Daily Tech Digest - October 12, 2019

Agile Project Management for Distributed Teams

One of the major parts of team development is that every team member should feel unburdened and all of the work should be divided equally. Also, every team member should understand their role perfectly, so as to remove any ambiguity. Every task that is allocated to the team members should be done transparently and not behind closed doors. One thing that the companies are beginning to realize is that increasing the amount of pressure on the team members can exhaust them and that is not good for anyone, because overloaded resources are so fed up that they lose focus and as a result, there is a real decline in productivity. Lastly, when there is so much clarity and transparency in the project development and team communication, agile project management and an agile team deliver the desired results very effectively and they are motivated to acquire the upcoming goal more eagerly. ... Scrum scaling is an amazing procedure in the agile project management model where every project is first evaluated and before scaling the project, a proper infrastructure is put into place to better understand all the elements related to the project.

How Cybercriminals Continue to Innovate

Distributed denial-of-service attacks also continue to dominate, Europol says. These are one of the top types of attacks that get reported to European law enforcement agencies because they're aided by the the easy availability of stresser/booter services. "Many banks report that DDoS attacks remain a significant problem, resulting in the interruption of online bank services, creating more of a public impact rather than direct financial damage," the report says. But police have successfully disrupted many major DDoS services ... Security experts say that in the recent past, criminals might advertise their goods and services exclusively on one darknet forum or use the same handle across forums to create better "brand awareness." Today, however, compartmentalization appears to be the name of the game, with criminals creating single-vendor shops or a presence on smaller, Tor-based markets. "Some organized crime groups are also fragmenting their business over a range of online monikers and marketplaces, therefore presenting further challenges for law enforcement," Europol says.

FBI warns about attacks that bypass multi-factor authentication (MFA)

The FBI made it very clear that its alert should be taken only as a precaution, and not an attack on the efficiency of MFA, which the agency still recommends. The FBI still recommends that companies use MFA. Instead, the FBI wants users of MFA solutions to be aware that cyber-criminals now have ways around such account protections. "Multi-factor authentication continues to be a strong and effective security measure to protect online accounts, as long as users take precautions to ensure they do not fall victim to these attacks," the FBI said. Despite the rise in the number of incidents and attack tools capable of bypassing MFA, these attacks are still incredibly rare and have not been automated at scale. Last week, Microsoft said that attacks that can bypass MFA are so out of the ordinary, that they don't even have statistics on them. In contrast, the OS maker said that when enabled, MFA helped users block 99.9% of all account hacks. Back in May, Google also said a similar thing, claiming that users who added a recovery phone number to their accounts (and indirectly enabled SMS-based MFA) improved their account security.

What developers need to know about an Alexa vulnerability

All Alexa virtual assistants automatically transmit all recording data back to Amazon servers. The company saves storage space by retaining certain voice recordings and deleting others at any time. Amazon employees routinely listen to recordings to determine how well Alexa understands requests and improve the service. Recordings are linked with an account number and the user’s first name. Amazon gives users the option to delete their interaction with Alexa, but doesn’t give them the option to prevent Amazon from retaining certain voice recordings. Indefinite record retention implies a lack of private data retention policy for Amazon’s servers. The company decides on the dates the records must be removed from its primary storage systems, not the consumer. A similar security concern also exists in Alexa for Business. Developers use the service to build, test and deploy Jenkins code to the cloud. Just like the aforementioned Alexa vulnerability, developers can delete recordings on their end, but don’t have the option to control what records Amazon may retain.

Web and mobile testing faceoff: Sauce Labs vs. BrowserStack

Both products require users to define how the test data maps to the GUIs involved, and users are generally comfortable with this process in each toolset. Users with specific interest in browser or mobile apps appreciate BrowserStack's approach of different modules for different missions, but those who require both view the segmentation somewhat negatively, so it's smart to know just what UI type the app uses. BrowserStack has strong organizational features. Users can define teams, allocate resources by team, and -- depending on the purchased plan -- do parallel testing. With provided analytics, development managers can review how many tests are run and the pattern of testing, and whether the tests cover the full functionality of the UIs. Sauce Labs also has good team support and team metrics such as data on the rate of changes made, the number of changes and tests run.

Cloud architecture that avoids risk and complexity

Cost is easy. You can spend ten times what you need to, to solve the same problem. Typically, the architecture team layers on more technology than necessary or doesn’t take advantage of cloud-native features. This means that the applications burn ten times more public cloud resources.  Often I come upon disturbing realities, such as a technology being used because of an existing enterprise license agreement with that technology provider, which really means “funny money” that needs to be spent. Risk is another core factor and is not as easy to spot as cost. Overengineering of the cloud solution can cause additional unnecessary complexity, which can lead to more attack surfaces for hackers and the additional likelihood that data on premises or in the cloud will be breached.  I often use the phrase “you’re not that good” to describe the fact that the more technology you have, the more complexity, cost, and risk you also have. If you think about it, most major breaches have been caused by some neglect that led to a vulnerability.

How to Stop Superhuman A.I. Before It Stops Us

The problem is not the science-fiction plot that preoccupies Hollywood and the media — the humanoid robot that spontaneously becomes conscious and decides to hate humans. Rather, it is the creation of machines that can draw on more information and look further into the future than humans can, exceeding our capacity for decision making in the real world. To understand how and why this could lead to serious problems, we must first go back to the basic building blocks of most A.I. systems. The “standard model” in A.I., borrowed from philosophical and economic notions of rational behavior, looks like this: “Machines are intelligent to the extent that their actions can be expected to achieve their objectives.” Because machines, unlike humans, have no objectives of their own, we give them objectives to achieve. In other words, we build machines, feed objectives into them, and off they go. The more intelligent the machine, the more likely it is to complete that objective.

