Daily Tech Digest - September 03, 2019

Cloud 2.0: A New Era for Public Cloud

Security remains a primary concern for companies moving to the cloud, even though public cloud providers offer security capabilities like data classification tools and even whole cloud environments tailored to meet industry-specific specifications - both of which Deloitte names as vectors to cloud progress. “A lot of times, one of the first things companies do in the cloud is migrate existing apps, workloads and the data they operate on to the cloud. The security model in the cloud is rather different, and sometimes data and assets need to be secured in a more granular way, so data classification is part and parcel of a prudent migration to the cloud,” Schatsky says. ... “There are apps written in the old mode of app dev and to convert them to the world of cloud takes time, effort and a willingness to do so. Plus, it takes skill. It’s not a nontrivial task. Those are the things that are slowing the process of moving everything to the cloud.” Schatsky agrees. “For a lot of companies, they’re dealing with incubating the skills they need to take full advantage of the cloud. When companies start by moving wholesale to the cloud, the biggest need they have is to just propagate the impact on their workflow and operating models that the cloud enables. You can’t rush that. It’s a human capital thing that takes time,” he says.

The Path to Modern Data Governance

It is worth noting that the longest list of activities is the people list. This is typical, as having all of the right people, engaged in the right ways, is critical to data governance success. The processes and methods lists are tied for 2nd longest. People, processes, and methods are at the center of effective data governance. The example shown in figure 3 illustrates the idea that we have selected a subset of the activities – not all of them – for initial planning. (The color coding here is different, mapping activities to projects.) To make modernization manageable and practical, it is important to make conscious decisions about what NOT to do. The selected activities are organized based on affinity – they seem to fit together and make sense as a project. They are also organized and based on dependencies – what makes sense to do in what sequence. Note here that the activities in a single project don’t necessarily all come from the same layer of the framework. The bottom sequence in green, for example, includes two activities from the culture layer, one from the methods layer, and one from the people layer.

Industry calls for joint participation to cement Australia's digital future

The report outlined how universities and publicly funded research agencies needed to reshape their research culture to safeguard and strengthen the country's digital workforce and capability pipeline, by placing substantially higher emphasis on industry experience, placements, and collaborations in hiring, promotion, and research funding. At the same time, there are also recommendations about how to lift the skills of teachers on ICT-related topics, and the need to increase diversity, particularly women, while removing structural barriers that cause the loss of knowledge, talent, and educational investment from the ICT and engineering sectors. "Attracting high-quality international students to, and retaining them in, Australia after they graduate is a good way to expand the diversity of the ICT skill base and to promote greater international engagement, not least of which with the home countries of those people. We should make it easier to keep such people after the end of their formal studies," the report said. Another recommendation the report made included the need for government to undertake a future-readiness review for the Australian digital research sectors, as well as to monitor, evaluate, and optimise the applied elements of the federal government's National Innovation and Science Agenda and the Australia 2030 Plan.

Is the tech skills gap a barrier to AI adoption?

Without the right workforce, organisations simply cannot proceed to tackle the technical challenges existing in a data-driven industry. This can help to reverse the inconsistencies and set-backs with data-led AI projects. With the right analytics platform, data capabilities can be put in the hands of the business experts who not only have the context of the questions to solve but the data sources needed to deliver insights at speed. Trained data scientists will still be required, but the shortage of them does not mean all activity, or some level of a project, can’t be tested and iterated and progressed. Existing employees should be still able to perform some levels of data tasks despite not being experts. They are in the line-of-business, close to the questions, the data, and the leaders who need insight. Linking up data insight for people with the vital business knowledge is paramount to making the most of data analytics and fuel business progress. What’s more, getting data in the hands of the people is crucial in order to democratise AI and make advanced analytics more accessible to everyone, rather than locked away by a ‘priestly caste’ of data scientists.

USBAnywhere Bugs Open Supermicro Servers to Remote Attackers

USBAnywhere stems from several issues in the way that BMCs on Supermicro X9, X10 and X11 platforms implement virtual media, which is an ability to remotely connect a disk image as a virtual USB CD-ROM or floppy drive. “When accessed remotely, the virtual media service allows plaintext authentication, sends most traffic unencrypted, uses a weak encryption algorithm for the rest and is susceptible to an authentication bypass,” according to the paper. “These issues allow an attacker to easily gain access to a server, either by capturing a legitimate user’s authentication packet, using default credentials, and in some cases, without any credentials at all.” Once connected, the virtual media service allows the attacker to interact with the host system as a raw USB device. This means attackers can attack the server in the same way as if they had physical access to a USB port, such as loading a new operating system image or using a keyboard and mouse to modify the server, implant malware, or even disable the device entirely. “Taken together, these weaknesses open several scenarios for an attacker to gain unauthorized access to virtual media,” according to Eclypsium.

Risk mitigation is key to blockchain becoming mainstream

A solution in search of a problem, blockchain is often associated with cryptocurrency, which is, arguably, the single worst application of the “immutable” ledger that defines the technology. Supply chains are a much better use, due to the high levels of integrity and availability provided by a blockchain. A blockchain is essentially a piece of software, run on multiple computers (or nodes) that work together as participants of a distributed network to produce a record of transactions submitted to that network in a ledger. The ledger is made of blocks that are produced when nodes run complex cryptographic functions, which are chained together to produce a blockchain. Nodes perform validation of each block that is created to verify its integrity and ensure it has not been tampered with. If a majority of nodes validate the block, consensus is reached, confirming the recorded transactions to be true. The block is added to blockchain and the ledger is updated.

