for managed service provider partners. Smaller cloud computing providers can work with Amazon and Microsoft to build and deliver services while establishing direct relationships with healthcare stakeholders. Smaller providers also can help with implementation and ongoing management of cloud-based applications. In addition, these providers can use HIPAA expertise to satisfy the regulatory requirements that healthcare providers must meet.  For Phil Misiowiec, the Chief Technology Officer of Healthcare Blocks, most of his clients already have a cloud strategy in place when they contact him. Systems being deployed to the Healthcare Blocks platform fall into one of three buckets, Misiowiec said

Why the road to 5G might be longer than expected

"From a consumer's perspective, there will certainly be a transition period," Mark McCaffrey, PwC's US technology, media, and telecommunications leader, told TechRepublic. "We won't simply go from 4G/LTE to 5G overnight and a 5G network won't necessarily be maximized with a device meant for 4G. And as 5G is a new technology, we can expect there to be bugs and glitches that need to be worked out along the way."  Creating a 5G network comes with a whole new set of roadblocks that didn't exist when creating 4G, according to the report. This higher density network brings regulatory, cost, and operational challenges.  "The biggest hurdles to 5G are simply logistical ones. To get to the point of widespread adoption on any scale, we must solve regulatory and infrastructure issues," said McCaffrey. "Each federal, state and local community may have unique requirements in its deployment of 5G. All carriers and equipment manufacturers will need to develop their own path to 5G deployment that meets the regulatory requirements including cybersecurity."  5G implementation also requires hundreds of thousands of small cells to be installed across the country, which calls for large bands of spectrum that aren't yet available, the report found.

Five examples of user-centered bank fraud

SMS swapping has become quite common in the banking industry. First, the attacker steals a victim’s private phone number, along with the phone’s Security ID. Then the attacker calls the SIM card call center claiming they lost their phone, have bought a new SIM card and now need to get their old number back. Using the Security ID and other private information, possibly gathered from snooping on social media accounts, they convince the telecommunication support person to perform the phone swap. This scam can even evade security protections. Most banking institutions that offer multi-factor authentication (MFA) to protect online banking sessions and applications rely on SMS-based MFA instead of using mobile tokens. Once hackers steal people’s phone numbers, they have access to these SMS messages. That means they can access the victim’s account even if it has SMS-based MFA in place. Another old but effective tactic is the Man In-The-Middle (MITM) attack, in which attackers target banking platforms that do not adequately protect their infrastructure. This not only allows hackers to steal money, but also negatively affects the bank’s reputation by making their infrastructure seem fragile and vulnerable.

Managing machine learning in the enterprise: Lessons from banking and health care

There have been many examples of seemingly well-prepared financial institutions caught off-guard by rogue units or rogue traders who weren’t properly accounted for in risk models. To that end, SR 11-7 recommends that financial institutions consider risk from individualmodels as well as aggregate risks that stem from model interactions and dependencies. Many ML teams have not started to think of tools and processes for managing risks stemming from the simultaneous deployment of multiple models, but it’s clear that many applications will require this sort of planning and thinking. Health care is another highly regulated industry that AI is rapidly changing. Earlier this year, the U.S. FDA took a big step forward by publishing a Proposed Regulatory Framework for Modifications to AI/ML Based Software as a Medical Device. The document starts by stating that “the traditional paradigm of medical device regulation was not designed for adaptive AI/ML technologies, which have the potential to adapt and optimize device performance in real time to continuously improve health care for patients.”

Black Hat: A Summer Break from the Mundane and Controllable

Security might be your job, but it's just one more additional thing for laypeople in your organization to worry about. Aside from clear mandates on the topic, compliance-driven requirements, or a recent "near-death" experience, most organizations are still balancing security needs with day-to-day pressing needs in order to win more customers and increase revenue. This is a good thing. Security is asking other people to improve the organization above and beyond what individual workers are held accountable for on a daily basis. It's important to understanding that this is the natural order and that security leaders are likely to encounter pushback on additional security controls. ... To make substantial progress on a security problem in a large 20,000-seat corporate environment you need technology. However, when the underlying risk decisions, business processes, and operations have not been addressed in a meaningful way, products only solve part of the problem and give security leaders a false sense of security. 

