Daily Tech Digest - November 08, 2019

Three digital workplace challenges CIOs face

Cybersecurity and information security are still making headlines, with everything from phishing scams to huge data breaches of customer or employee data. CIOs are under intense pressure to ensure they take every action to keep their organisation protected from these attacks. Many organisations, particularly in sectors where employees handle customer or personal data, are likely to have robust information security policies in place. For example, restricting data that contractors can access or giving permissions only to a group of designated people. However, enforcing this across the digital workplace is more challenging than it seems. ... A significant proportion of user behaviour comes through the use of unauthorised applications and devices for work purposes. Many organisations have a problem with shadow IT, although the extent of the problem and the degree of risk are always hard to measure. Shadow IT exposes companies to data breaches and falling out of GDPR rules.

Permission Vs Permissionless Blockchain Explained

A permissionless blockchain is as its name suggests, a blockchain where no permission is required to become part of this blockchain network and contribute to its upkeep. Anyone or anything can become part of a permissionless blockchain. Trading on the network doesn’t require permission, running a node on the network doesn’t require permission, setting yourself a miner doesn’t require permission. Basically, download the required software, set up your wallet, node or whatever components you need to serve your requirements and of you go. I other words a Permissionless Blockchain is a way of saying “public.” As anyone can join a permissionless blockchain, they tend to be described as decentralized in that no one company or permission is a central point in the network as say a Central bank would be in the fiat currency system. As you can imagine this feature of the Bitcoin network appeals to the parts of the Cryptocurrency community that doesn’t like or have faith in centralised control be that either by a state or any other part of the existing financial services industry.

The 7 Biggest Technology Trends To Disrupt Banking & Financial Services In 2020

Although banking and financial services tend to be slower to adopt new technologies, a PricewaterhouseCooper study confirms the majority of financial services decision-makers are investing in artificial intelligence (AI)—52 percent of executives confirmed they are making “substantial” investments in AI while 72 percent believe it will be a business advantage. One thing that will likely make the rest believe in artificial intelligence’s potential for the industry are the cost savings that are expected to be $447 billion by 2023. ... Blockchain can support banking in several ways. Bitcoin showed how it can be used for payments, but it can also be transformative in the way our capital markets work by tokenizing traditional bonds, stocks, and other assets and putting them on public blockchains. Blockchains would remove the gatekeepers and third parties in the loans and credit system while also making it more secure to borrow money and lowering interest rates. Blockchain could also eliminate manual data reconciliation for bank ledgers. The way information and money are exchanged today will be altered by smart contracts that operate from blockchain technology.

Helium activates wireless network for IoT devices in more than 425 US cities

Through Helium's open-source Software Development Kit, developers can build devices that connect to the network without needing a cellular plan. A number of hardware developers have already created small, low-power devices that communicate over several miles using the company's LongFi technology. Prototypes developed for the Helium network include InvisiLeash's location tracking dog collar, CleanWater AI's remote, low-power pollution monitor, and Bike Route Data Gatherer's bike and scooter tracker. Using cellular for such low-power IoT devices as pet trackers and water quality sensors would be impractical due to power and cost limitations. However, through its peer-to-peer network, Helium can provide the necessary connectivity throughout a city, even reaching into remote areas. Based on initial testing, only about 50 to 100 hotspots are needed to provide complete coverage for an entire city, according to the company. Due to the interest in Helium, the company also announced an expansion of its Patron program across the country. This program offers discounts, priority shipping, network tools, Helium support, and other benefits to those who buy 15 or more hotspots.

Ex-Twitter Employees Spied on Saudi Dissidents: DoJ

The two accessed various account information, including user emails, phone numbers, IP address information, the types of devices used, user-provided biography information, logs that contained the user’s browser info and logs of all particular user’s actions on twitter platform at any time. This information could be used to identify and locate the Twitter users who published these posts, according to the DoJ. It’s not clear whether the two started working at the company with the alleged intent of accessing the data; or whether they were eventually convinced during their employment at Twitter. Abouammo was allegedly compensated for his illicit conduct, including with a luxury watch and $100,000 in cash. “We would like to thank the FBI and the U.S. Department of Justice for their support with this investigation,” a Twitter spokesperson told Threatpost. “We recognize the lengths bad actors will go to try and undermine our service. Our company limits access to sensitive account information to a limited group of trained and vetted employees.”