MDM can tame and monetize IoT data explosion

To achieve success at large scale, Bonnet says a company's MDM system must allow for an agile delivery process. "It is almost impossible to be sure about the data structure, semantics, and governance process a company needs to start, and the prediction for the future is so hard to establish, even impossible," he laments. The inability to know the future is the key reason for the agility mindset. This is a vital awareness. "If the MDM system is not agile enough, then all the existing systems running in a company could be slowed in their ability to change. There is also a potential for poor integrating with the MDM system which will not improve the data quality, and may have the opposite effect," he continues. He suggests that checking two points: first, the MDM system must be agile, without a rigid engineering process that could delay the delivery of the existing systems. This is what is called a "model-driven MDM" for which the data semantics will drive a big part of the expected delivery in an automatic process.

Data-Driven Design Is Killing Our Instincts

Design instinct is a lot more than innate creative ability and cultural guesswork. It’s your wealth of experience. It’s familiarity with industry standards and best practices. You develop that instinct from trial and error — learning from mistakes. Instinct is recognizing pitfalls before they manifest into problems, recognizing winning solutions without having to explore and test endless options. It’s seeing balance, observing inconsistencies, and honing your design eye. It’s having good aesthetic taste, but knowing how to adapt your style on a whim. Design instinct is the sum of all the tools you need to make great design decisions in the absence of meaningful data. ... Not everything that can be counted counts. Not everything that counts can be counted. Data is good at measuring things that are easy to measure. Some goals are less tangible, but that doesn’t make them less important. While you’re chasing a 2% increase in conversion rate you may be suffering a 10% decrease in brand trustworthiness. You’ve optimized for something that’s objectively measured, at the cost of goals that aren’t so easily codified.

How to Use Chaos Engineering to Break Things Productively

There are a number of variables that can be simulated or otherwise introduced into the process. These should reflect actual issues that might occur when an app is in use and prioritized by the likelihood of occurrence. Problems that can be introduced include hardware-related issues like malfunctions or a server crash as well as process errors related to sudden traffic spikes or sudden growth. For example, what might happen during the whole online shopping experience if a seasonal sale results in a larger than expected customer response? You can also simulate the effects of your server being the target of a DDoS attack that's designed to crash your network. Any event that would disrupt the steady state is a candidate for experimentation. Compare your results to the original hypothesis. Did the system perform as anticipated, beyond expectations, or produce worse results? This evaluation shouldn't be undertaken in a vacuum, but include input from team members and services that were utilized to conduct the experiment.

---

Quote for the day:

"True leaders bring out your personal best. They ignite your human potential" -- John Paul Warren

---

Daily Tech Digest - September 02, 2019

Big Four and Blockchain: Are Auditing Giants Adopting Yet?

At this point, all of the Big Four companies have at least demonstrated some interest in blockchain, albeit their approaches tend to differ. Some companies, like Deloitte, have been mostly researching how this technology has affected the general market, while EY, for instance, has focused on releasing software solutions tailored for the needs of cryptocurrency businesses.  Such diversity can be explained by the very nature of those companies — being professional services networks, they offer a variety of services, including audit, tax, consulting, enterprise risk and financial advisory. ... “Because the Big Four work in such a wide scope of sectors, they are unable (or unwilling) to dedicate serious time to blockchain. This makes sense, given that they cannot invest in every new technology set which comes along (although we view blockchain as different). One key thing to note is that many of the big four only got into blockchain when Crypto projects began using them to show more transparency. The Big Four are known to only get involved with something when their client base is using it, blockchain was and is no exception.”

Social media and enterprise apps pose big security risks

“Today’s organisations are heavily dependent on applications, and employees will often use them to perform key parts of their job,” said Ollie Sheridan, security engineer for Europe, the Middle East and Africa at Gigamon. “However, it also means these applications can have access to sensitive corporate data, which could put an organisation at risk if it fell into the wrong hands. “Organisations should therefore treat applications as part of their own network and aim to have complete visibility of their functions. Security should always be paramount when new applications are being deployed.” Scott Crawford, a security analyst at 451 Research, told Computer Weekly in June 2018 that security threats arise because companies are using a diverse range of applications. Often, IT and security teams do not have the resources or time to identify and respond to attacks, he said. The Gigamon survey also asked IT security professionals which applications they believe bring in the most malware to the enterprise.

The Psychological Reasons of Software Project Failures

Coding is not a challenge. In fact, code is the last thing anybody is willing to pay for (though, ironically, it is the most important thing that gets produced in the end). The real challenge, and the real duty of a programmer, is solving problems that customers face, most likely with code but not necessarily. These problems are usually only partially “technical”, often sociological, often complex, often wicked. As problem complexity grows, the required effort, intelligence, knowledge and dedication to solve it grows as well, sometimes exponentially. Recognizing complexity, confining it and minimizing it is the ultimate goal of a programmer. This raises the bar so high that an average person might fail to present the sufficient personal qualities required for the job, and turn out to be relatively stupid. As David Parnas states it: “I have heard people proudly claim that they have built lots of large complex systems. I try to remind them that the job could have been done by a small simple system if they had spent more time on "front-end" design. Large size and complexity should not be viewed as a goal.”