Volusion Payment Platform Sites Hit by Attackers

"The most obvious threat actor that is currently famous for card skimming and compromising ... e-commerce websites is Magecart, which has the history of using Vultr Holdings data centers (just live Volusion-Cdn[.]com) and using public cloud storage to host their malicious scripts," Afahim says. Afahim discovered the attack against the check-out site for Sesame Street Live this week, although these incidents could have started as far back as Sept. 12. The payment function for the Sesame Street Live online store remained offline Wednesday. On Thursday, a spokesperson for Volusion told Information Security Media Group that the attacks had been stopped within a few hours of the company being notified, but that an investigation was still underway. "A limited portion of customer information was compromised from a subset of our merchants. This included credit card information, but not other associated personally identifying details ..." the spokesperson says.

Mind-reading systems: Seven ways brain computer interfaces are already changing the world

A collaboration between researchers -- including neuroscientists, biomedical engineers, and musicians -- has been looking at the potential for BCIs to be used with music. They are working on a system that could analyse a person's emotional state using their neural signals, and then automatically develop an appropriate piece of music. For example, if you're feeling down, the system's algorithms could write you a piece of music to help lift your mood.  The system has been tested on healthy volunteers, as well as on one individual with the neurodegenerative condition Huntington's disease, which causes depression and low mood. "Part of the reason someone might have a music therapy session is because they have trouble understanding their own emotions or expressing their own emotions, so the idea is to use music and the skills of the therapist, and potentially this device is better in helping them understand their emotions," says Ian Daly, lecturer at the University of Essex's School of Computer Science and Electronic Engineering.

Author Q&A on the Book Software Estimation Without Guessing

Much of the trouble with estimating is not estimation itself, but the communications, or lack thereof, between people. If you don’t know how an estimate is going to be used, it’s likely to be the wrong estimate for the situation. If you fear an estimate for one use is going to be misused for another, then you’ll likely develop an estimate that doesn’t satisfy either need. ... In one sense, there is only one way to estimate. That’s by comparing the unknown to the known. There are, of course, many ways to do that comparison. You might conceptually break the unknown down into smaller pieces that are easier to compare. You might build a model that encapsulates the comparison based on measurable attributes of the planned work. ... The one thing you know about an estimate is that it is going to be wrong to some degree. How wrong and wrong in what way are the more important questions. Making an early prediction and then trusting it for a long time seems like a foolish strategy. Estimates have a limited shelf-life. If you’re going to make a long-term estimate, you should also make some shorter-term interim estimates that you can use to check your assumptions.

---

Quote for the day:

"The task of leadership is not to put greatness into humanity, but to elicit it, for the greatness is already there." -- John Buchan

---

Daily Tech Digest - October 11, 2019

Artificial stupidity: ‘Move slow and fix things’ could be the mantra AI needs

While there are countless other examples of how far AI still has to go in terms of addressing biases in the algorithms, the broader issue at play here is that AI just isn’t good or trustworthy enough across the spectrum. “Everyone wants to be at the cutting edge, or the bleeding edge — from universities, to companies, to government,” said Dr. Kristinn R. Thórisson, an AI researcher and founder of the Icelandic Institute for Intelligent Machines, speaking in the same panel discussion as Carly Kind. “And they think artificial intelligence is the next [big] thing. But we’re actually in the age of artificial stupidity.” Thórisson is a leading proponent of what is known as artificial general intelligence (AGI), which is concerned with integrating disparate systems to create a more complex AI with humanlike attributes, such as self-learning, reasoning, and planning. Depending on who you ask, AGI is coming in 5 years, it’s a long way off, or it’s never happening — Thórisson, however, evidently does believe that AGI will happen one day. When that will be, he is not so sure — but what he is sure of is that today’s machines are not as smart as some may think.

Close the Gap Between Cyber-Risk and Business Risk

With the number and types of cyberattacks on the rise, and the growing numbers of companies that experience some sort of breach, cyber-risk has become equivalent to business risk. As such, a company's vulnerability to cyber threats is now a top-of-mind issue for C-level executives, which puts increased pressure on CISOs I talk with to ensure their security controls work as they should. Yet there seems to be a large gap between how companies should address cyber-risk and what they're actually doing. How do I know this? Aside from conversations and interactions with security leaders that point to this trend, I also collect security statistics from hundreds of audience members via real-time polling software when I'm making a presentation. My audiences generally include red and blue security teams, auditors, security executives, and individuals representing various non-technical, non-security leadership roles across government organizations, financial services, transportation, telecom, retail, healthcare, and oil and gas, just to name a few — providing an interesting cross-section of perspectives.

