Daily Tech Digest - October 29, 2019

uncaptioned
As part of any good AI conversation, we have to consider the potential ramifications of an AI-based model. What are the true risks of harnessing AI to help defend ourselves in cyberspace? It is always possible to misuse the information a security system collects. It’s possible to program in unintentional bias. You could break things too much because AI told you to — or you could miss things because you trust your AI system to catch everything. Yet as a business community, we must confront these risks and design to prevent these outcomes. The need for more robust cybersecurity is too great. We simply need to be thoughtful in our approaches, develop and use ethical standards around how we leverage these new and evolving technologies, and, finally, use a trust but-verify-methodology as we look to mature our multilayered cyber-defense strategies. To do this, start by planning ahead and developing a framework for building AI that has preapproved controls in place. Building human review into the decision-making process can go a long way toward preventing major issues. You can also leverage some of the work already being done to manage insider threats and apply that to controlling runaway AI.



Accelerate will enable fintechs to be onboarded to Mastercard in a matter of weeks and provide a guided experience through everything the company can offer. Program participants are connected to relevant parts of the business, to integrate Mastercard’s proprietary technology, leverage its insights and cybersecurity services, engage new customers, and reach new markets and segments. In addition, Mastercard’s commitment to financial inclusion drives focused product development, helping co-create solutions that enable a more inclusive economy. “Mastercard Accelerate is a single doorway to the countless ways Mastercard can help fintechs all over the world grow and scale sustainably,” said Michael Miebach, chief product & innovation officer, Mastercard. “Fintechs are contributing to the rapid digital transformation that makes lives more convenient, simpler, and rewarding. We’re the partner of choice for the top Fintech brands worldwide, and with Accelerate we invite the next generation of global entrepreneurs to join us.” “And for our financial institution partners and customers, Mastercard Accelerate provides access to the next generation of innovators, with a portfolio of start-up partners and fintechs ready to co-create and collaborate on new experiences,” added Miebach.



The temptation to use automated support to cut time and costs comes at the risk of further alienating physicians and other clinicians through IT, rather than making their lives easier. Automation via tools like chatbots and self-service surely “roboticizes” interactions, resulting in a loss in human-to-human contact and a degrading of users’ relationships with the IT staff — and perhaps with the institution itself. Despite all the hype around AI and machine learning, perhaps these technologies will be best embraced by support teams as an extension of their personal services, designed first to enhance the customer experience and only secondarily to ease the support staff’s workload and/or cut costs. If we are smart, we should be able to create a balance between digital and human interaction. Even IT-resistant physicians are learning to appreciate digital solutions if they clearly bring ease and convenience.


broken window with windows logo in clouds
Microsoft warned us at the beginning of the Win10 onslaught four-plus years ago that it wouldn’t dole out patches one by one. Except for emergency security fixes, patches would be released as part of cumulative updates. Over the years, that promise has evolved into a common pace of two cumulative updates per month: the first on Patch Tuesday, and a second “optional, non-security” cumulative update sometime later in the month. It’s one of the ways “Windows as a service” is a service, doncha know. Last month we were treated to an unholy pileup of Windows security patches as Microsoft released, then re-released, then finally pushed a fix to the Internet Explorer zero-day vulnerability known as CVE-2019-1367. Of course, nobody’s seen any widespread exploits attributable to that security hole, but the bugs — three different sets of them, corresponding to the three botched out-of-band patches — were breathtaking. This month, it looks like we’re headed in a similar direction.


Part 1 — what can these three Silicon Valley AI startups do for your business? image
According to Harvard Business School professor Clayton Christensen, each year more than 30,000 new consumer products are launched and 80% of them fail. There is a clear disconnect between product companies and the market. How does it work? The machine learning, natural language processing and visual AI models developed by Commerce.AI analyses unstructured customer feedback or data in the form of text, image, voice and video from reviews, and social media to a lesser extent. “We take unstructured data and synthesise it using AI, NLP and visual AI to create product intelligence for approximately 56,000 product categories,” explained Pandharikar. ... It’s all about improving product development and management; using AI/ML to identify the features that are working and build that into the next product, while taking positive feedback from millions of reviews and using that in the next generation of products. “The old way was to make consumers buy products, now it’s about making products that consumers want,” said Pandharikar.


Speaking at TechCrunch Disrupt SF, Jeanette Manfra, the assistant director for cybersecurity for Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), said that the agency was making training for new cybersecurity professionals a priority. “It’s a national security risk that we don’t have the talent regardless of whether it’s in the government or the private sector,” said Manfra. “We have a massive shortage that is expected that will grow larger.” Homeland Security is already responding, working on developing curriculum for potential developers as soon as they hit the school system. “We spend a lot of time invested in K-12 curriculum,” she said. The agency is also looking to take a page from the the tech industry’s playbook and developing a new workforce training program that’s modeled after how to recruit and retain individuals. For Manfra, it’s important that the tech community and the government agencies tasked with protecting the nation’s critical assets work more closely together



With the emergence and the implementation of blockchain technology in the Australian financial domain, developers and entrepreneurs can put their creative minds to good use and produce even more innovative games for gambling lovers. This has been brought up due to a well-known relationship between the total revenue and a notable contribution that gambling holds to it. Not only will the peer-to-peer gaming become a reality opening the door for mutual betting, decentralized lotteries and other categories of games, but Aussie high roller casinos will also benefit sizably. One of the main attractions of using Blockchain technology will be the improved degree of trust between players and operators. Every game rule, underlying code, and the outcome will be enabled to verification and thus, enhanced safety and security will be guaranteed. In addition, it will not be too big of a hurdle for Blockchain to gain support rapidly in Australia since many reputable online casinos allow Australian punters to wager, withdraw and deposit in bitcoins.