Visa Contactless Cards Vulnerable to Fraudsters: Report

Researchers Leigh-Anne Galloway and Tim Yunusov say they were able to manipulate two data fields that are exchanged between the card and the terminal during a contactless payment. This was done by using a proxy machine that manipulates the transaction data between the card and the payment gateway, essentially creating a man-in-the-middle attack, the researchers report. The researchers successfully tested a proxy machine with five U.K. banks, which they did not name. They discovered that the vulnerability is common to all Visa-issued contactless cards regardless of the bank and the locality of the person using the card, according to the blog. "Positive Technologies tested the attack with five major U.K. banks, successfully bypassing the U.K. contactless verification limit of £30 on all tested Visa cards, irrespective of the card terminal," the researchers note. The researchers say that an attack using the proxy machines can go through Google Pay by adding Visa to a digital wallet.

Cyber Warfare: Army Deploys 'Social Media Warfare' Division To Fight Russia

What's as interesting is the West's own use of the mainstream and social media to ensure that Russia and its proxies don't have it all their own way. We have always seen that battle for hearts and minds in the physical sphere. What we've started to see with news of cyberattacks on energy grids in Russia and command and control networks in Iran is the beginnings of the same in cyber. "State and non-state actors are continually seeking to gain an advantage in the grey zone that exists below the threshold of conventional conflict," as General Jones put it. And so, moving forward, you can expect much more of the same. "This restructuring is not the answer to everything," Ingram said, "and nor will or can it meet all current threats, but it is the first step in a journey and that first step gives a series of capabilities—and for the new division with psychological warfare in its structure, that rebranding is important in influencing future Army force development."

Self-organizing micro robots may soon swarm the industrial IoT

The robots already jump, and now they self-organize. The Swiss school’s PCB-with-legs robots, en masse, figure for themselves how many fellow microbots to recruit for a particular job. Additionally, the ad hoc, swarming and self-organizing nature of the group means it can’t fail catastrophically—substitute robots get marshalled and join the work environment as necessary. Ad hoc networks are the way to go for robots. One advantage to an ad hoc network in IoT is that one can distribute the sensors randomly, and the sensors, which are basically nodes, figure out how to communicate. Routers don’t get involved. The nodes sample to find out which other nodes are nearby, including how much bandwidth is needed. The concept works on the same principal as how a marketer samples public opinion by just asking a representative group what they think, not everyone. Ants, too, size their nests like that—they bump into other ants, never really counting all of their neighbors. It’s a strong networking concept for locations where the sensor can get moved inadvertently.

Your multicloud strategy is all wrong

Forced to choose, my guess is most enterprises want the higher-order services from particular clouds more than they want that portability across clouds. The latter may appeal to accounting, but the former appeals to the teams tasked with driving agility and innovation within an enterprise. If you had to pick one of those teams to appease, pick the developers. Every. Single. Time. However, siding with developers doesn’t mean that an enterprise needs to cede control of its IT to a vendor. Rather, by going deep with a vendor, not only does that enterprise put itself in a position to develop more expertise with that cloud, but it also sets itself up as a VIP with that cloud. Anyone who has worked in enterprise software knows that while “all animals are created equal,” following Animal Farm logic, “Some animals are more equal than others.” Vendors always tend to listen to their most committed customers, and that “commitment” isn’t merely a matter of money. The cloud vendors, like all enterprise IT vendors, will tend to partner with those customers who help them to push the envelope on innovation and publish success stories (case studies, conference keynotes, etc.).

---

Quote for the day:

"It is better to be hated for what you are than to be loved for what you are not." -- André Gide

---

Daily Tech Digest - August 01, 2019

Dealing with the Disconnect Between Developers and Security

Developers want to write secure code and catch vulnerabilities early on, Fletcher says, but they many not have the necessary skills or management support to focus on prioritizing security. “It is literally more work to do,” he says. There could be organizational challenges, for example, if development functions such as testing are handled in separate groups. Those different groups could have separate charters and mandates to adhere to. “They’re not necessarily working off of the same page at the data level,” Fletcher says. “It becomes difficult to create a symbiotic relationship needed to get to that DevSecOps nirvana.” The disparity is particularly pronounced given the pace of DevOps deployment, compared with non-DevOps software rollouts. The narrow window of time for delivery of DevOps applications can leave little room for security screening. Fletcher says continuous delivery and continuous integration, where DevOps applications are built and delivered in an ongoing basis, can mean deployment of code several times per day. That compares with non-DevOps generated applications that might be released quarterly or biannually.