Industry 4.0: How IoT Will Inspire A New Era Of Maintenance Technology

The next phase of maintenance software evolution involved transforming desktop software into digital cloud-based software. This shift democratized the highest level of security and reliability by making maintenance software technology scalable and therefore affordable. What once was technology enjoyed solely by this specific aerospace sector is now accessible to smaller independent organizations across a wide variety of industries. Today, we’re seeing the mobilization of maintenance technology. My company produces a computerized maintenance management system (CMMS) that makes it easier for today’s growing deskless workforce to submit work orders from their mobile devices. Mobile CMMS software also allows organizations to keep better track of preventative maintenance tasks, which can dramatically extend equipment lifetime, increase productivity and ultimately boost profits.  But maintenance software still has so much untapped potential. I believe the next generation of Industry 4.0 software will empower even more people, organizations and entire industries through the successful mainstream implementation of connected IoT devices.

Why it’s time to start talking about blockchain ethics

Blockchain technology is still mostly a niche interest; the value of the cryptocurrency market is minuscule compared with the value of traditional global investment markets. It doesn’t have much influence, if any, in the global financial system—rather, cryptocurrencies are mostly seen as a way to profit by speculating on their volatile prices. But that may be changing. Big mainstream institutions like Fidelity Investments and Intercontinental Exchange (which owns the New York Stock Exchange) have embraced the technology. Facebook wants to launch its own global digital currency. Central banks may be close to getting into the business too. Lindmark said that like other “tech ethics” fields, the field of blockchain ethics should examine what the technology is capable of doing, and ponder the potential consequences. For instance, blockchains make it possible to create leaderless, “decentralized” organizations. Does that mean no one is responsible if something goes wrong?

Digital Transformation And Public Sector Success

Public and private sector organisations need to be flexible, open, and have strong yet humble leaders who can accept when they need to change direction. Ultimately, digital should sit at the heart of operations which, in Taylor’s view, isn’t yet the norm. “We’re still experimenting with digital technologies on the edge of business, which means this doesn’t get enough traction or isn’t taken seriously. We need to bring the experimental mindset much more to the front and centre of business, and do it very openly so people see what’s happening, understand it and see the backing of the leadership team.” This includes tapping into the ideas of digital natives, who were born and raised in the digital world and, as a result, can see opportunities that others might miss. “We have digital natives coming up in the more junior ranks of our organisations, but are we listening to them? They have a lot of ideas about how we can do things better, but are we giving them a voice? How are we learning from talented people across the whole business? We need to make sure there are digital skills at all levels.”

British Airways data breach: class action lawsuit approved

The 2018 British Airways data breach was one of the first to occur under the GDPR (General Data Protection Regulation), so the ICO (Information Commissioner’s Office)’s investigation into the incident was seen as a test case. ... Last week, on 4 October, the High Court duly granted a group litigation order, effectively giving the go-ahead to mass legal action from the 500,000 British Airways customers whose personal data was compromised in the breach. Mr Justice Warby ruled that victims have 15 months to join the class action. Last summer, BA fell victim to a formjacking attack that skimmed its customers’ payment data when they attempted to make bookings through the BA app or website. The security firm RiskIQ attributed the attack to the Magecart group, which has been responsible for similar attacks, including on Ticketmaster. According to the ICO, “a variety of information was compromised […], including log in, payment card, and travel booking details as well [sic] name and address information” and BA’s “poor security arrangements” were to blame.

As the smart building market grows, so do the security risks

As vehicles, buildings, and in some cases, entire cities strive to become smarter and more connected, security becomes a bigger and bigger piece of the puzzle. The very applications that make people really excited about 5G, like drones delivering packages or autonomous vehicles, are the same applications that are the riskiest if they should become compromised. And in some cases, such as a hacker gaining control of smart traffic lights or compromising a smart hospital’s control system, these breaches could mean life or death, as MobileIron’s engineer Russ Mohr told RCR Wireless News earlier this week. Global cybersecurity firm Kaspersky recently analyzed data from 40,000 smart buildings worldwide that use the firm’s security products and found that nearly 4 in 10, or 37.8%, of these buildings had been affected by a malicious cyberattack. In most cases, these cyberattacks were attempting to infect the computers that control smart building automation systems.

McAfee, IBM join forces for global open source cybersecurity initiative

One of the key realizations of the initiative is the time wasted on connection and integration that could be better spent creating tools to directly address pertinent security issues. With this newfound integration, the organizations hope to "develop protocols and standards which enable tools to work together and share information across vendors. "The aim is to simplify the integration of security technologies across the threat lifecycle – from threat hunting and detection to analytics, operations, and response -- so that products can work together out of the box," OASIS added in their statement. ... The Open Cybersecurity Alliance will create a new "set of open source content, code, tools, patterns, and practices" that allow the companies to share information and solutions to situations. The sharing of insights will help all of the companies better prepare for future cyberattacks and increase the industry's visibility in the threat landscape.

An important quantum algorithm may actually be a property of nature

Quantum mechanics provided an additional twist. At the time, Grover’s recipe was only the second quantum algorithm that had been proved faster than its classical counterpart. (The first was Peter Shor’s algorithm for factoring numbers, which he discovered in 1994.) Grover’s work was an important factor in preparing the way for the quantum computing revolution that is still ongoing today. But despite the interest, implementing Grover’s algorithm has taken time because of the significant technical challenges involved. The first quantum computer capable of implementing it appeared in 1998, but the first scalable version didn’t appear until 2017, and even then it worked with only three qubits. So new ways to implement the algorithm are desperately needed.  Today Stéphane Guillet and colleagues at the University of Toulon in France say this may be easier than anybody expected. They say they have evidence that Grover’s search algorithm is a naturally occurring phenomenon. “We provide the first evidence that under certain conditions, electrons may naturally behave like a Grover search, looking for defects in a material,” they say.