Beware this insidious word in the workplace

What is the most important aspect of leadership? Because of its nature, it’s possible to begin a sentence with “Leadership is about…” and choose from dozens of applicable words to finish it, all of which would prompt nods of agreement. But my vote would be for trust as the most important among them. If leaders consistently undermine their people, they will also undermine the expectation that their people will do the right thing, whatever the context. If that expectation goes away, so, too, does motivation. Another key to leadership, a close second for me after trust, is respect — not just because the leader needs to earn respect, but because the leader must respect the people who work for him or her. When I interviewed the Hollywood executive Jeffrey Katzenberg years ago, he shared a key insight that stayed with me. “By definition, if there’s leadership, it means there are followers, and you’re only as good as the followers,” he said. “I believe the quality of the followers is in direct correlation to the respect you hold them in. It’s not how much they respect you that is most important.”

Why do DBAs dislike loops?

So why do data people tend to avoid (or even actively dislike) loops? (Can you say cursor anyone?). Scaleability! Loops just don’t scale well. A loop that is fast at 100 loops is going to take twice as long at 200 loops, five times as long at 500 loops and one hundred times as long at 10,000 loops. That’s a problem in the database world when at 10,000 rows a table is still considered small and depending on your experience a mid-sized table might be 1,000,000 rows or more. As in all things I like examples, so here’s a simple one. I’m creating a table with an identity column and a date column. I’m going to record times spent updating each row one at a time and just updating the entire table. Then I’m going to add 10 rows and run again, 10 rows and run again, etc until I have 7500 rows. Quick note to everyone who reads this and thinks “But …”. I’m aware this is a really simple example. If you have buts that you think will significantly change the outcome feel free to run a test yourself and if by some odd chance feel free to put the results in the comments, or even better blog them and link the blog in the comments

DigitalOcean Adds Managed MySQL and Redis Services

Both Managed MySQL and Redis options support up to two standby nodes that take over automatically if the primary node fails. Managed MySQL customers can provision read-only nodes in additional geographic regions for horizontal scaling. Managed MySQL customers also get access to monitoring and proactive alerting functionality, and the ability to fork an entire cluster based on a specific point in time. Bearfield says that Managed Redis will also get database metrics and monitoring upon general availability. Both the Managed MySQL and Redis offerings come with two cluster types: single node or high-availability. The single node clusters start at $15 per month and provide 1 GB of memory, 1 vCPU, and 10 GB of SSD disk storage. As evident by the name, the single node clusters aren't highly available, but do support automatic failover. The high availability clusters offer up to two standby nodes and begin at $50 per month. The single node plan offers database instances as large as 32 GB of RAM, 8 vCPUs, and 580 GB of storage.

CISOs turn to AI, detection, response and education

CISOs believe that AI, like machine learning, and analytics relieve IT teams of monotonous tasks, so they can focus on business-critical jobs such as identifying anomalous behaviour in their networks and responding to threats quickly. According to the survey, security leaders are currently allocating an average of 36% of their security budget to response. However, most would like to shift their resources from prevention to bolster detection and response capabilities and increase response investments to 40% of their budget. “There is a growing realisation that breaches are inevitable, and that strong detection and response practices are a greater priority,” the report said. CISOs believe talent and training constraints have a significant impact on their organisations, the survey found, with CISOs paying more attention to educating their own employees on best practices and building cyber security awareness in order to prevent and reduce internal threats.

People And Machines – A Workplace Reality

For people to seize this kind of opportunity they must be able to embrace change, as well as having access to learning and reskilling programmes to help them on their journey. As mentioned above, this is one area where HR cannot afford to drop the ball. Similarly, another crucial factor to consider is ensuring that all employees are able to benefit on an equal basis. “We have to ask ourselves,” says Cable, “if we don’t act and invest with new technology, who might be left behind? 15 per cent of organisations were saying they didn’t see any need to invest in new technology. Those organisations are essentially taking a back seat, and choosing not to take advantage of all the new things around us.” Worryingly, Cable observes, an area where that investment is least likely to be made is HR. HR departments tend to have a slightly more female workforce. Is this therefore another inhibitor to women being able to contribute in technology-enabled organisations? It’s a subtle point, but this is certainly something that HR – and organisations in general – should be aware of.

Software Deployment Strategy: How to Get It Right the First Time

There is an intense focus today on customer experience (CX). Ensuring that your website visitors have access to the information they want, and they can find it quickly and easily, is just part of your overall CX. This makes your customer-facing technologies – the ones that power your website or mobile app – critical investments, even though they may not carry the price tag of an ERP system. Even the smallest investments need to be vetted to make sure they work with existing infrastructure and processes. One small piece of website tech that ends up degrading your online CX can cost your organization millions in a very short amount of time. There’s simply too many choices just a click away today if something isn’t working properly. Differentiating technologies are also more likely to be customized than an application like ERP, which can often use a number of out-of-the-box processes. These are areas where a software deployment strategy involving your EA team can help guide the software purchase and deployment process.

Findings from Gartner’s Market Guide for Email Security 2019

To help determine which combination of cloud email security products might work best for any organization, we believe, a thorough analysis of existing email security products to understand the current solution’s capabilities completely. Gartner recommends, “Leverage incumbent email security products by verifying and optimizing their capabilities and corresponding configurations. This will serve as the start of a gap analysis to determine where supplementation or replacement may be required.” The Cisco Threat Analyzer for Office 365 quickly detects security gaps in Office 365 email inboxes to provide visibility into threats that may have gone undetected and identify security vulnerabilities. In addition, to support this growing cloud email platform user base, Cisco Email Security now has data centers with global coverage located in North America, Europe and Asia. These locations allow for local customers to satisfy data access and sovereignty requirements in their specific regions and provide the confidence that their data will remain within region. For those install base customers using an on premise or hybrid solution, this global coverage gives them the peace of mind for migrating from on premise to cloud email.