cybersecurity awareness month
“Lock your devices up. Make backups. Stay on top of your accounts.” – Ivanti Insider “Be vigilant and be up-to-date. Verify you're typing in the correct web address. Before you click anything in an email, verify the sender is who you think it is and the link/attachment is something they themselves sent. Verify that your antivirus products are up-to-date (and that you have one installed!) and scanning, and that your PC is staying up-to-date with patches. Most issues can be avoided by being careful to always visit legitimate sites, ensuring you aren't opening attachments from unknown individuals, by keeping your PC patched, and your antivirus up-to-date and performing regular scans.” – Kelly Ruston, Technical Support Specialist, William Osler Health System “When you are going to click a link on a webpage or an email, hover over the link first and check the bottom left of your browser to see if it will take you to the page you are expecting.” – Adam Howard, Systems Administrator, Rack Room Shoes


Linx prosthetic
We’re walking in all sorts of different terrains, and the body is naturally adjusting itself, and the way legs move so that you can get around with the least amount of energy possible. The Linx needs to accommodate changes to the environment in a biomechanical way so that users don’t exert so much energy. And that’s a difficult problem because you’re dealing with such a huge variation. If you imagine the activities of daily living — every move that you do — thousands and thousands of steps — how do you detect these changes and accommodate them? The way to do it is to integrate the components of the limb. Rather than looking at products or joints individually, you can leverage all that new information. And what you end up with is a leg which behaves in a much more natural way — able to predict and move in a coordinated way. That’s another important thing. And in our limbs, the movement is very coordinated. Essentially our microprocessor foot would be making its own decisions in complete awareness of what a microprocessor knee would be doing.



A failure to publish an event can mean critical failure to the business process. To explain the problem statement better, let’s consider a Student microservice that helps Enroll the student. After enrollment, the "Course Catalog" service, emails the student all the available courses. Assuming an Event-Driven application, the Student microservice enrolls the student by inserting a record in the database and publishes an event stating that the enrollment for the student is complete. ... This pattern provides an effective solution to publish events reliably. The idea of this approach is to have an “Outbox” table in the service’s database. When receiving a request for enrollment, not only an insert into the Student table is done, but a record representing the event is also inserted into the Outbox table. The two database actions are done as part of the same transaction. An asynchronous process monitors the Outbox table for new entries and if there are any, it publishes the events to the Event Bus. The pattern merely splits the two transactions over different services, increasing reliability.



Quote for the day:



"Leverage is the ability to apply positive pressure on yourself to follow through on your decisions even when it hurts." -- Orrin Woodward


Daily Tech Digest - October 28, 2019

A Century of Healthcare Data

Firstly, there is the length of time that patient data will have to be preserved. People are now living longer than ever before, and current UK legislation states that GP records must be retained for ten years after the death of a patient. This means healthcare data being created today may need to be kept on file for up to 100 years or more. Secondly, the rate of technological development means this data may also have to be migrated between formats multiple times over its lifespan – which is both labour-intensive and expensive. Data storage technology and organisational priorities will continue to evolve, while the data itself will typically come from various sources. As a result, healthcare organisations will face a huge amount of complexity when it comes to preserving data and making it accessible, on top of the growing costs involved as data scales. Medical organisations therefore need to ensure that their storage infrastructure provides the highest possible scalability, flexibility and portability – especially with data volumes becoming so vast that just migrating data from one format or provider to another can require significant investment. 


UN, UNICEF, Red Cross officials targeted in recent phishing campaign

united nations UN
"We can't speculate on attribution," Jeremy Richards, principal security researcher at Lookout, told ZDNet in an email this week. "The motive of the attack is to compromise Okta and Microsoft credentials to gain access to these accounts, which could be used for further attacks or intelligence gathering." A member of a human rights advocacy group told this reporter in an encrypted chat this week that organizations such as his or the ones listed in the Lookout report are often the targets of all sorts of groups. State-sponsored groups want to breach human rights organizations to learn of any ongoing investigations, to track local or abroad whistleblowers, or gain intelligence on organization members to harass them at later points. Similarly, human rights groups are also regularly targeted by regular financially-motivated hackers, such as BEC (business email compromise) scammers, who want to hijack payments or steal funds. "It's no difference to them if we're a hardware vendor or NGO. All they want is the money," our source told us.


The best free photo editor 2019

The best free photo editor
There are dozens of free photo editors out there, so we've hand-picked the very best so you can make your pictures look amazing without paying a penny. Of course, if you're able to wait until Black Friday and Cyber Monday, you'll almost certainly be able to find a great deal on a premium photo editor like Adobe Photoshop, but there's plenty of choice out there if you can't wait that long. We've spent hours putting a huge range of photo editors to the test, and picked out the best ones for any level of skill and experience. From powerful software packed with features that give Photoshop a run for its money to simple tools that give your pictures a whole new look with a couple of clicks, there's something for everyone. Many free photo editors only offer a very limited selection of tools unless you pay for a subscription, or place a watermark on exported images, but none of the tools here carry any such restrictions. Whichever one you choose, you can be sure that there are no hidden tricks to catch you out.