IT leaders must recognise & acknowledge the growing mental health issues

Mental health is increasingly talked about as a societal issue, but it’s not one that’s had much focus in IT. It’s unsurprising, therefore, to learn that as many as one in five IT professionals have expressed mental health concerns as a result of their work. A Harvey Nash survey of more than 2000 UK IT workers highlighted problems around excessive working hours as a result of skills shortages, as well as lack of flexibility, and job insecurity. IT staff are no longer hiding away in a dingy back office staring at screens trying to keep the lights on. They’re on the frontline of business and government, running websites and payment systems and monitoring the security of applications and data that can be under constant attack. It’s too easy to dismiss all this as part of a stressful but well-paid career. More than four in five IT professionals are male, often more on the introverted end of the personality spectrum, and perhaps less inclined to talk about their feelings and worries in the workplace.

---

Quote for the day:

"To do great things is difficult; but to command great things is more difficult." -- Friedrich Nietzsche

---

Daily Tech Digest - October 10, 2019

The problem with AI? People

This possibility for computers to make bad decisions is complicated by the data being fed into them by people who are biased themselves, as Rishidot founder Krishnan Subramanian has highlighted: "[T]here is very little diversity among people building these AI algorithms." This can be mitigated through conscious efforts to hire diverse data engineers and scientists, but it's a tricky conundrum. It's made all the trickier because people (whether those building the AI models or not) are influenced by the data coming from the machines. In this way, we can become ever more distant from raw data, and ever more incapable of giving good data to our models, as Manjunath Bhat has written: "People consume facts in the form of data. However, data can be mutated, transformed and altered--all in the name of making it easy to consume. We have no option than but to live within the confines of a highly contextualized view of the world." Catch that nuance? We rely on ever-increasing quantities of data to make decisions, but that data is just as increasingly mediated by machines that try to spoon-feed it to us in ways that make it easier to consume.

Liberating Structures - an Antidote to Zombie Scrum

Scrum is a simple, yet sufficient framework for complex product delivery. It helps organizations thrive on complexity. Scrum provides the minimal boundaries for teams to self-organize and solve complex problems with an empirical approach. However, we’ve noticed that although many organizations use Scrum, the majority struggle to grasp both the purpose of Scrum as well as its benefits. Instead of increasing their organizational agility and delivering value to customers sooner, they achieve the opposite. We’ve come to call this Zombie Scrum; something that looks like Scrum from a distance, but you quickly notice that things are amiss when you move closer. There is no beating heart of valuable and working software, customers are not involved, and there is no drive to improve nor room for self-organization. One antidote we’ve found helpful is to rethink how teams interact, both within the team as well as with stakeholders and the broader organization. For this, we found help in Liberating Structures. 

Enterprise backup software provides data protection foundation

The first consideration is data movement, which is the process a backup application uses to get data from primary storage to the backup storage platform. Early backup and recovery software ran on each server and simply wrote to a local tape drive or disk device. This method wasn't scalable and introduced considerable hardware and management costs. Vendors have evolved their products into network-based backup. These systems implement one or more centralized backup servers that pull data across the network from each source application server. Scalability is achieved by adding more backup servers and storage media, such as tape and disk drives. As long as sufficient network bandwidth is available, backups can scale to meet demand. Network backup systems have advanced over time to improve the efficiency of data movement. Some products read data directly from the storage platform through snapshots and replication. Other systems use data protection APIs available in hypervisor and hyper-converged infrastructure platforms.

Mental health issues concern UK tech professionals

The most significant reason behind the decline in mental wellbeing is an insufficient workforce. According to the study, tech teams are “stretched to breaking point” to make up for talent shortfalls, with several mentions of employees working more than 50 hours a week, which has a direct impact on stress levels. Employers that are very inflexible when it comes to working arrangements are three times more likely than highly flexible ones to have workers with mental health issues (31% versus 9%), according to the study. “No one would pretend that working in the tech sector is a walk in the park, but for it to be pushing more than half its workers into a state of mental health concern is a real issue for the sector,” said Albert Ellis, chief executive at Harvey Nash. “This is particularly true for those very small companies where a greater proportion of workers report that they are currently affected by stress,” he added. Companies are relatively supportive when it comes to mental health issues, with three-quarters (77%) having at least some kind of support in place.

Data science and ML for human well-being with Jina Suh

The mission of the HUE team is to really empower people by creating and inventing new technologies that promote emotional resilience and well-being. It’s really grounded in the fact that emotions are fundamental to human interactions and they influence everything that we do starting from learning, memory, decision making and all these other aspects of our lives. So, you know, how do we bring emotional intelligence to technology is kind of the core our research. ... As humans, we actually generate a lot of data about how we’re feeling or what we’re thinking, we have body language, we have the way that we speak, kind of the faces that we make. It’s really difficult to process all of that data all at once. So we need the help from computers and technology to not only capture all of that information, but also help us make sense of the data by analyzing the information. ... Computers have been ubiquitous in our lives and we expect more meaningful interactions with our technologies and we want our technologies to understand this in some sense.