---

Quote for the day:

"Tenderness and kindness are not signs of weakness and despair, but manifestations of strength and resolution." -- Khalil Gibran

---

Daily Tech Digest - September 01, 2019

Software Ate The World, Now AI Is Eating Software

The extent in which Andreessen’s cherished software companies are weaving AI into their products is however often limited. Instead, a new slew of start-ups now incorporates an infrastructure based around the above mentioned AI-facilitating processes from their very foundation.  Driven by an increase in efficiency, these new companies use AI to automate and optimize the very core processes of their business. As an example, no less than 148 start-ups are aiming to automate the very costly process of drug development in the pharmaceutical industry according to a recent update on BenchSci. Likewise, AI start-ups in the transportation sector create value by optimizing shipments, thus vastly reducing the amount of empty or idle transports. Also, the process of software development itself is affected. AI-powered automatic code completion and generation tools such as TabNine, TypeSQL and BAYOU, are being created and made ready to use.

Police Trick Malware Gang Into Disinfecting 850,000 Systems

The disruption effort began after Avast in March traced back a rise in stealthy cryptocurrency mining infections to variants of a worm called Retadup, written in both AutoIt and AutoHotkey scripts. Researchers began studying the command-and-control communications being used to control infected endpoints, or bots, says Jan Vojtesek, a malware researcher at Avast, in a research report. "After analyzing Retadup more closely, we found that while it is very prevalent, its C&C communication protocol is quite simple," he says. "We identified a design flaw in the C&C protocol that would have allowed us to remove the malware from its victims' computers had we taken over its C&C server." Avast alerted France's national cybercrime investigation team, C3N, that servers in France appeared to be hosting the majority of the command-and-control infrastructure for distributing and controlling the Retadup worm - in other words, self-replicating malware. Avast also shared a technique that it thought might allow authorities to neutralize existing infections.

Inside Facebook’s engineering culture

Unlike some companies where departmental work groups are not always accessible to those outside those groups, Facebook employees can participate in any group. “Most of those groups are what we call open QA. What that means is that people outside of those groups can also see the information. And you’ll be surprised how this tackles a number of challenging problems as the company grows,” Nguyen said. For one, open work groups will help to prevent duplication of projects, since developers can see what other teams are doing, and avoid building the same things. In cases where duplicate projects are already being built, Nguyen would step in to bring the teams together in an open dialogue. “There were a few teams within infrastructure and Instagram that were building different technologies for logging of data,” Nguyen recalled. “One of the engineers at Instagram escalated [the issue] to me and I set up a meeting for them to work together.”

4 Cybersecurity Professionals That Can Benefit from Threat Intelligence

The first layer of defense that most organizations rely on is their own security operation center (SOC). Whether outsourced or in-house, security operations analysts need to possess a broad set of skills to be effective. This includes capabilities in log monitoring, penetration testing, incident response, access management, and more. Each one of these tasks requires a different group of systems and solutions to work well, which are usually not integrated. This means that SOCs often have to deal with unending alerts and big data that may not come with much context. Threat intelligence enriches alert management. It provides context to help SOCs know which alerts need to be prioritized. Some threat intelligence platforms readily offer this kind of automation using machine learning (ML) or similar technologies. Just like SOCs, incident response teams face the challenge of getting information that lacks context. They are also bombarded with numerous alerts from their security information and event management (SIEM) solutions and so are forced to choose which ones to prioritize.

Cloud Storage Is Expensive? Are You Doing it Right?

A common solution, adopted by a significant number of organizations now, is data repatriation. Bringing back data on premises (or a colocation service provider), and accessing it locally or from the cloud. Why not? At the end of the day, the bigger the infrastructure the lower the $/GB and, above all, no other fees to worry about. When thinking about petabytes, there are several ways to optimize and take advantage of which can lower the $/GB considerably: fat nodes with plenty of disks, multiple media tiers for performance and cold data, data footprint optimizations, and so on, all translating into low and predictable costs. At the same time, if this is not enough, or you want to keep a balance between CAPEX and OPEX, go hybrid. Most storage systems in the market allow to tier data to S3-compatible storage systems now, and I’m not talking only about object stores – NAS and block storage systems can do the same. I covered this topic extensively in this report but check with your storage vendor of choice and I’m sure they’ll have solutions to help out with this.

The First Artificial Memory Has Been Successfully Created and Implanted

Previous research had shown that it was possible to partially transfer memories from one rodent to another via reproducing the electrical activity associated with a specific memory in one mouse and jolting it into the brain of another mouse. This new experiment is different. This time the memory was created completely artificially from the ground up. This consisted of a few parts. First, they used a technique called optogenetics. This involves fiber optic cables surgically implanted into the olfactory region of the mice’s brain so that light can be used to turn on proteins associated with specific smells. To do that, the mice had to be genetically engineered to only produce the light-sensitive protein in the region associated with acetophenone—AKA the scent of cherry blossoms. Now they could artificially create the scent of cherry blossoms in the brain of a mouse. So we’re already into some wacky stuff, but don’t worry. It gets wackier.