AI Policies Are Setting Stage To Transform Healthcare But More Is Needed

AI
The President signed an Executive Order in February 2019 setting the tone for improved data connectivity and stronger public-private partnerships to spark new products in the marketplace and inspire entrepreneurs. It highlights the need for better ways to connect the vast amounts of data that need to be sorted and ultimately harnessed for patients’ benefit. The Initiative mandates that heads of government research agencies like the National Institutes of Health (NIH) develop and identifying new AI programs, explore collaborations with the private sector and help train new generations of data scientists. AI hungers for data and the Initiative helps focus efforts on better methods to connect the countless dark pockets that are inaccessible or hoarded by some organizations. Connectivity is a considerable problem. Healthcare data is expected to double three times each year, leading to zettabytes of information which is utterly impossible to process using historical standards.


Why good strategies fail

abstract
Much has been written in management books, white papers, and news articles about how to craft a winning strategy. Scholars, strategy executives, management consultants, and business gurus alike, all have a formula for how to identify opportunities to advance an organization’s aspiration, architect a plan of attack, orchestrate resource allocation, and coordinate execution of priority initiatives. Developing a well-crafted strategy takes time, effort, money, intellectual commitment, and political capital. If you have ever led or participated in a strategic planning process, you know the drill. But what happens when your strategy doesn’t work as intended? What happens when your strategy falls short of delivering the expected results? The question of "why isn’t my strategy working?" is asked more often than many executives would like to admit. Yet, there is very little in the strategy literature that can help companies troubleshoot their strategy execution, isolate the causes of friction, and deploy mitigating and corrective actions. In this article, we aim to bridge that gap. We explore three critical strategic tensions—incoherence, incongruence, and inconsistency—their root causes, how to identify them, and how to make sure that they don’t prevent your strategy from realizing its full potential.


Psst! Wanna buy a data center?

data center / server racks / connections
Since then there have been numerous sales of data centers under better conditions. There are even websites that list data centers for sale. You can buy an empty building, but in most cases, you get the equipment, too. There are several reasons why, the most common being companies want to get out of owning a data center. It's an expensive capex and opex investment, and if the cloud is a good alternative, then that's where they go. But there are other reasons, too, said Jon Lin, president of the Equinix Americas office. He said enterprises have overbuilt because of their initial long-term forecasts fell short, partially driven by increased use of cloud. He also said there is an increase in the amount of private equity and real estate investors interested in diversifying into data centers. ... Enterprises do look to sell their data centers, but it's a more challenging process. She echoes what Lin said about the problem with specialty data centers. "They tend to be expensive and often in not great locations for multi-tenant situations. They are often at company headquarters or the town where the company is headquartered. So they are hard to sell," she said.


How 5G Will Revolutionise Retail Payments


The launch of 5G will provide more internet access, currently there is only a 49% global internet penetration. This will lead to more online consumers worldwide and create even faster websites. Broken down this is a 10X decrease in latency and up to 100X more network efficiency. Advancements with 5G will allow for easier online shopping experiences to an even broader spectrum of digital consumers. In fact, Adobe reports 5G will boost e-commerce revenue by $12 billion by 2021. Offering mobile adapted e-wallets will prepare retailers to take advantage of this trend. After 5G, consumers will truly be able to pay and shop wherever and whenever they want to, with little resistance and receive instant confirmation of their purchases. Merchants should see a boost in revenue due to even more seamless mobile shopping. A combination of merchant and shopper apps and faster 5G speeds will cause consumers to naturally move towards mobile commerce.


The rise of the platform economy in financial services

Industry 4.0 promises to herald in a new era of platform players delivering products and services designed to accurately meet the personalized needs of customers in a more tailored way throughout their lives. So what’s the perspective of Xavier Gomez @Xbond49 on this new era? “PSD2 rules clearly push banking sectors to renovate the customers relationship (B2B and B2C) for lower cost. The first wave of APIs in Europe was disappointing in terms of quality of data provided. Why? Banks produce a lot of data but they do not know how to use and leverage it unlike the GAFA. Open banking is an opportunity to build new banking services that are customizable to customers thanks to the “platformization” concept. Banks can apply a digital transformation policy by rebuilding a new IT core banking system (open source), by integrating fintech solutions and collaborating with start-ups.”


Nasty PHP7 remote code execution bug exploited in the wild

php.png
The vulnerability is a remote code execution (RCE) in PHP 7, the newer branch of PHP, the most common programming language used to build websites. The issue, tracked as CVE-2019-11043, lets attackers run commands on servers just by accessing a specially-crafted URL. Exploiting the bug is trivial, and public proof-of-concept exploit code has been published on GitHub earlier this week. "The PoC script included in the GitHub repository can query a target web server to identify whether or not it is vulnerable by sending specially crafted requests," says Satnam Narang, Senior Security Response Manager at Tenable. "Once a vulnerable target has been identified, attackers can send specially crafted requests by appending '?a=' in the URL to a vulnerable web server." ... But there are also website owners who cannot update PHP or can't switch from PHP-FPM to another CGI processor due to technical constraints.


Facebook alters video to make people invisible to facial recognition


Facebook’s approach pairs an adversarial autoencoder with a classifier network. As part of training of the network, researchers tried to fool facial recognition networks, Facebook AI Research engineer and Tel Aviv University professor Lior Wolf told VentureBeat in a phone interview. “So the autoencoder is such that it tries to make life harder for the facial recognition network, and it is actually a general technique that can also be used if you want to generate a way to mask somebody’s, say, voice or online behavior or any other type of identifiable information that you want to remove,” he said. Like faceswap deepfake software, the AI uses an encoder-decoder architecture to generate both a mask and an image. During training, the person’s face is distorted then fed into the network. Then the system generates distorted and undistorted images of a person’s face for output that can be embedded into video.