The biggest risk to uptime? Your staff

The Uptime Institute has surveyed thousands of IT professionals throughout the year on outages and said the vast majority of data center failures are caused by human error, from 70 percent to 75 percent. And some of them are severe. It found more than 30 percent of IT service and data center operators experienced downtime that they called a “severe degradation of service” over the last year, with 10 percent of the 2019 respondents reporting that their most recent incident cost more than $1 million. ... "Perhaps there is simply a limit to what can be achieved in an industry that still relies heavily on people to perform many of the most basic and critical tasks and thus is subject to human error, which can never be completely eliminated," wrote Kevin Heslin, chief editor of the Uptime Institute Journal in a blog post. "However, a quick survey of the issues suggests that management failure — not human error — is the main reason that outages persist. By under-investing in training, failing to enforce policies, allowing procedures to grow outdated, and underestimating the importance of qualified staff, management sets the stage for a cascade of circumstances that leads to downtime," Heslin went on to say.

Pattern of the Month: Single Piece Flow

As you'd expect, pull ultimately starts with consumer demand for a product or service; however, to enable smooth flow, at each station where work is done, the number of items that can be handled at any one time must be subject to a Work In Progress (WIP) limit. Anything below the WIP limit implies a potential for accommodating more work. It is this "pull signal" which draws work on from the previous station in the value chain. The theoretical WIP limit for achieving optimum pull is exactly one. This is known as single piece flow (SPF) and it has the clear advantage of reducing lead time, depreciation of stock-on-hand, and the cost of delay on each item to the absolute minimum. SPF requires cross-functional team members, all of whom can swarm on a single work item to progress it. In fact, in such cases, it can be argued that a WIP limit greater than one must mean a push system. SPF can be very difficult to achieve and yet the potential rewards are indisputable. With only one item on hand at any one time, there will be no opportunity for work to pool in the team's engineering process and very little chance for technical debt and waste to accumulate.

Can Fintech Make the World More Inclusive?

In recent years, fintech companies have played an important role in complementing the formal banking sector and providing trade credit to small firms. Chinese mobile and online payment platform Alipay, for example, has since 2006 provided credit to vendors operating on the Chinese e- commerce platform, Alibaba. Alipay, and subsequently Ant Financial, developed an algorithm-based internal rating system taking data from vendors’ real-time transactions on commercial platforms, such as the Chinese online shopping website Taobao, to provide credit facilities. Three key features show how Alipay/Ant Financial credit to SMEs helps to alleviate credit market frictions in China. First, using the data and information Alibaba has on its 16 million merchants, Ant Financial reduces information asymmetry between itself and potential borrowers, allowing it to extend credit to firms that traditional banks will not help due to information scarcity.

Building Intelligent Conversational Interfaces

In Machine Reading Comprehension, or Question Answering, you are given a piece of text or context and a query, the goal is to identify the part of the text that answers the question. The combination of long-short term memory network and attention model is used for finding the answer in the context or piece of text. At a high level, you feed the context or passage of text through LSTM layers with word embedding and character embedding, also the query or questions, and you compute pairwise query to context and context to query attention, and again, apply bidirectional LSTM networks to get the start and end of the answer a piece of text. This is a very active area of research, in the last couple of years, there has been a lot of progress in machine reading comprehension. Dialog understanding or Dialog State Tracking is an active research area. Many times, users don’t give all the information needed to achieve a task in a single turn. The bot has to converse with the user and navigate the user to achieve the task (to track an order for example). Maintaining the "state" of the dialogue and extracting information across different set of messages is key to dialog understanding.

Integrating security with robotic process automation

Bot operators are employees responsible for launching RPA scripts and dealing with exceptions. Sometimes, in the rush to deploy RPA and see immediate results, enterprises will not distinguish between the bot operators and the bot identities. The bots are run using human operator credentials. This configuration makes it unclear when a bot conducted a scripted operation versus when a human operator took an action. It becomes impossible to univocally attribute actions, mistakes and, most importantly, attacks or fraudulent actions. The other issue that arises from re-using human operator credentials with bots is that administrators will tend to keep passcode complexity and frequency of rotation to a minimum. Administrators are limited to what is reasonable human user experience, rather than what a bot can handle. This eases brute force attacks and consequent data leakages. Instead, Gartner recommends assigning a unique identity to each RPA bot.

---

Quote for the day:

"Trust is the lubrication that makes it possible for organizations to work." -- Warren G. Bennis

---

Daily Tech Digest - October 09, 2019

Blockchain: Why the revolution is still a decade away

According to Adrian Lee, who researched the report, this was caused by a "lack of industry consensus" on key features of the technology, such as product concept, application requirements or target market. In other words, blockchain has been a victim of its own hype. Its potential benefits raised huge expectations, but in reality it is not mature enough yet to be efficiently implemented at scale. Litan compares this to the adoption of the internet: users don't have to worry about understanding protocols such as DNS or TCP/IP. This is why browsing the web is scalable, and it is why it became so mainstream. But if an enterprise wants to implement blockchain, it's a whole different story. Individual companies have to worry about picking a platform, coming up with a smart contract language, or using a specific system interface and consensus algorithms. ... Avivah Litan, research vice-president at Gartner, doesn't see this happening before 2028, which is when she expects the technology to be fully scalable.