Semi-supervised learning explained

Self-training uses a model’s own predictions on unlabeled data to add to the labeled data set. You essentially set some threshold for the confidence level of a prediction, often 0.5 or higher, above which you believe the prediction and add it to the labeled data set. You keep retraining the model until there are no more predictions that are confident. This begs the question of the actual model to be used for training. As in most machine learning, you probably want to try every reasonable candidate model in the hopes of finding one that works well. Self-training has had mixed success. The biggest flaw is that the model is unable to correct its own mistakes: one high-confidence (but wrong) prediction on, say, an outlier, can corrupt the whole model. Multi-view training trains different models on different views of the data, which may include different feature sets, different model architectures, or different subsets of the data. There are a number of multi-view training algorithms, but one of the best known is tri-training.

Sprint Reviews With Kanban

Kanban is sometimes thought of as a soft option because “flow” is misinterpreted as “whatever gets delivered gets delivered”. A team will start with what it is, realistically, doing now. There is no need to vamp Sprints. The odious Sprint Goal and the contrived forecast of work in the Sprint Backlog are dispensed with. It looks as if the team can no longer be held hostage to fortune. In Kanban there is no Great Lie to be fabricated about a planned Sprint outcome, and, it is assumed, there is no great commitment that can hang over team members’ heads like the Sword of Damocles. What possible use for a monstrous Sprint Review can there be? Instead, there ought to be a succession of mini-reviews with the Product Owner as each item is completed. Having mini-reviews can be useful and timely, and they are all very well. In truth, however, a professional Kanban team will not escape from making a serious commitment, nor would a team ever seek to do so. For one thing, its members will need to understand and define a commitment point in their workflow.

Hackers Hit Unpatched Pulse Secure and Fortinet SSL VPNs

Based on their count of recent publicly exposed common vulnerabilities and exposures in SSL VPNs, it appeared that Cisco equipment would be the riskiest to use. To test that hypothesis, the researchers began looking at SSL VPNs and found exploitable flaws in both Pulse Secure and Fortinet equipment. The researchers reported flaws to Fortinet on Dec. 11, 2018, and to Pulse Secure on March 22. ... In response, Fortinet released a security advisory on May 24 and updates to fix 10 flaws, some of which could be exploited to gain full, remote access to a device and the network it was meant to be protecting. In particular, it warned that one of the flaws, "a path traversal vulnerability in the FortiOS SSL VPN web portal" - CVE-2018-13379 - could be exploited to enable "an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests." Such FortiOS system files contain sensitive information, including passwords, meaning attackers could quickly give themselves a way to gain full access to an enterprise network.

How to bolster IAM strategies using automation

Litton argues that automation is also important for protecting critical data assets. “An example of this is when an employee leaves an organisation or a technology supplier relationship ends,” he says. “Automation can ensure that their accounts do not remain in an active state, thus eliminating a potential avenue through which bad actors can access data. When implemented properly, automated IAM solutions can also identify orphan accounts automatically and alert system owners.” Identity management systems comprise users, applications and policies, all of which govern how people are able to use software. Litton says automated IAM systems can fully automate identity creation at scale; automatically manage user access; apply role- and attribute-driven policies; and completely remove the need for passwords, helping to improve the user experience, while decreasing the helpdesk support burden.

---

Quote for the day:

"Leaders keep their eyes on the horizon, not just on the bottom line." -- Warren G. Bennis

---

Daily Tech Digest - August 31, 2019

AI ‘Emotion Recognition’ Can’t Be Trusted

If emotion recognition becomes common, there’s a danger that we will simply accept it and change our behavior to accommodate its failings. In the same way that people now act in the knowledge that what they do online will be interpreted by various algorithms (e.g., choosing to not like certain pictures on Instagram because it affects your ads), we might end up performing exaggerated facial expressions because we know how they’ll be interpreted by machines. That wouldn’t be too different from signaling to other humans. Barrett says that perhaps the most important takeaway from the review is that we need to think about emotions in a more complex fashion. The expressions of emotions are varied, complex, and situational. She compares the needed change in thinking to Charles Darwin’s work on the nature of species and how his research overturned a simplistic view of the animal kingdom. “Darwin recognized that the biological category of a species does not have an essence, it’s a category of highly variable individuals,” says Barrett. “Exactly the same thing is true of emotional categories.”

Regulations To Trust AI Are Here -- And It's a Good Thing

With customer protection in mind, regulators are staying ahead of this technology and introducing the first wave of AI regulations meant to address AI transparency. This is a step in the right direction in terms of helping customers trust AI-driven experiences while enabling businesses to reap the benefits of AI adoption. This first group of regulations relates to the understanding of an AI-driven, automated decision by a customer. This is especially important for key decisions like lending, insurance and health care but is also applicable to personalization, recommendations, etc. The General Data Protection Regulation (GDPR), specifically Articles 13 and 22, was the first regulation about automated decision-making that states anyone given an automated decision has the right to be informed and the right to a meaningful explanation. According to clause 2(f) of Article 13: "[Information about] the existence of automated decision-making, including profiling ... and ... meaningful information about the logic involved [is needed] to ensure fair and transparent processing."