Quote for the day:


"Being honest and open is the only way to convince cynical employees that you truly want to establish a partnership with them." -- Florence M. Stone


Daily Tech Digest - October 26, 2019

Scammers are targeting Cash App users hoping for free money


On Instagram, hopeful entrants leave comments on Cash App Instagram posts. Scammers then jump on these posts using fake accounts pretending to be the legitimate firm, such as one named $cshfridayoffical, and request money for verification purposes. As an example, users would be asked to send $10 or $20 in order to claim $500. Other fraudsters take another approach. Rather than targeting #CashAppFriday directly, they will look for commenters and follow them, hoping to entice users into fake cash flipping scams. These cash 'flippers' claim they can turn small amounts of money into far larger amounts -- such as $7 into $120 -- and may also use limited-time only deal offers to ensnare Instagram users. In one example, a user under the name "Money Flip Queen" said that participants in cash flipping needed to have at least $25 stored in Cash App or a bank account. Likely doctored images displayed on the profile apparently show the successful money flips, and given this incentive, it is possible some fall for the ploy.



Cisco Networking Trends Report: ‘Intent-Based Networking Is Coming’

Cisco Networking Trends Report: ‘Intent-Based Networking Is Coming’
The survey found maximizing business value to be IT’s No. 1 priority with 40% of respondents naming it their top concern. But seeing the top of the mountain is one thing, and getting up there is another. In order to maximize business value, IT teams will require greater insight into data along with the right tools. “That’s why IT teams are embracing intent-based networking, AI and machine learning — because the business demand it,” said Scott Harrell, SVP and GM of Cisco enterprise networking, in a statement. ... Simply put: IT operators need visibility into both the network and its data, and Cisco expects IBN to pick up where SDN left off in providing a feedback loop that can indicate what is or is not working, and why.  The idea is that SDN provides a natural, solid foundation for an IT infrastructure evolution where added DevOps capabilities will afford network operators more control over network operations. IBN comes into play to close the feedback loop and “unlock the potential and intelligence to the data that the network and infrastructure provides.”


Lawyers of the world: Robots aren't replacing you--yet

ai-in-court-9.jpg
Lillquist believes there is a role for AI in law practices. "AI will continue to transform the practice of law," he said. "Rather than replacing jobs, it will instead require lawyers to develop an increasing number of skills in order to make use of the latest technologies and maintain a competitive edge. These potential changes are an opportunity for lawyers. They will be able to leverage AI-enabled legal tech solutions that can help them complete more work at a higher degree of accuracy, freeing up time to focus on more meaningful work that can create greater value for their companies or clients. "AI will continue to take on repetitive tasks of increasing complexity, especially in data extraction, requiring that new systems be built in order to exact value out of new kinds of data. Lawyers will be responsible for working with technology to train it on datasets and law's nuances. Deep legal expertise is required to create technology that successfully operates in the legal space, and that knowledge resides in humans. We will probably also see a redefinition of what it means to be a lawyer, and what it means to work at a law firm or as an in-house counsel."


DARPA is betting on AI to bring the next generation of wireless devices online

The demand for spectrum has grown to the point that the wastefulness of this arrangement is becoming untenable. Spectrum is not only shared by commercial services; it also supports government and military communication channels that are critical for conducting missions and training operations. The advent of 5G networking only ups the urgency. ... To tackle this challenge, DARPA asked engineers and researchers to design a new type of communication device that doesn’t broadcast on the same frequency every time. Instead, it uses a machine-learning algorithm to find the frequencies that are immediately available, and different devices’ algorithms work together to optimize spectrum use. Rather than being distributed permanently to single, exclusive owners, spectrum is allocated dynamically and automatically in real time. “We need to put the world of spectrum management onto a different technological base,” says Paul Tilghman, a program manager at DARPA


Cyber in construction: Why cybersecurity should be in the blueprints


Employees and contractors commonly use project management software to track job status and collaborate with external vendors. Highly confidential plans, blueprints, bids, financial information, and even personally identifiable information (PII) – like full names and social security numbers – can be stored within these systems. As you can imagine, this data is a gold mine for cyber criminals, ensuring they are properly secured at all times should be top priority. It’s imperative for construction companies to take inventory of this data. Know exactly what information you have, where it’s stored, and who exactly has access to this information. Securing data on secure servers or in the cloud is ideal, to ensure that your on-the-go team is not saving confidential information on their hard drives or personal devices. Globally, the average cost of a data breach can cost a company $3.9 million dollars. In addition to the financial loss, companies face long-term effects such as lost business and bad press coverage – a large data breach can tarnish a reputation within the industry.


Face It -- Biometrics To Be Big In Cybersecurity

Authenitication by facial recognition concept. Biometrics. Security system.
The engineers at Google are bringing second generation FIDO protocols to every Android smartphone running software version 7.0 or above. The software will begin rolling out to devices over the next few days in an over-the-air update. The attraction is users will simply register their login credentials with websites and applications once, then the biometric information will supersede usernames and passwords. Fingerprint information is never stored on Google servers. It is maintained cryptographically on the device. This is a big deal. There are 2.8 billion Android users worldwide. Forbes calculates that 1.7 billion users will get the FIDO2 update. And FIDO2 is already supported across all of the leading internet browsers, including Google Chrome, Microsoft Edge, Firefox and Apple Safari. This follows a decision by Microsoft in 2018 to bring the same capability to 800 million Windows users through its Hello login. Faster, more secure logins make life easier for users. However, the real benefit accrues to enterprises, financial institutions, telecoms, insurance, and the government. Better authentication speeds ecommerce and banking transactions.