Defenders can discover phishing sites through web analytics IDs

Akamai provided two examples where the use of web analytics UIDs on phishing pages allowed its researchers to identify much larger campaigns. One was a campaign that targeted LinkedIn users and used many misleading domains that all shared the same Google Analytics UID, which was probably added by the phishing kit’s creator. The second was a campaign targeting AirBnB users that used subdomains on 000webhostapp.com, a legitimate site hosting service. The second campaign used the original AirBnB web analytics UID, which allowed the malicious subdomains to be easily identified. “Enterprise security teams can track their own analytic UIDs that are being used in the wild as the result of their website content being copied for building phishing website,” Akamai Security Researcher Tomer Shlomo tells CSO via email. “Security researchers and security vendors will use phishing Toolkit UIDs which will give them the ability to track other phishing websites and the ability to assess the scale of the campaign or find other phishing activities deployed by the same threat actor."

Brazilian government announces creation of AI lab network

The Brazilian government has already put the wheels in motion to get the building blocks ready to fully exploit AI in the public sector. For example, it has announced the creation of a single citizen database in October, which will contain a wide range of personal information about the country's population of over 200 million people, to be fully shared across departments. "What has made a difference throughout history is the ability to work in teams; the ability to reason, plan and think about the future; and our ability to create tools to solve problems and improve quality of life, " Pontes said during his speech. "We have created magnificent things, we have gone through many transformations - machines, engines, electricity, electronics, computers, airplanes - and we have reached a point now that is very special, which is digital transformation," he added. "We now have [technology] that aids the creation of other tools that help us plan and work in teams." The announcement of the AI lab network follows the creation of a partnership between IBM and the São Paulo Research Foundation (FAPESP) to launch a major AI research center in São Paulo next year.

5G brings up questions of cybersecurity vulnerabilities

"For all of the opportunities that 5G will unlock, it will also create new challenges," Pai said. "When 5G is embedded in almost every aspect of our society and economy, from businesses to homes, hospitals to transportation networks, manufacturing to the electrical grid, that means securing our networks will become much more important, and much more difficult." The next-generation technology is expected to bring a wave of innovations, with enhanced internet speeds pushing advances in self-driving cars and virtual reality, along with letting you download movies and TV shows faster than ever. 5G networks are not widespread yet, and experts are hoping to address the security issues before they are. Security researchers have found, for instance, that 5G networks are still vulnerable to International Mobile Subscriber Identity (IMSI) catchers, commonly known as "Stingrays." These surveillance devices impersonate cell towers and intercept network signals from devices, allowing attackers to gather information like location data and call details from people.  

Apollo Foundation Agrees Partnership With Lesotho On Blockchain Development

Despite the immense potentials of the technology, Africa as a continent has been lagging behind recording the lowest engagement of blockchain technology. Lesotho is looking to bridge the gap and views the partnership with Apollo as one that can change the level of blockchain developments in the country. According to the terms of the partnership, Apollo will help the Lesotho government to create new wealth opportunities via its fintech solutions, create and implement blockchain systems for the government, reduce financial crime and help maximize the commercial opportunities of the nations natural resources. Speaking on the partnership, Steve McCullah the director of business development for Apollo Foundation revealed that Lesotho has taken a good stride towards blockchain technology. “Lesotho is working to become a leader in technology,”. He also assured the Lesotho government that Apollo can deliver on the terms of the MOU. “We are confident Apollo can help accomplish this mission.

Optics for the cloud: storage in the zettabyte era with Dr. Ant Rowstron and Mark Russinovich

Just in the landscape of what cloud was and what it is now, it’s been a fascinating journey because when I started in Azure in 2010, Azure had been underway for a few years, just commercially launched, but Azure was tiny. Basically, in two datacenters, a few thousand servers. And the number of companies that were saying they were going to do cloud was probably twenty, twenty-five companies. And about four years ago, there were still about seventeen. Three years ago, we were down to thirteen. ... And there’s still six in what Gartner classifies as their “magic quadrant” for an infrastructure as a service. And I think there’ll be more paring down to come and Azure has been continuously in this strong position rising, rising and a couple of years ago, the market and analysts started to recognize us as the strong number two in this space. ... If you think of most of the technologies we use to store data today – things like flash, things like hard disk drives, things like tape – it’s true to say that they were all designed before the cloud existed. And in fact, they were all designed to work in multiple scenarios.