Apple iPhones Hacked by Websites Exploiting Zero-Day Flaws

Google reported two serious flaws - CVE-2019-7287 & CVE-2019-7286 - to Apple on Feb. 1, setting a seven-day deadline before releasing them publicly, since they were apparently still zero-day vulnerabilities as well as being used in active, in-the-wild attacks. Apple patched the flaws via iOS 12.1.4, released on Feb. 7, together with a security alert. Hacking modern operating systems - including iOS - typically requires chaining together exploits for multiple flaws. In the case of mobile operating systems, for example, attackers may require working exploits that allow them to initially access a device - typically via a WebKit-based browser - and then to escape sandboxes and jailbreak the device to install a malicious piece of code. All told, Google says that it counted five exploit chains that made use of 14 vulnerabilities: "seven for the iPhone's web browser, five for the kernel and two separate sandbox escapes." The identified exploits could have been used to hack devices running iOS 10, which was released on Sept. 13, 2016, and nearly every newer version of iOS, through to the latest version of iOS 12.

The challenge: creating a better future of work

With appropriate policies, any job can become a good job. There’s nothing about today’s low-wage service jobs, home-care work and gig jobs that means we can’t make them good jobs, like we have done before. The jobs of the future are upon us today. We can’t turn the clock back and resurrect all of the manufacturing jobs that have disappeared. But we can create the good jobs of the future. Rather than wondering what kinds of jobs we will be doing for robot bosses, we need to decide what we want work and jobs to be doing for us, our families and our communities in the future. The state can take the lead in charting a new path forward that works for all Californians. In an executive order creating a Future of Work Commission, Gov. Gavin Newsom emphasized the need to “modernize the social compact between the government, the private sectors and workers.” We can begin to formulate policies that set guardrails on how robots and artificial intelligence can be used to improve the quality of jobs, not just replace them. We can look beyond upskilling workers to upgrading jobs.

Electronic word-of-mouth can make or break a product launch

eWOM can also affect product strategy. Executives at GM scrapped plans for a type of Buick crossover after reading tweets criticizing the design. And beauty products retailer Sephora canceled the release of a Starter Witch Kit — an innovative product that combined perfumes with tarot cards and a crystal ball, among other items — after critics accused the brand of trivializing witchcraft as a religious practice. So what’s the key to getting product launches to go viral, generating positive eWOM across the Internet? Researchers have yet to connect the dots between innovativeness, a firm’s marketing strategies, and the sentiments expressed through eWOM channels, particularly as they relate to the success of new products. But a new study aims to make those connections and provides suggestions for creating effective viral marketing campaigns for new products. To arrive at their findings, the authors conducted a two-phase study. The first phase analyzed a data set of millions of eWOM posts on message boards, forums, and social media platforms such as Facebook, Twitter, and Instagram.

Why 2-factor authentication isn't foolproof

Two-factor authentication is certainly more effective than just a username and password. But the risks of attack and data breach remain if 2FA is poorly implemented, especially in cases where appropriate checks aren't included before the authentication challenges are presented. Password leakage and credential misuse is on the rise, and attackers are continuously devising new ways to improperly access organizations and systems. We need to embrace evolving approaches to identity security that improves security posture while simultaneously keeping a simple user experience. Modern, adaptive, risk-based approaches that leverage real-time metadata and threat detection techniques have to be the standard. Intelligence needs to be built into the authentication process that leverage dynamic controls in real time. They also need the ability to block authentication requests when they are considered to be high risk. These risk factors include detecting anonymous proxy usage, detection of malicious IP addresses, dynamic geo-controls, device controls, and analyzing for unusual access patterns or overly privileged accounts.

Rating IoT devices to gauge their impact on your network

Devices with low-bandwidth requirements include smart-building devices such as connected door locks and light switches that mostly say “open” or “closed” or “on” or “off.” Fewer demands on a given data link opens up the possibility of using less-capable wireless technology. Low-power WAN and Sigfox might not have the bandwidth to handle large amounts of traffic, but they are well suited for connections that don’t need to move large amounts of data in the first place, and they can cover significant areas. The range of Sigfox is 3 to 50 km depending on the terrain, and for Bluetooth, it’s 100 meters to 1,000 meters, depending on the class of Bluetooth being used. Conversely, an IoT setup such as multiple security cameras connected to a central hub to a backend for image analysis will require many times more bandwidth. In such a case the networking piece of the puzzle will have to be more capable and, consequently, more expensive. Widely distributed devices could demand a dedicated LTE connection, for example, or perhaps even a microcell of their own for coverage.

Addressing Large, Complex Unresolved Problems With AI

Tracking the demand for skills in the market and the educational infrastructure available to supply those skills, through a Skills Repository. This will help keep education concurrent with current market demands and ensure much better alignment between academia and corporates; Automate routine, time-consuming tasks – from creating and grading test papers, developing personalized benchmarks for each student, identifying gaps in student development, tracking aptitude and attentiveness within each subject, and enabling teachers to focus on curriculum development, coaching and mentoring, and improving behavioral and personality aspects of students; ... Review and summary-creation of long drawn cases and their history can be done through natural language processing and voice recognition; Routing Right-to-Information and governance-related citizen requests through intelligent bots, thus making it more efficient to get critical information; Employ Anomaly Detection frameworks to surface fraudulent transactions – especially among land deals.