The IoT could provide a model for improved internet security


While the Internet of Things (IoT) undoubtedly creates potential risks – especially when it comes to the number of internet-facing endpoints potentially vulnerable to attackers – the risk is a known quality, so it can also be dealt with in a way which, if applied correctly, could improve internet security. That's because, Martin suggested, the way the internet currently operates creates security risks for users. "We're moving away from an internet economy where people give away large amounts of personal data for free in order to get services they don't have to pay for with money – which isn't very good for security – towards a model where people will be paying for products and services". That, he argued, "gives us an opportunity to introduce objective standards that consumers and businesses can judge when buying those products and services". The NCSC has already worked alongside the Department for Culture, Media and Sport to produce guidelines for IoT device manufacturers designed to ensure that products are secure and easy to update.


3 steps to reskilling in the digital era that no leader can afford to miss

3 steps to reskilling in the digital era that no leader can afford to miss
Projections of 40-50% of jobs in the manufacturing or transportation industry being potentially done by robots in the next 15 years are accurate, but they don’t consider that most new employment opportunities at the time will be in job categories that don’t exist today. After all, jobs like ethical hacker or data scientist didn’t exist until recently. In the workforce of the future, the warehouse operator will likely not just direct operations, but also manage algorithms that run the robots. The accountant and call center agent will be freed of the drudgery of data entry and physical paperwork by robots, and take over the higher-order decision-making that the robots cannot do. The upshot is that working with technology is becoming commonplace in every function in the enterprise. The distinction between technology “developers” and “users” is becoming increasingly blurred. Technology such as “low-code” and “no-code” software development allows employee profiles that may have been thought of as “users” of systems to also be “developers” of software.


Congress Grills Facebook's Zuckerberg on Cryptocurrency Plans

Congress Grills Facebook's Zuckerberg on Cryptocurrency Plans
"Facebook's plans to create a digital currency, Libra, and a digital wallet, Calibra, raise many concerns relating to privacy, trading risks, discrimination, opportunities for diverse-owned financial firms, national security, monetary policy and the stability of the global financial system," Waters said. Zuckerberg received a warmer reception from some of the Republicans on the committee, who praised the Facebook CEO for attempting innovation in the payments industry. Rep. Patrick McHenry, R-N.C., the ranking Republican on the committee, used his opening statement to make the case for more of these types of experiments. "American innovation is on trial today in this hearing," McHenry said. Later in the hearing, Republican Roger Williams of Texas said: "I do admire people in our capitalist system here that are disruptors ... that [they] find the weakness and try to exploit it with a new product that's better for consumers." But committee members from both parties raised questions about why the Libra Association, which would oversee the virtual currency, is located in Switzerland when it plans to comply with U.S. financial regulations.


Q&A on the Book: The Technology Takers – Leading Change in the Digital Era

The balance of power has shifted between companies and customers. Customer demands have changed, not due to direct competitors, but due to customer experience in other industries. The global dominance of smartphone processes has caused consumers to expect choice.  For example, faced with shifting consumer demand, McDonald’s has started eliminating its proprietary technologies for over-the-counter and drive-up window ordering. Customers can now use self-service technology to customize their McDonald’s hamburger – instead of going across the street to the competition. Technology-taking managers have access to real-time data about business operations. Coupled with effective analysis, these data can help managers test assumptions and develop new hypotheses. Scania, a truck manufacturer, recognized the importance of data in transportation. In Europe, a truckload of 60% capacity is typical. Scania has built an international database to improve fleet management by tracking speed, fuel use, engine performance and driving technique, enabling their clients to improve fill rates and reduce costs.



Quote for the day:


"Most people who sneer at technology would starve to death if the engineering infrastructure were removed." -- Robert A. Heinlein


Daily Tech Digest - October 24, 2019

Developers: The Cause of and Solution to Security's Biggest Problems


"Investing in bringing developers on those security teams can help them build things that are going to be directly consumed by engineers," Lackey says. He is far from an outlier in this view that security needs to hire more developers. Hit up security and DevOps conferences today, and you'll increasingly run across security managers who are pushing hard for the industry to prioritize development experience. "I only hire developers; I don't hire security people anymore," says John Melton, application security senior manager at Oracle NetSuite. "If you're a security person and you can't code, you should learn how, or you should hire people on your team who know how to code." As Melton explains, the lack of development knowledge is endemic in the security world, and it's hurting security teams in so many ways. He's far from the only one to voice those concerns. According to Larry Maccherone, who runs the DevSecOps transformation at Comcast as senior director in the technology and product division's security and privacy group, a lack of developers on security teams does the most damage to the team's credibility.