---

Quote for the day:

"One must be convinced to convince, to have enthusiasm to stimulate the others." -- Stefan Zweig

---

Daily Tech Digest - November 07, 2019

Forrester: Edge computing is about to bloom

It’ll also mean that telecom companies will begin to feature a lot more heavily in the cloud and distributed-computing markets. Forrester said that CDNs and colocation vendors could become juicy acquisition targets for big telecom, which missed the boat on cloud computing to a certain extent, and is eager to be a bigger part of the edge. They’re also investing in open-source projects like Akraino, an edge software stack designed to support carrier availability. But the biggest carrier impact on edge computing in 2020 will undoubtedly be the growing availability of 5G network coverage, Forrester says. While that availability will still mostly be confined to major cities, that should be enough to prompt reconsideration of edge strategies by businesses that want to take advantage of capabilities like smart, real-time video processing, 3D mapping for worker productivity and use cases involving autonomous robots or drones. Beyond the carriers, there’s a huge range of players in the edge computing, all of which have their eyes firmly on the future.

Cloud native core banking enables consumers to personalise what they buy

Mark Warrick, chief design officer at Thought Machine, said that rather than the customer being able to just change loan amounts and durations, the system can offer dozens of extra parameters they can edit. “Users can adjust obvious things like the amount, the duration and the payback frequency but can also add repayment breaks,” he said. “This goes straight into their instance of a smart contract and banks can have millions of customers with millions of individually configured loans and mortgages.” Thought Machine already works with a diverse group of banks, including Lloyds Banking Group, Atom Bank, Standard Chartered and Sweden’s SEB – all of which have gone public – as well as others yet to. Ed Twiddy, chief customer officer at Atom Bank, said changing people’s relationship with their money is “at the heart of Atom” and a “cornerstone” of its three years of work with Thought Machine.

AI will now watch for fraudsters on the world’s largest stock exchange

After investigating the case, the analyst enters the outcome back into the system. In this way, the deep-learning algorithm continuously refines its understanding. It will also be trained to detect different types of abuse over time. But neural networks, the algorithms that power such deep-learning systems, are only as good as the examples they are trained on. In other domains, hackers have been able to fool them by exploiting their blind spots. Doug Hamilton, Nasdaq’s managing director of artificial intelligence, says that’s why the team will first roll out the new surveillance system on top of the old one, rather than replacing it immediately. Having human analysts as a backstop adds an additional layer of insurance, he says. If the system is a success, the company plans to roll it out globally. Nasdaq also operates 29 total markets across North America and Europe and provides market surveillance technologies to 59 other marketplaces, 19 regulators, and over 160 banks and brokers.

React Native End-to-end Testing and Automation with Detox

Software development demands fast responses to user and/or market needs. This fast development cycle can result (sooner or later) in parts of a project being broken, especially when the project grows so large. Developers get overwhelmed with all the technical complexities of the project, and even the business people start to find it hard to keep track of all scenarios the product caters for. In this scenario, there’s a need for software to keep on top of the project and allow us to deploy with confidence. But why end-to-end testing? Aren’t unit testing and integration testing enough? And why bother with the complexity that comes with end-to-end testing? First of all, the complexity issue has been tackled by most of the end-to-end frameworks, to the extent that some tools (whether free, paid or limited) allow us to record the test as a user, then replay it and generate the necessary code. Of course, that doesn’t cover the full range of scenarios that you’d be able to address programmatically, but it’s still a very handy feature.

Amazon fixes Ring Video Doorbell wi-fi security vulnerability

The vulnerability has been disclosed by researchers at cybersecurity company Bitdefender, who note that all Ring Doorbell Pro cameras have now received a security patch to mitigate the issue. Ring Doorbells have become one of the most popular internet-connected doorbells installed in smart homes. These devices provide motion-sensing and video surveillance capabilities that allow users to see and communicate with anyone outside their door via an app -- even if they're not at home. One of the reasons people buy IoT doorbells is safety and the ability to ward off unwanted visitors by speaking to them through the device. But the vulnerability uncovered in the Ring device could have put users at risk from cyber attacks. The vulnerability stems from when the device is first configured to the local network, when the Ring smartphone app needs to send the wireless network connections to the Amazon Ring servers in the cloud. Researchers found that this takes place in an insecure manner that can be exploited by an attacker: not only does the device create an access point without a password, but the credentials of the network are also sent using HTTP, which means they can be exposed to snooping from nearby attackers.