How Blockchain-Based Digital Credentialing Impacts The World Of Work

New technologies like blockchain, along with advancements in mobile security, have enabled Workday to imagine a new form of digital credential—one that puts individuals in control of their data, and is portable, authentic, and secure. As credentials are issued by organizations and educational institutions, held by individuals, and shared with employers or prospective employers that need to verify them, blockchain provides a common trust layer, allowing each of these parties to independently verify their authenticity. As the common source of verification, blockchain enables data to move between parties, and its distributed ledger can prove that the data has not been modified and the credentials are still valid. This kind of credential creates a transparent, trustworthy, and reliable source of truth that is instantly authentic once shared. We are also taking this blockchain application one step further with our approach to openness. Technology is most powerful when it’s open and interoperable, and this is especially the case with blockchain.

5G enthusiasm abounds from tech CEOs: Is it warranted?

The enthusiasm about 5G is flowing out of earnings conference calls. The big question is whether it is justified. Aside from carriers touting their 5G build out, Qualcomm CEO Steve Mollenkopf said 5G will be deployed and with devices faster than expected. He said: We now have over one hundred fifty 5G designs launched or in-development using our 5G chipsets. In addition to core chipsets, virtually all our 5G design wins are powered by our complete RF Front-End solutions for 5G Sub6 and / or millimeter wave. By the first calendar quarter of 2020, we anticipate reaching the inflection point as our financial results begin to reflect the benefits of our substantial efforts over the years in to bring 5G to the market worldwide. Qualcomm's take revolves around China ramping 5G commercial service and US carriers all on track with nationwide 5G coverage by mid-2020. There will be more operators and devices launching with 5G relative to 4G in the same time frame, according Qualcomm. Samsung's conference call was also bullish on 5G. Samsung has multiple ways to play 5G with smartphones, networking gear, memory and chips that'll benefit. 

Hacking security alert issued for small planes, DHS warns modern flight systems are 'exploitable'

A security alert was issued by federal officials Tuesday focusing on small planes after authorities voiced concerns that modern flight systems are vulnerable to hacking in the event a malicious actor is able to gain physical access to the aircraft. The alert from the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency said that a security flaw of open electronics systems known as "the CAN bus" was discovered by a Boston-based cybersecurity company and reported to the federal government, which found the systems are "exploitable." "An attacker with physical access to the aircraft could attach a device to an avionics CAN bus that could be used to inject false data, resulting in incorrect readings in avionic equipment," CISA said in its alert. "The researchers have outlined that engine telemetry readings, compass and attitude data, altitude, airspeeds, and angle of attack could all be manipulated to provide false measurements to the pilot." Most airports have security officers in place to restrict unauthorized access.

Podcast: 'Know thy user' a key tenet of modern IT design

The first thing you have to do is know who your user is. If you don't know that, then any design work is going to fall short. And now the design work that systems at IT companies are delivering is not only delivered toward IT but also different contingents within their businesses. It might be developers who are in a LOB trying to create the next service or business application that enables their business to be successful. Again, if we look back, the CIO or leaders in IT in the past would have chosen a given platform, whether a database to standardize on or an application server. Nowadays, that's not what happens. Instead, the LOBs have choices. If they want to consume an open source project or use a service that someone else created, they have that choice. Now IT is in the position of having to provide a service that is on par, able to move quickly and efficiently, and meets the needs of developers and LOBs. And that's why it's so important for design to expand the users we are targeting.

A Realistic Path Forward for Security Orchestration and Automation

The idea of security orchestration and automation is itself "the shiny new thing on the block," Cavey says. However, investing in more technology to solve the problem of disparate tools not working in orchestration is not a silver bullet. Keeping infrastructure and data secure across the entire organization requires staffing, which is one reason why Cavey says he anticipates a number of failed implementations on the horizon. Many companies have unrealistic motivations when they are investing in these platforms, he says.  Those motivations are coming from the pain points an organization is feeling, according to Cavey: "There's incredible pressure coming down from the board for these security teams to be able to say, 'Tell us you have this; tell us we are in good shape. We have an interest in IT security and knowing that we as a company are not going to be the next headline.'" Take data loss prevention (DLP), for example. When introduced nearly a decade ago, DLP's promise to the average CISO was its implementation would protect data and prevent it from being stolen, Cavey explains.