TrickBot Variant Enables SIM Swapping Attacks: Report

The operators of this version of TrickBot are able to intercept a victim's PIN as well as other credentials when they attempt to log onto the websites of the three wireless carriers, according to the report. This allows for a so-called SIM attack, which involves taking a victim's phone number and porting it to another SIM card that is then under the control of the attackers. Then an attacker can collect one-time passwords or trick telecom employees into giving out information about the victim through social engineering techniques. These moves create opportunities for further attacks, such as account takeover schemes. "Interception of short message service (SMS)-based authentication tokens or password resets is frequently used during account takeover fraud," the SecureWorks report notes. Over the past year, SIM swapping has been used in the U.K. for attempted account takeover attacks that have targeted banks and other financial institutions. Account takeover attacks can pave the way for credential stuffing - a technique used to guess passwords and users names to steal data

Great Global Meetings: Navigating Cultural Differences

Team members will know their cultural differences are getting in the way, but they don’t have a safe or honest way to talk about them. Without a chance for team members to work through these differences, a collision course is inevitable. By missing the opportunity to openly explore how cultural differences affect its ability to collaborate, a team may become mired in cultural misunderstandings and handcuffed by invalid assumptions. Many may be afraid of saying the wrong thing or asking a question that may be offensive. Global team leaders should initiate candid discussions about cross-cultural differences as early as possible, ideally when a new team is forming. Cultural differences will affect collaboration one way or another, so it’s best to have team members familiarize themselves with each others’ cultures right up front, so they can decide how they want to work together moving forward. Allocate time for checkpoints at key junctures in the conversation. Pause periodically to let all participants absorb what’s just been said. Some people—Americans in particular—often feel compelled to puncture silence with a comment.

---

Quote for the day:

"Tend to the people, and they will tend to the business." -- John C. Maxwell

---

Daily Tech Digest - August 30, 2019

Cybersecurity Readiness: A Must-Have For Digital Transformation Success

On the flip side, digital transformation greatly expands the cyberattack surface, providing more potential targets for cybercriminals and nation-state adversaries. One estimate from Juniper Research shows that cybercrime will cost businesses a total of over $8 trillion by 2022. The unfortunate reality is that crime does pay, and techniques used to capitalize on technology vulnerabilities or the inherent trusting nature of humans are constantly being refined. As more devices and applications connect to the enterprise and workforces continue to become more globally widespread, potential pathways to successful infiltration will increase. Digital transformation requires solid security. Security is the enabler of successful digital transformation. It’s a veritable catch 22 -- forgo digital transformation and risk falling behind or fully embrace it and risk greater instances of compromise. As an experienced leader of many organizations, I can tell you ignoring technological progress is never a good option -- it's actually a quick way for seemingly innocuous competitors to capture marketshare. So how should businesses tackle digital transformation in relation to cybersecurity?

How to mitigate IoT security risks to tap business benefits

By far, one of the most effective IoT security services that any business can invest in, says Burns, is mobile device monitoring. “While end-to-end encryption and siloed networks are essential, there’s nothing more crucial than knowing the current status of all your IoT devices in real-time,” he says. While there “countless ways” IoT devices can benefit modern businesses, Burns says that in the light of potential IoT device vulnerabilities, it is important for enterprises to identify the risks and challenges to ensure that all internet-connected devices are secure  Surveying 950 IT and business decision makers globally, Gemalto found that companies are calling on governments to intervene, with 79% asking for more robust guidelines on IoT security, and 59% seeking clarification on who is responsible for protecting IoT. Despite the fact that many governments have already enacted or announced the introduction of regulations specific to IoT security, most (95%) businesses believe there should be uniform regulations in place, a finding that is echoed by consumers, with Gemalto research indicating that 95% expect IoT devices to be governed by security regulations.

Weigh infrastructure as code risks against the benefits

Infrastructure as code creation is not a step-by-step process detailed in a textbook. IaC development depends as much on business needs and processes as the infrastructure engineer who writes it. Infrastructure code functions similarly, but its development is unique to its writer. Personalized or specialized code isn't problematic for an IT organization -- unless the code writer leaves the company before it retires. Then, a new admin must make sense of an unfamiliar, highly personal code base. Once again, the problem lies in scope and effect. To take over an application role or server role is a challenge, but something with which most IT admins have some level of familiarity. It isn't the code itself that proves problematic for fresh eyes, but rather its construction and documentation. And, because of its ultimate range of effect, odds are slim that a new admin will be able to run trials in a sandbox before the code is needed in production.

What Is Cyberthreat Intelligence, and Why Do You Need It?

Along with providing your company the proper tools to stymie any cyberattacks, cyberthreat intelligence can determine if you've already had a security issue. Through the use of indicators of compromise (IOC), intelligence analysts can determine whether your systems have been hit with malware that, if left undetected, could spell trouble in the form of stolen sensitive data. One type of malware that's commonly used is spyware, which can be installed on a system without your knowledge to obtain internet usage data and other sensitive information. In a business setting, this could be credit card information, customers' and employees' personal information, and other valuable data. Malware can become a costly problem for any business. For example, one piece of malware named Ryuk caused major headaches for some organizations throughout the United States at the end of 2018 and early 2019. As a piece of ransomware, which locks systems down before demanding payment for the user to gain access, Ryuk specifically targeted organizations that run on strict timetables ...