Google CEO Sundar Pichai on achieving quantum supremacy

Google wouldn’t be here today if it weren’t for the evolution we have seen in computing over the years. Moore’s Law has allowed us to scale up our computational capacity to serve billions of users across many products at scale. So at heart, we view ourselves as a deep computer science company. Moore’s Law is, depending on how you think about it, at the end of its cycle. Quantum computing is one of the many components by which we will continue to make progress in computing. The other reason we’re excited is—take a simple molecule. Caffeine has 243 states or something like that. We know we can’t even understand the basic structure of molecules today with classical computing. So when I look at climate change, when I look at medicines, this is why I am confident one day quantum computing will drive progress there. ... For example, us building our own data centers is what allowed us to build something like TPUs, which makes our algorithms go faster. So it’s a virtuous cycle.


How to secure, manage and monitor edge devices

How to secure, manage and monitor edge devices image
How can organisations secure their edge devices, which allows enterprises to take steps towards the real-time and proactive management of applications? From Nick Dawson‘s perspective, security needs to be embedded in the actual compliance. “It needs to be a fundamental part of the DNA of any given device,” he said. However, there needs to be a mindset shift. Users and business partners tend to think of smartphones as the most important device that should be protected. But, in reality, a smart toaster of fish tank could provide a route in for hackers. “Any appliance that is connected to a network must have security built into it,” Dawson continued. ... As organisations see the proliferation of different types of devices, with more connected endpoints out there on the network, one of the challenges is being able to monitor it all — “how do I ensure that everything is doing what it’s supposed to do,” asked Dawson? For large multinational companies, there are lots of individuals with different skill sets who can’t all be up 24 hours a day.


FTC bans Retina-X from selling creepy stalkerware

The settlement resolves allegations that these apps compromised the privacy and security of the consumer devices on which they were installed. … The FTC alleges that Retina-X and Johns developed three mobile device apps that allowed purchasers to monitor the mobile devices on which they were installed, without the knowledge or permission of the device’s user.… Retina-X sold more than 15,000 subscriptions to all three stalking apps before the company stopped selling them. … While Retina-X claimed in its legal policies that the apps were intended for monitoring employees and children, Retina-X did not take any steps to ensure that its apps were being used for these purposes. … At the same time, devices on which the apps were installed were exposed to security vulnerabilities. The FTC also alleges that Retina-X and Johns failed to adequately secure the information collected from the mobile devices. [It] failed to adopt and implement reasonable information security policies and procedures, conduct security testing on its mobile apps, [or] conduct adequate oversight of its service providers.


Cisco issues critical security warning for IOS XE REST API container

secure system / network security policy management
With the vulnerability an attacker could submit malicious HTTP requests to the targeted device and if successful, obtain the token-id of an authenticated user. This token-id could be used to bypass authentication and execute privileged actions through the interface of the REST API virtual service container on the affected Cisco IOS XE device, the company said. According to Cisco the REST API is an application that runs in a virtual services container. A virtual services container is a virtualized environment on a device and is delivered as an open virtual application (OVA). The OVA package has to be installed and enabled on a device through the device virtualization manager (VMAN) CLI. The Cisco REST API provides a set of RESTful APIs as an alternative method to the Cisco IOS XE CLI to provision selected functions on Cisco devices. ... Cisco said it has released a fixed version of the REST API virtual service container and a hardened IOS XE release that prevents installation or activation of a vulnerable container on a device. If the device was already configured with an active vulnerable container, the IOS XE software upgrade will deactivate the container, making the device not vulnerable.


Machine teaching, LUIS and the democratization of custom AI with Dr. Riham Mansour

The goal of machine teaching and traditional machine learning is to build an accurate model. Same goal, right? So a user who’s using either, would have the goal in mind to build a model, a good model, right? But then, the ‘what’ and ‘how’ is what’s different. So usually to build any model from data you need to have some knowledge that exists somewhere. In machine teaching, it’s about extracting the knowledge from the teacher, so it has the human-in-the-loop providing the necessary knowledge about the domain, so that we can build an AI model specific to that domain. Traditional machine learning is about extracting knowledge from data. So, using the compute power to extract the knowledge from huge amounts of data, and that’s where deep learning and other key words, transferred learning, come into play. So when and why machine teaching can be useful, I would say, in situations where there isn’t enough labeled data already available ...


Achieving a data-centric approach to security requires homomorphic encryption

A data-centric approach to security requires homomorphic encryption image
Real-time homomorphic encryption — the ability to perform mathematical functions on data and get search queries back without decrypting it — is a solution that fosters a data-centric approach to security. With this technology, where ShieldIO is a pioneer, “privileged and non-privileged users can get value from the encrypted data in real-time, without seeing, exposing or decrypting the actual data,” said Jennings. ... Users need to do their job, but it’s important that blockers don’t get in the way, in the name of security. Security needs to be efficient, but it should run in the background and not interfere with users doing their job. “Our job is to make security as easy and secure as possible and not get in the way of people’s jobs,” confirmed Jennings. This can be achieved by enabling; access to encrypted data in-use, development test environments to use real data without exposing live data, real-time speed of query on a fully encrypted dataset and, a simple, fast and transparent data security implementation through standard database drivers.


ServiceNow under Bill McDermott: What you can expect

For ServiceNow to grow significantly acquisitions are likely. ServiceNow's category expansions are notable, but purchases could accelerate those moves. McDermott led a series of SAP acquisitions as it transitioned to the cloud. Wood said: McDermott has the experience, background and network to 1) heavily recruit sales talent to backfill any attrition and put together sales leadership that can run enterprise sales operations at scale (maybe second only to Keith Block in this last regard); and 2) effectively on-board new acquisitions in order to help ServiceNow enter new markets and scale in size (much like SAP, Oracle and Salesforce have done). Sarah Hindlian, an analyst at Macquarie Capital, noted that SAP is a large ServiceNow customer and the companies have grown closer. What if ServiceNow and McDermott wound up back at SAP? Stranger things have happened. ... Hindlian also argued that McDermott is also likely to expand ServiceNow's global profile. ServiceNow doesn't have the global experience yet and McDermott has a global contact list and is used to chasing big multinational companies.