Intent-Based Networking (IBN): Bridging the gap on network complexity

Undoubtedly, we need new tools, not just from the physical device’s perspective, but also from the traffic’s perspective. Verifying the manual way will not work anymore. We have 100s of bits in the packet, meaning the traffic could be performing numerous talks at one time. Hence, tracking the end-to-end flow is impossible using the human approach. When it comes to provisioning, CLI is the most common method used to make configuration changes. But it has many drawbacks. Firstly, it offers the wrong level of abstraction. It targets the human operator and there is no validation whether the engineers will follow the correct procedures. Also, the CLI languages are not standardized across multi-vendors. The industry reacted and introduced NETCONF. However, NETCONF has many inconsistencies across the vendor operating systems. Many use their own proprietary format, making it hard to write NETCONF applications across multiple vendor networks. NETCONF was basically meant to make the automation easy but in reality, the irregularities it presented actually made the automation even more difficult.

Learning lessons from the unicorns: the tech phenomena

In the UK, 17 companies have attained unicorn status to date. These include the digital bank, Monzo, which recently reached a milestone of 2 million customers and is launching in the US, and food delivery start-up, Deliveroo, which raised £452 million in a funding round last year and is currently valued at more than £1.5 billion. For private tech companies, an IPO strategy could be an attractive proposition, potentially delivering the funding boost needed to take the business into new markets or allow it to innovate and/or diversify its product or service offering. Instead of focusing purely on financial data to support the move, ambitious businesses pursuing this strategy might seek to emulate the unicorns by concentrating on developing a compelling growth story, based on metrics about user numbers and preferences or rapid take up in a new market. Of course, a clear business plan, which sets out where profits will come from in the future is also essential. Ambitious, fast-growing businesses are among those most likely to consider an IPO. 

15 signs you've been hacked -- and how to fight back

The best protection is to make sure you have good, reliable, tested, offlinebackups. Ransomware is gaining sophistication. The bad guys using malware are spending time in compromised enterprise environments figuring how to do the most damage, and that includes encrypting or corrupting your recent online backups. You are taking a risk if you don’t have good, tested, backups that are inaccessible to malicious intruders. If you belong to a file storage cloud service, it probably has backup copies of your data. Don’t be overly confident. Not all cloud storage services have the ability to recover from ransomware attacks, and some services don’t cover all file types. Consider contacting your cloud-based file service and explain your situation. Sometimes tech support can recover your files, and more of them, than you can yourself. Lastly, several websites may be able to help you recover your files without paying the ransom. Either they’ve figured out the shared secret encryption key or some other way to reverse-engineer the ransomware. You will need to identify the ransomware program and version you are facing.

BizDevOps tools await enterprise maturity

Splunk execs also firmly believe BizDevOps is where the market is headed, but said a majority of enterprise customers still struggle with it. "Many of our customers still deal with disjointed teams -- it's like DevSecOps, it's heading in that direction, but [BizDevOps] is probably not as close [to widespread adoption] as IT and security," said Tim Tully, CTO of Splunk. "The business side has to become more agile. People are seeing convergence in IT, and the world is evolving, and business has to evolve along with it." IT experts that consult with enterprise clients, however, said that evolution has been very slow so far. "We see organizations that want to close the gap between the IT perspective and business perspective of products. But that means addressing not just features, but defects, risks and debt, and what we see is companies double down on CI/CD" said Carmen DeArdo

---

Quote for the day:

"Great leaders go forward without stopping, remain firm without tiring and remain enthusiastic while growing" -- Reed Markham