What is SAFe? The Scaled Agile Framework explained

The Scaled Agile Framework encompasses a set of principles, processes and best practices that helps larger organizations adopt agile methodologies, such as Lean and Scrum, to develop and deliver high-quality products and services faster. SAFe is particularly well-suited for complex projects that involve multiple large teams at the project, program, and portfolio levels. The current version, SAFe 4.6, focuses on five core competencies that help enterprises to “successfully navigate digital disruption and to effectively respond to volatile market conditions, changing customer needs, and emerging technologies,” according to Scaled Agile, the framework’s provider. ... While SAFe focuses on alignment, teamwork, and provisioning across a large number of agile teams, there are other popular frameworks for scaling agile at larger organizations, including Large-Scale Scrum (LeSS) and Disciplined Agile Delivery (DAD). It is important to understand each of these frameworks so that your organization can select the best option for your projects.

How the Cloud Security Alliance helps businesses identify and mitigate cybersecurity risks

When we talk about how we advanced in the cloud kind of over the last 10 years, we're talking about people that are transitioning to the cloud. We talk about people that are in the cloud, but when they want to build on top of the controls they have currently. So when you think about security protection, a lot of these are imposed upon us where I have a regulation that I have to meet. And so that's how I kind of take those business requirements, those security requirements, and I transferred that to the cloud. Well, now we have so much more tooling and cloud that we're saying, "Hey, there are ways to enhance that security posture with new tools that are cloud relative, things like DevOps methodologies," and that's where it starts. So now that we have more people that own the process, that own the security process, we can not just get to the executives that are trying to say, Hey, let's implement these security policies, but now we're getting to the developers, we're getting to practitioners, we're getting to even the compliance folks that need to be aware of security, aware of even privacy and how to implement that as we're building applications, as we're building tools within our organization.

How to build AR apps for the enterprise and beyond

Selling the idea to key stakeholders can be the biggest challenge of the whole AR implementation process. Many see AR as an entertainment tool rather than a business one. It can be a hard convincing an organisation to change its current processes if they do not see the business value. Resistance to new technology is common; you must have a tangible “why” to present to your business. The key to success is knowing who your stakeholders are. We were lucky that our CEO and founder, Jon Oringer, welcomes and encourages innovation. He fully embraced the idea of introducing AR to our business, but not all stakeholders are quite as open to transformation. Not everyone will have basic background knowledge of the technology, so make the AR concept you are presenting digestible and visual – what you are selling is a visual concept, after all, so let it tell the story. I like to provide examples that stakeholders might not know about, such as the Pepsi bus stop or Microsoft’s partnership with BAE (see both videos below). Examples help stir the imagination of your stakeholder. Then, if possible, aim for the output of an AR implementation to be measurable. This will help develop the technology down the line and prove the benefits of the adoption to stakeholders.

Overburdened SOC Analysts Shift Priorities

It's a vicious cycle: Much of the stress in the SOC comes from analysts surrounded by too many security tools that don't work well together or that they don't have time or resources to fully master, as more alerts bombard their screens every day. They just don't have the time or expertise to master the tools, or stay on top of the alerts these systems pump out. "More security sensors and log sources containing more signatures of potentially malicious activity combined with exponential IT growth — and a dramatic increase in malicious attacks," Calvert explains. He says SOCs should measure the time and effort spent on false positives and automate the process where they can. The noise and overload of tools and alerts can escalate quickly, according to Larry Ponemon, president of the Ponemon Institute. "A lot of research studies find the whole issue of interoperability and scalability is largely ignored and as result, the technologies don't actually work together, and you have more [tools] than you need," Ponemon says. An overwhelmed SOC can result in dangerously long times to resolve and remediate an attack.

Buying a Windows laptop? Five must-have features for my next notebook

Most business-class laptops today are designed as if they were little high-definition TVs, with a widescreen display whose aspect ratio is 16:9. That's the optimal configuration if you're watching a full HD movie, but it feels unbearably cramped when you're trying to get work done. The much more productivity-friendly display option is the 3:2 aspect ratio found on every Microsoft Surface laptop since the Surface Pro 3. That design results in a taller screen that easily accommodates two documents snapped into side-by-side windows. I wish more manufacturers would embrace that design, but the economics of the PC business apparently make it cost-prohibitive; the only recent exception I could find is from is Huawei. ... The advantage really becomes obvious on a device equipped with an eSIM, which can be configured through software and doesn't require a physical SIM card (although that option is available). On the ARM-powered Lenovo Yoga C630 PC I've carried on several recent trips, I can switch in seconds between mobile carriers. That's especially useful when traveling overseas where high-speed mobile data might be unavailable or an expensive option from your service provider.

VMware touts hyperscale SD-WAN

“The package is a much simpler way for customers to quickly set up a modern SD-WAN, especially for those customers who don’t have a lot of IT personnel to handle setting up and configuring an SD-WAN,” Uppal said. “Branch office networking can be complex and expensive, and this package uses subscription pricing, and supports cloud-like capabilities and economics.” Dell EMC and VMware also announced SmartFabric Director, software that can be part of the service offering. Director enables data-center operators to build, operate and monitor an open network-underlay fabric based on Dell EMC PowerSwitch switches. Accoding to Dell, organizations that have embraced overlay software-defined networks need to make sure their physical, underlay networks are tuned to work with the SDN. "A lack of visibility between the two layers can lead to provisioning and configuration errors, hampering network performance,” Dell stated. The Director also supports flexible streaming telemetry to gather key operational data and statistics from the fabric switches it oversees, so customers can use it in security and other day-to-day operations, Dell said.

---

Quote for the day:

"A lot of people have gone farther than they thought they could because someone else thought they could." -- Zig Zigler

---