New security alliance wants to build strong defense against cyber-physical attacks on IoT devices


As the Industrial Internet of Things digitizes more and more manufacturing processes, security risks from the IT world are reaching into operational technology as well. Operational technology (OT) includes the hardware and software that manage processes of physical devices such as valves, pumps, sensors, cameras, electronic locks, and thermostats. Until recently, these technologies have not generated data for business use and OT traditionally has not been part of an IT department's responsibilities. OT systems typically have relied on physical security and have ensured high availability at the expense of confidentiality and integrity. As more of these processes and devices are connected to the Internet, that opens up OT systems to cyber attacks.  In a report on the digitization of the oil and gas industry, EY Global found that the convergence of the IT and OT environments has created new cyber-physical risks: "... network connected endpoint devices such as unmanned vehicles, smart sensors, handheld engineer terminals and industrial routing equipment are being produced and deployed without a cybersecurity baseline implementation and are open to remote compromise."


Why Organizations Must Quantify Cyber-Risk in Business Terms

Security leaders can learn from other industries about how to quantify risk in business terms, like financial services, which has been out in front when it comes to managing risk. People don't let banks manage their life savings if they don't understand the risks and guard against losses. Financial services and cybersecurity aren't that dissimilar. Both feature increasingly complex systems and could suffer catastrophic damage in the event of failures that can cascade out into entire industries and geographies. Cyber-risk varies depending on the type of organization affected and the potential harm. Two examples of cyberattacks that pose significant risk have targeted industries that are critical to the functioning of civil society. In 2015 and 2016, Ukraine's power grid was disrupted by nation-state attacks. Just recently, US officials revealed a much less serious cyberattack in March that briefly affected a grid control center and small power generation sites in California, Utah, and Wyoming.



Quote for the day:


"A leader is one who knows the way, goes the way, and shows the way." -- John C. Maxwell


Daily Tech Digest - October 23, 2019

Google's Raspberry Pi-like Coral: AI board with TPU is ready for business


Google unveiled its Coral edge kit in March, offering developers a Raspberry Pi-like board with an attachable Google Edge TPU machine-learning accelerator. The kit is aimed at engineers and researchers who want to run TensorFlow models at the edge of a network, outside the data center.  The Coral Dev Board itself costs $149, which includes a detachable Coral system-on-module (SoM) that can now be bought as a standalone product for $114. The SoM includes Google's Edge TPU with the NXP IMX8M SoC, Wi-Fi and Bluetooth, memory, and storage. Google is selling its Coral line of products through Mouser "globally". However, it is also planning to expand distribution of the developer board and SoM to Taiwan, Australia, New Zealand, India, Thailand, Singapore, Oman, Ghana, and the Philippines by the end of the year.  Additionally, it will soon release a new version of Mendel OS, a lightweight 'derivative' of Debian Linux designed for Coral dev boards and the Coral Edge TPU. The new version of Mendel OS will be based on Debian Buster. Google is also offering three new accelerators for production workloads, each of which features the Edge TPU and connects to other devices via PCIe slots. These include the Mini PCIe, M.2 A+E key, and M.2 B+M key.


Aruba rounds out edge-to-cloud strategy

data center / server racks / connections
“Building on the success of the 8400 it is a natural and necessary progression for Aruba to fill out this portfolio with access and aggregation switches,” said Rohit Mehra, vice president of Network Infrastructure at IDC. “The single operating system simplifies operations and lets customers build commonality between their data center and campus environments.” The knock against HPE/Aruba has been its variety of network software for its data center products, which can cause confusion, Gartner said in its Magic Quadrant for Data Center Networking report in July. Gartner wrote that the “company’s data center portfolio includes FlexFabric and Plexxi which have different codebases and management platforms, which limits deep integration and investment protection across its portfolio.” FlexFabric products offer a single network architecture for the data center, campus and branch offices. When it bought Plexxi in 2018, HPE said it would integrate Plexxi technology into its hyperconverged offering, which is in part the technology HPE got from buying SimpliVity for $650 million last year. 


The reality for CIOs is simply deploying new technologies in an attempt to improve internal and customer-facing collaborative processes doesn't necessarily lead to a measurable return on investment. Instead, new collaboration capabilities potentially create friction and lack of contextual awareness, as employees constantly move among a variety of different applications for content creation, messaging, calling and meetings. ... Workers struggle with scheduling and starting meetings and lack automated abilities to capture highlights and follow-on action items. An emerging set of technologies, based on AI and machine learning, aims to improve the collaboration experience by connecting people, applications and data; improving usability of apps and endpoints; and ultimately delivering a positive return on investment by enabling greater efficiency and productivity. We refer to these capabilities as cognitive collaboration.