---

Daily Tech Digest - July 31, 2019

The Power Of Purpose: The ROI Of Purpose

The impact of a purpose-driven initiative on the health of the brand is also another key area to be measured. The ‘silver bullet’ question which is most important is drawing a clear correlation between purpose and sales. However given the complexity of the purchase funnel, I believe that at the very least measuring ‘Purchase Intent’ (‘Does this initiative make you more or less likely to purchase this brand’) is the closest proxy. ... Often, one of the biggest upsides of purpose-driven initiatives is the effect it has on the employees of the company in terms of morale and motivation - not to mention recruiting new talent, especially Millennials and Gen-Z who are increasingly motivated by the opportunity to work for a company that creates meaningful social and environmental impact (leading to lower recruiting costs). While each company has its own metrics for measuring employee engagement, a common one worth measuring is the impact on turnover: Does the initiative make employees more or less likely to stay with the company? Benevity’s research shows that employees are 57% more likely to stay with a company which offers volunteering and fundraising opportunities, leading to significant cost reductions

Why CIOs should focus on trimming their internal email footprint

Reducing business’ reliance on email is just one part of a wider shift in the way companies need to operate going forward. Stanley Louw, UK and Ireland head of digital and innovation at Avanade, believes organisations need a strategy that is digital, not a digital strategy. “The way we have always provided IT for work is actually holding us back,” he said. “You have to apply the sample principles of customer experience to employee experience. What is the experience employees need to do their job? CIOs have to start partnering with HR.” But in Louw’s experience, IT departments still approach desktop IT from a pure IT perspective, which makes their approach to the desktop archaic, very much based in legacy approaches to desktop management. Industry momentum around focusing on customer experience has changed the way businesses look at their customer, he said, adding: “You also need to look internally and start by modernising platforms.”

Chief Integration Officer!

As organizations go for technology-leveraged strategic transformation, they expect technology to help them maximize business value, as an organization. This is different from better decision-making or operational efficiency or a specific new capability at a functional level. The whole value accrued to the organization must be more than the sum of parts. Someone needs to drive that.  That someone, for a very few selected organizations, is a dedicated Chief Digital Officer. But more than 95% of organizations do not have a CDO role; most of them do not intend to have one. Yet, they still need someone to put all the pieces together to create organizational value. That integration has to be done by someone who thoroughly understands technology and its direction as well as business. In most organizations, CIO is the best person to drive that role.  The reason why it has not happened so widely is not as much because the top management has doubt over CIOs’ capability as it is because the CIOs are not ready to move on from nuts and bolts because that may mean giving up control over a big chunk of budget on IT infrastructure.

Why Proxies Are Important for Microservices

The dynamic nature of microservices applications presents challenges when implementing reverse proxies. Services can come and go as they are revisioned or scaled and will have random IP addresses assigned. The synchronization of the available services and the configuration of the reverse proxy is essential to ensure error-free operation. One solution is to use a service registry (e.g. etcd) and have each service maintain its registration while it is running. The reverse proxy watches the service registry to keep its configuration up to date. Kubernetes does all of this automatically for you as part of its automation. The Kube DNS process maintains the service registry with an address (A) and service (SRV) record for each service. The Kube Proxy process routes and load-balances requests across all instances of the services. With all incoming request traffic for a microservices application typically passing through proxies, it is essential to monitor the performance and health of those proxies. Instana sensors include support for Envoy Monitoring, Nginx Monitoring, and Traefik Monitoring, with more proxy technologies coming.

Browser OS could turn the browser into the new desktop

A potential challenge is the browser becomes the desktop for the end user, and that's something folks have to get used to. But to Google's credit and its partnerships with vendors like VMware or Citrix, the UX challenge becomes almost invisible. We'll see how enterprises continue to approach this opportunity, which is ultimately more secure. For certain use cases, field services for example, if a browser OS-based device either dies or gets broken or lost, no data is lost. A user can just go get a new Chromebook and sign in back where he or she left off. That's an unheard-of value proposition -- that begin-where-you-left-off concept is powerful. One other problem enterprises may face is around Microsoft legacy infrastructure -- particularly around endpoint management. Microsoft has moved away from that to help bridge the divide, and Windows 10 is doing well. We'll see a lot more migration happening this year as the Windows 7 sunset comes closer.