7 Considerations Before Adopting Security Standards

ISO 27001. PCI DSS. GDPR. When it comes to business and security standards, it's easy to get lost in the alphabet soup of acronyms. How can you discern which ones are right for your organization? Start by asking some high-level questions as to what you hope to accomplish by adopting them – and how adhering to standards can help your growth, says Khushbu Pratap, a senior principal analyst at Gartner who covers risk and compliance. "The most important questions to ask [are]: Are your customers asking for it, and do your stakeholders think a particular standard is important?" says Pratap. Assuming the answers are yes, there are additional factors to think through before moving ahead with a strategy for compliance. The seven practical tips outlined in this feature will help. Heavily regulated organizations typically have special teams that work on these standards, but even for them, use this list as a chance to take a step back and better target your standards compliance and certification teams.

Developers' Code Reuse Security Conundrum: Cut, Paste, Fail

For writing more secure code, culture remains another challenge. Stu Hirst, principal cloud security engineer at British online food order and delivery service Just Eat, speaking at last week's ScotSoft conference in Edinburgh, Scotland, advocated literally showing developers the risks that poor or poor-quality reused code can create, for example, by showing them how it can be hacked. He says such discussions are essential for fostering a culture in which coders are coding securely, without trying to impose punitive measures. ... Earlier this year, the CISO of a European financial services firm told me that his organization's approach has been to maintain its own repository of code snippets that have been vetted and trusted, from which in-house developers can draw, thus saving time and contributing to more secure and stable software builds. The organization also regularly evaluates open source offerings, and it isn't afraid to tear up code built in-house when a better open source alternative becomes available. 

The Magic Of Smart Mirrors: AI, AR & The IoT

Coty’s version of the smart mirror is the CES 2019 Innovation Awards Honoree—Wella Professionals Smart Mirror. This mirror allows stylists to provide more personalized consultations. Like the apps discussed above, the Wella Professionals Smart Mirror is able to do a live AR hair color try on and can provide a 360-degree of the style so the client can see what it will look like from all angles. In addition, using facial recognition technology, it can retrieve past styles for each customer, allowing the stylist and client to really assess what worked and what didn't. ... It also connects to a mobile app so the stylist and customer can stay in contact in between appointments. Memory Mirror, a digital mirror created by MemoMi, combines a full-length mirror with high-tech including a 70-inch LCD, computer and HD camera that can record videos so you can save, share and review your try-on sessions. Neiman Marcus installed MemoMi’s mirrors in 34 locations. Another mirror altering the retail experience is the Oak Mirror by Oak Labs. It serves as a digital assistant in a dressing room, allowing customers to request other colors, styles, or accessories from a sales assistant.

Canada’s Blockchain Sector Wants Legal Clarity

The report – one of the first to take a comprehensive snapshot of Canada’s blockchain ecosystem – sheds new light on the country’s nascent crypto firms, who appear largely bullish on their own future and are increasingly eager to know if their government feels the same. ... Though separate from U.S. regulators and from other global regulatory bodies, Canada’s government has been reticent to establish crypto regulations that might conflict with other countries’ laws, said Michael Gord, CEO of Toronto-based MLG Blockchain consulting group. Instead, Gord described a regulatory gray zone that confounds his consulting group and the legal teams he turns to for advice: “Often digital asset regulations in Canada are so ambiguous that lawyers cannot give us a yes or no answer. The regulations have not been defined enough for them to be able to.” Neither the U.S. nor Canada have developed comprehensive definitions for digital assets, and Gord doubts the Canadians will jump ahead: “Even if [Canadian regulators] were to want to create clear regulation, there’s a lot of pressure from the SEC” to follow its lead, he said.

How to prepare tomorrow’s workforce? Focus less on devices and more on digital thinking

In most liberal arts institutions, students are situated in a brick-and-mortar, face-forward teaching environment that says, “read this book, do this essay, or submit this paper. In their own personal lives, they are digital natives, using an iPhone and technology to do just about everything – from communicating to ordering food. They must push that world aside, however, to conform to teaching methods and teachers that are not digitally literate. The solution is not just to introduce more digital devices and technical training into a classroom to get faculty and students to think more digitally about what they are doing, but to improve their overall digital literacy or ability to live, work, think and communicate in a society that is driven by the Internet, social media, mobile devices and other digital technologies. In short, change the education and learning formula to be more closely aligned with the demands of today’s digital world.

74% of global workers say the tech industry needs more regulation

Overall, nearly three-quarters (74%) of global workers said the tech industry needs more regulations. Snow surveyed 3,000 professionals across the US, Europe, and the Asia-Pacific region to determine how employees felt about about data privacy regulation standards. As technology enables more organizations to harbor personal consumer data, standards must be put in place to make sure this information isn't exploited. ... Millennials were more likely to feel like their data is protected by regulations (44%) than baby boomers (21%), the report found. Some 55% of tech company vice presidents and 52% of directors also said they feel more protected from data breaches, while only 27% of entry-level employees said the same. The rise in data regulation has resulted in more pop-up and opt-in messages for employees, but opinions are split down the middle whether these messages are disruptive to their workday or not.  "But at the same time, the increase in regulation makes administratively navigating the internet much more difficult, and some might find this to be an annoying and tedious user experience," Larson said.

How the Software-Defined Perimeter Is Redefining Access Control

An SDP or zero-trust model can be used within the modern perimeter-less enterprise to help secure remote, mobile, and cloud users as well as workloads. SDP isn't just about having a secure tunnel — it's about validation and authorization. Instead of just trusting that a tunnel is secure, there are checks to validate posture, robust policies that grant access, segmentation policies to restrict access and multiple control points. The increasing adoption of zero-trust security technologies by organizations of all sizes is an evolving trend. As organizations look to reduce risk and minimize their potential attack surface, having more points of control is often a key goal. Security professionals also typically recommend that organizations minimize the number of privileged users and grant access based on the principle of least privilege. Rather than just simply giving a VPN user full local access, system admins should restrict access based on policy and device authorization, which is a core attribute of the zero-trust model. 