Move aside, RDBMS, NoSQL owns the future

Move aside, RDBMS, NoSQL owns the future
After all, as former MongoDB (and current GitHub) executive Kelly Stirman once explained, there’s a reason enterprises may move on to new technologies relatively quickly, but the database decision usually gets pushed out: “The database has the most inertia. It’s the hardest thing to move because it has state. And it has the most valuable asset, the data itself.” Or, to quote Gartner analyst Merv Adrian, “The greatest force in legacy DBMS is inertia.” Why? Because “When someone has invested in the schema design, physical data placement, network architecture, etc. around a particular tool, that doesn’t get lifted and shifted easily.” Unconvinced? Meander over to the DB-Engines database popularity ranking and you’ll see this played out. Yes, MongoDB, Apache Cassandra, Redis, and Elasticsearch have all made it into the top 10 databases, but their relational ancestors remain at the top of the heap. Even so, in the nearly 10 years that I’ve been following that ranking, NoSQL databases have steadily gained on these frontrunners.


Banks move to contain impact of Samsung biometric flaw


Samsung confirmed the issue on Friday 18 October 2019, and advised any users of those devices who use screen protector covers to remove them, delete any previous fingerprints, and re-register their biometrics. Users should also refrain from using their covers until the devices can be patched. NatWest’s social media team responded to users on Twitter, asking why they were unable to access banking services using its mobile app. “We’ve removed the app from the Play Store for customers with Samsung S10 devices,” it said. “This is due to reports that there are security concerns regarding these devices. We hope to have our app available again shortly once the issue has been resolved.” A Nationwide spokesperson said: “We are aware of reports in the news that suggest Samsung S10 devices with a screen protector can be unlocked with any fingerprint. While we are confident in the security measure we have in place, we know some of our members have this device and may use TouchID to access their banking app.


Managing Microservice "Deep Systems": Q&A with Ben Sigelman

When we say microservices, everyone thinks about the services themselves, not the shape of the larger system. If you have a lot of microservices, they grow deep; there are not just many services, but many layers. If you have 500 services, it's not as if one router or API gateway talks to all 500 services; they talk to each-other. And a service can only be as fast as its slowest dependency, so each layer adds a new way for things to go wrong. The reason the industry moved to microservices was to facilitate autonomy and independence across devops teams, though ironically the depth of these systems often creates friction, inefficiency, and a reduction in overall velocity. This is because it's so difficult to track issues between microservices, understand the complex ways that they rely on each other, and determine which service needs adjustment to restore an SLO.


Troubleshoot Slow RDS SQL Servers with Performance Insights


CloudWatch metrics show infrastructure-related counters like CPU, network throughput, IO performance or disk queue length of the underlying virtual machine or its host. Enhanced monitoring on other hand, exposes operating system metrics like free memory available or currently running processes. Although these are useful for identifying resource contention, SQL Server DBAs still need to dig deeper to find problem queries. Troubleshooting a slow running RDS SQL instance would usually start with the DBA quickly having a look at these counters for an idea about of the system’s overall health. This would be followed by checking currently running queries and statements. Then system tables, dynamic management views or functions would be queried for further analysis. All these pieces of information and data from other sources like log files would be then correlated to get to the root cause. Depending on the complexity of the problem, this can easily take anywhere between several minutes to several hours, to even days. Third-party monitoring solutions can simplify this process, but that means paying for a solution.


Can Facebook's Libra cryptocurrency survive the exodus?

Facebook headquarters
Unlike bitcoin, Ethereum and other cryptocurrencies that aren't backed by fiat currency or other forms of stored value, a Libra coin would be backed 1:1 by real money. "This means that for any unit of Libra to exist, there must be the equivalent value in its reserve," Facebook's crypto chief David Marcus wrote in a series of tweets defending the project. "As such, there's no new money creation, which will strictly remain the province of sovereign Nations." Katie Haun, a partner with the law firm Andreessen Horowitz – a Libra Association founding member – reiterated that existing members would forge ahead with the project, tweeting after the meeting: "Even though some of the original members have changed, we remain committed to Libra's mission. "It's also important to look at this project in the global context," Haun tweeted in a separate post. "By attempting to block Libra before it's even built, U.S. policymakers risk ceding leadership over one of the most important emerging technologies."


How to become a CIO thought leader


At Baseline, Dyché's thought leadership was the company line. In contrast, at a Fortune 500 company such as SAS, she was just one vice president among dozens. She could no longer presume to speak for, or as, the company. She couldn't simply toe the company line, either. The challenge of successful thought leadership is twofold, according to Dyché. On the one hand, would-be thought leaders must assert the uniqueness of their own voices and craft their own messages, while taking care not to contradict the messaging of the organizations that employ them. On the other hand, they must guard their independence against the agendas of the internal forces, such as public relations (PR) and marketing, that will try to coopt and control them. "PR is one potential source of opposition. PR sees thought leadership as synonymous with content. And they want to own content. ..."


Malware volumes decline, but risks are higher


“What the data shows is that cyber criminals are becoming more nuanced, more targeted and savvier in their attacks. Businesses need to align to create stricter security rules within their organisations to reduce the threats that our researchers are identifying. ... SonicWall’s data was drawn from its Capture Labs threat intel unit, which said 7.2 billion malware attacks were launched between 1 January and 30 September this year, alongside 151.9 million ransomware attacks – declines of 15% and 5%, respectively. Even though there is a clear downward trend, the number of attacks remains extremely high and more nefarious than ever before, as evidenced by the clear upward trend in targeted geographic attacks going after enterprises in countries such as Germany and the UK, where malware and ransomware infections have almost trebled during what SonicWall referred to as a “frenzied summer”.



Quote for the day:


"Leadership is particularly necessary to ensure ready acceptance of the unfamiliar and that which is contrary to tradition." -- Cyril Falls