This new Android ransomware infects you through SMS messages

Depending on the infected device's language setting, the messages will be sent in one of 42 possible language versions, and the contact's name is also included in the message automatically.  If the link is clicked and the malicious app is installed manually, it often displays material such as a sex simulator. However, the real purpose is quietly running in the background. The app contains hardcoded command-and-control (C2) settings, as well as Bitcoin wallet addresses, within its source code. However, Pastebin is used by the attackers as a conduit for dynamic retrieval.  Once the propagation messages have been sent, Filecoder then scans the infected device to find all storage files and will encrypt the majority of them. Filecoder will encrypt file types including text files and images but fails to include Android-specific files such as .apk or .dex.  ESET believes that the encryption list is no more than a copy-and-paste job from WannaCry, a far more severe and prolific form of ransomware.  A ransom note is then displayed, with demands ranging from approximately $98 to $188 in cryptocurrency. There is no evidence that files will be lost after the time threatened.

Google bolsters hybrid cloud proposition for enterprises through VMware partnership

Google Cloud CEO Thomas Kurian confirmed the news in a blog post, in which he described the move as “another significant step” in his firm’s drive to bolster the enterprise appeal of its public cloud platform.  In recent years, this has seen the Google Cloud team roll out a series of data security and functionality improvements to its platform, and move to introduce industry-specific services. Such moves have resulted in Google Cloud developing into an $8bn annual revenue run rate company that is growing “at significant pace”, as was confirmed by Google CEO Sundar Pichai during a conference call to discuss its parent company’s second-quarter results earlier this month. “Customers are choosing Google Cloud for a variety of reasons,” said Pichai on the call, transcribed by Seeking Alpha. “Reliability and uptime are critical.” He also made reference to the “flexibility” that organisations also need when moving to the cloud, so they can proceed in their “own way”. 

The Future of API Management

There will be a continued emphasis on the developer and recognizing the developer is king and making the job easier for them. We understood this for the public, but we still need to improve internally. In the form of a service catalog for internal developers to make it easier for them to ramp up and get benefits of existing APIs. New architecture — Everything is driven by containers, container platforms, and K8s is leading to microservices architecture with new approaches to control traffic with sidecar approaches to manage traffic like Envoy and Istio to provide service mesh to manage applications within the container cluster.  As these things come up, there will be a proliferation of types of control points with multiple form factors. We embrace Envoy as the new gateway. Right now we live in a mixed world and it’s important to consider how service mesh and API management will overlap. API management is about the relationship of providing a service and multiple consumers of that service. The more scale, the more important the formal API management platform.

What is a zero day? A powerful but fragile weapon

A zero day is a security flaw that has not yet been patched by the vendor and can be exploited and turned into a powerful weapon. Governments discover, purchase, and use zero days for military, intelligence and law enforcement purposes — a controversial practice, as it leaves society defenseless against other attackers who discover the same vulnerability. Zero days command high prices on the black market, but bug bounties aim to encourage discovery and reporting of security flaws to the vendor. The patching crisis means zero days are becoming less important, and so-called 0ld-days become almost as effective. ... Not all zero days are complicated or expensive, however. The popular Zoom videoconferencing software had a nasty zero day that "allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user's permission," according to the security researcher's write up. "On top of this, this vulnerability would have allowed any web page to DoS (Denial of Service) a Mac by repeatedly joining a user to an invalid call." The Zoom for Mac client also installs a web server on your laptop that can reinstall the Zoom client without your knowledge if it's ever been installed before.

Kubernetes security: Best practices for enterprise deployment

One thing that is widely agreed upon by the security pros – as Kubernetes adoption and deployment grows, so will the security risks. There have been multiple recent events in the cloud and mobile dev spaces where these environments were compromised by attackers. This included everything from disruption, crypto mining, ransomware, and data stealing. Of course, these types of deployments are just as susceptible to exploits and attacks from attackers and insiders as the traditional environments. Thus, it is more important to ensure your large-scale Kubernetes environment has the right deployment architecture and that you use security best practices for all these deployments. As Kubernetes is more widely adopted, it becomes a prime target for threat actors. “The rapid rise in adoption of Kubernetes is likely to uncover gaps that previously went unnoticed on the one hand, and on the other hand gain more attention from bad actors due to a higher profile,” says Amir Jerbi, CTO at Aqua Security.

---

Quote for the day:

"Leaders begin with a different question than others. Replacing who can I blame with how am I responsible?" -- Orrin Woodward

---