How to build a better cybersecurity defense with deception technologies

Deception technology addresses these key challenges with early and accurate detection coupled with automation to accelerate incident response. The solution tricks threat actors into revealing their presence with authentic, high-interaction decoys that blend seamlessly into the production environment. As soon as an attacker attempts to scan the network, steal credentials, or move laterally, the deception platform raises a high-fidelity alert, reducing dwell times. From there, defenders can remediate or safely let the attack play out and collect company-specific threat intelligence to strengthen their defenses. ... One way to be more proactive is to assume the attacker will get in, and plan a defensive strategy that leverages the entire network to detect them early, while gathering adversary intelligence to better defend against future attacks. In the perimeter-less society that we find ourselves in, with the rapid adoption of cloud infrastructure and ubiquitous global access, traditional security can't scale to keep up with where organizations now operate.

Hype vs reality: Is the tech industry on the cusp of another ‘AI winter’?

The amplification benefits that AI can bring to the IT work that humans are responsible for within organisations was one area called out by Chandrasekaran during the panel as sign of the good that the technology can do. Although a lot of the reporting on AI focuses on how its proliferation within enterprises could lead to job cuts, the converse is often true, he said. “When we [Cisco] look at any IT organisation, they are growing,” he said. “They are hiring hundreds of people to run the network, or the digitisation that’s happening. What we see is that the [AI] tooling is basically to free them up from dealing with the complexity that comes along, so that they can actually get their job done. “We look at all this automation, and… the idea is to free people so that they don’t become completely buried with the burden that’s coming along with the number of devices coming on board.”

---

Quote for the day:

"Leaders are people who believe so passionately that they can seduce other people into sharing their dream." -- Warren G. Bennis

---

Daily Tech Digest - October 08, 2019

Why you need to get your team up to speed on privacy-aware development

Prepare for privacy policies to reign supreme in programming; they already figure prominently in legislation. Take right-to-be-forgotten clauses, which are included in both the GDPR and the California Consumer Privacy Act (CCPA). The clauses require companies to quickly identify data on their systems that are covered by the privacy regulations and delete the data after the prescribed period of time has passed. All data being held by companies—even machine-learning data—may be impacted by the policy, said RiskIQ's Hunt. Sometimes these records can be spread across databases, data warehouses, backups, and spreadsheets, he said. "If the user's information was used to train a machine-learning model to serve them ads, that model may or may not need to be retained if a single user requests to be forgotten," Hunt said. "But what if 650,000 users file requests? If they represent a similar demographic, the model would certainly need to be retrained in order to truly 'forget' about those users."

Automation improves firewall migration and network security

When it comes to firewall migration, do you migrate every object and rule, or do you try to clean up the rule sets as you go? If you make changes, there is a high probability you will make mistakes that result in application failures or insufficient security, where you block too much or don't block enough, respectively. The least disruptive mechanism involves converting rules from one vendor's configuration to another vendor's configuration while applying some simple heuristics to identify orphaned objects. ... The first step for the automation process was to extract the objects, rules and interface information from the source firewall. We decided to import the extracted information into Excel spreadsheets so data items could be identified by spreadsheet column. While the conversion to Excel was a manual process, we only needed to do it once and finished relatively quickly. ... The scripts were a big win. It was easily a 20-to-1 ratio of manual effort versus running the script.

High performance computing: Do you need it?

With compute-demanding use cases rapidly becoming the norm, UNC-Chapel Hill began working with Google Cloud and simulation and analysis software provider Techila Technologies to map out its journey into cloud HPC. The first step after planning was a proof of concept evaluation. "We took one of the researchers on campus who was doing just a ton of high memory, interactive compute, and we tried to test out his workload," Roach says. The result was an unqualified success, he notes. "The researcher really enjoyed it; he got his work done." The same task could have taken up to a week to run on the university's on-premises cluster HPC. "He was able to get a lot of his run done in just a few hours," Roach says. On the other side of the Atlantic, the University of York also decided to take a cloud-based HPC approach. James Chong, a Royal Society Industry Fellow and a professor in the University of York's Department of Biology, notes that HPC is widely used by faculty and students in science departments such as biology, physics, chemistry and computer science, as well as in linguistics and several other disciplines.

Alibaba’s Chairman Daniel Zhang: “Data is the Petroleum, Computing Power is the Engine”

According to Qi, the chip enables optimization for computer vision applications including classification, object detection and segmentation. For instance, on the Taobao app, there is an option named “photograph and search” that allows users to take photos of whatever product they see and search for similar items in the app. There are altogether 1 billion new photos added into the image gallery each day. The recognition process for traditional GPU took as long as one hour, meanwhile, it takes Hanguang 800 only five minutes to complete the task. The applications of AI vary from the municipal government level to enterprises and ordinary consumers. Among them, one of the most talked about has been the city brain, first implemented around three years ago in Hangzhou. According to Zeng Zhenyu, VP of Alibaba Cloud Intelligence and expert on Alibaba’s industrial brain and city brain, “The city brain is built on top of the Alibaba Aspara Operating System, which provides a city-level data middle station. ...”

Building a cloud-native network from core to edge

First off, to take advantage of the latency benefits 5G opens up, compute resources have to be closer to the user–whether that’s you, me, an industrial robot or a security camera; that’s just physics. Second, in order to use data to initiate an action, you need the ability to conduct real-time data analysis. But with these edge investments, what’s the business case? “Let’s look at how we monetize 5G and edge,” Chan said. She gave the example of a smart venue, which she characterized as a “fertile ground” for innovation that also brings a global reach as “sports transcend all cultures.” For example, Intel worked with Arizona State University on an IoT project. Sensors collected a variety of metrics for retailers in the venue. The learning: people in the cheap seats spend more money per person on not just tickets but things like food and merchandise than people who buy premium seats. “That kind of data is very valuable for people in that micro-ecosystem.” From LTE to 5G, Chan laid out a proof of concept Intel worked on in conjunction with the National Hockey League. 

Africa’s Game Changer. Building A Pan African Data Centre Portfolio

Africa Data Centres believes this is the way of the future, because we can offer services in all the countries in which we are present, to any international customer who wants to come to Africa. We can offer them the same design, the same procedures, the same contracts, which allows them to focus on their growth and development in Africa, in a way that is both secure, visible and scalable. Our strategy is not a short term one. Our aim is to digitalise Africa in the long term, to execute a long-term industrial project, and interconnect our data centres all over the continent. Our strategy is long term, Pan-African, and not to be acquired at any time soon. In terms of trends in Africa, Africa Data Centres is looking to firstly service clients in important regions. We are also in the process of building a network of data centres in the five leading countries in Africa, which we see as South Africa, Kenya, Egypt, Nigeria, and Morocco. These five are our current focus and will become hubs. The next step is developing a sub-network of edge data centres around those hubs in the countries we see as second tier.

Data Scientists Are in Short Supply, But Does Manufacturing Really Need Them?

To address the data science skills gap, software developers have created new programs that can perform many of the analytical tasks previously reserved for data scientists. This has turned data science into a commodity and allowed everyday users to become “citizen data scientists” with a little bit of training. But simply having more citizen data scientists running analyses doesn’t necessarily deliver value to the organization. What’s more vital is the ability to approach data and analytics from a business perspective. Bilingual talent can do that. They can turn data into predictive models, and then translate those models within the context of critical decisions and operations, such as for demand forecasting or preventative maintenance on production equipment. Moreover, they can clearly explain the derived insights, ideas, and plans of action to senior executives in a way that they understand. Bilingual talent can make for very inspiring leaders within a manufacturing organization, capable of driving significant positive change.

Good cybersecurity comes from focusing on the right things, but what are they?

“Anyone who has spent a significant amount of time in this industry understands that you can make a positive impact and be successful without sacrificing job security – as long as technology keeps evolving, the threats and vulnerabilities will evolve along with it,” he noted. Demonstrating your own value outside of a crisis is a challenge, but it’s a challenge that every infosec professional should do their best to overcome. One aspect of this is changing the organizations’ mindset regarding security. “Our job is to enable organizations to create value securely and to quantify the risk of the alternative, not to put up obstacles and police our organization,” he added. Another aspect is changing their own mindset, i.e. the tendency to look at cybersecurity as a problem that could be solved if only they could invest more in security products or hire more people. This usually leads to inordinate investment in niche problems and applying outdated solutions to new challenges.

Understanding why IPv6 renumbering problems occur

A network may be renumbered in many different ways without the local routers being able to signal hosts that the existing prefixes should be phased out. ... In this situation, the local router performs two related, but separate functions. On the LAN side, it operates as a SLAAC router, providing network configuration information to the local hosts. On the WAN side, it operates as a DHCPv6-PD (DHCPv6 prefix delegation) client to dynamically obtain an IPv6 prefix from the upstream internet service provider (ISP). The ISP will typically lease the router a /48 prefix, which the local router will advertise as a /64 subprefix on the local network via SLAAC. Once a prefix has been leased by the upstream ISP, the local router will only communicate with the upstream DHCPv6 server when expiration of the leased prefix is imminent, enabling it to renew the lease before it expires. Other than that, there will be no further communication between the DHCPv6-PD client on the router and the DHCPv6-PD server at the ISP. In situations where the local router crashes and reboots, for example, the router will typically request a new IPv6 prefix from the upstream network, and the leased prefix may be different from the previously leased prefix.

Wearing Two Hats: CISO and DPO

What's it like to serve in the dual roles of CISO and DPO? Gregory Dumont, who has both responsibilities at SBE Global, a provider of repair and after-sales service solutions to the electronics and telecommunication sectors, explains how the roles differ. While a CISO looks at risks from a business, financial and operations point of view, a DPO, or data protection officer - a role required under the European Union's General Data Protection Rule - looks at the same risks from a data subject's (consumer) point of view, Dumont, who is based in the U.K., explains in an interview with Information Security Media Group. In his DPO role, Dumont says, he considers such questions as: "What are the risks in terms of the loss of privacy and loss of freedom from a data subject's point of view?" As CISO, Dumont faces the challenge of managing multiple vendors under strict GDPR regulations. "We have suppliers; we have customers. Sometimes my customers are also my suppliers. You have to make sure that you have contracts that cover all of these interactions. ..." he says.

---

Quote for the day:

"Leadership happens at every level of the organization and no one can shirk from this responsibility." -- Jerry Junkins

---