How to Turn Data Management Challenges of Benchmark Reform into Opportunities for New Analytics

Firms can reap benefits from digitising contracts and applying a data governance framework to them, according to Gannon. For example, they will be able to adapt to regulatory change with more agility in future as, in minutes, the business or compliance team will be able to use contract analytics to see all of the documents that are impacted by a rule change. This will dramatically increase efficiency, reduce compliance risk and lead to better client outcomes. As well, firms can drive reporting analysis out of the digitised documents for management purposes. Says Gannon: “We find, particularly in corporate legal departments, that people oftentimes don’t know what’s in their contracts. Sometimes they are paying for things they no longer use, or they are unaware of risks. Maybe they are missing out on revenue opportunities. Just having the contracts digitised can give people better insights into their relationships with customers, vendors, and strategic partners.” Firms with digitised contracts will be able to analyse contracts in bulk and export the information into Word, Excel, a contract management database, or another type of database.

Organizations fail to implement basic cloud security tools

Applications in the cloud help streamline work and improve communications in the enterprise. The most popular cloud applications include Microsoft Office 365 (79%) and Slack (62%), which experienced significant growth over the past couple of years, rising from 56% and 43% in 2018, respectively. Despite early success in the cloud productivity market, Google's G Suite (33%) has lost traction, only seeing an 8% increase in adoption between 2018 and 2019, indicating increased competition in the cloud apps market, according to the report. Cloud app adoption is significant across industries, with the majority of organizations in education (81%), technology (80%), finance (82%) and healthcare (79%) adopting Office 365. While adoption rates were high, adoption of cloud basic cloud security was not, the report found.  One of the most popular cloud security tools is single sign-on (SSO). The report defined SSO as a cloud security tool that organizations use to authenticate users trying to access data within the cloud, referring to SSO as "table stakes when it comes to protecting data in the cloud."

Testing Microservices: 6 Case Studies With a Combination of Testing Techniques

The architects were responsible for gathering techniques, guidelines, and tools to be used by the developers. They were also responsible for creating an architecture that would minimize waste by reuse of proven techniques, tools, and components. The developers wrote JUnit and TestNG integration tests, and used an API mocking tool to mock dependent components. They also wrote Cucumber/Gherkin BDD acceptance API tests to capture the business requirements (they called these "contract tests"), which use a Docker image of the microservice and a Docker image of an API mocking tool called Traffic Parrot. The BDD tests verify both the microservice API and interactions with dependent components by verifying the interactions on the API mocks. That way, the BDD tests verify both microservice API request and response and all communication with dependent components by assertions and verifications. The company used JMeter to create performance tests. JMeter tests test individual microservices, and replaces the dependent components with API mocks of real dependencies like the microservices and the old legacy monolith.

Pros and cons of RPA platforms vs. APIs

As dependent systems change, RPA-powered processes may not be able to absorb the small changes that human beings would absorb without noticing. Changes like colors, button labels or menus can cripple RPA integration. "Thus, RPA can actually be less flexible than APIs," Thielens said. However, Coureil said he expects better OCR and machine learning capabilities will reduce these problems by discovering changes and adjusting configurations. "This potential self-healing property of future RPA could ease the workload of change requests and enhancements," he said. ... "The utility of RPA ends with trivial business processes, such as swivel chair data entry tasks or simple point-to-point orchestrations," said Ross Garrett, chief product officer at Cloud Elements, an API integration platform based in Denver. Most enterprise business processes are far more nuanced than this and rely upon complex data and application integration scenarios to work as required.

Kaspersky Lab Analysis Shines Light on DarkUniverse APT Group

The security vendor made the discovery when trying to identify an advanced persistent group the US National Security Agency (NSA) had been quietly tracking when the ShadowBrokers outfit leaked many of the spy agency's offensive tools in 2017. One of the leaked tools had been used by the NSA to check for traces of malware and other artifacts tied to specific APT groups on compromised systems. Kaspersky Lab's analysis of the tool revealed the NSA was using it to track 44 separate APT groups, many of them unknown and not publicly described at the time. Researchers from the security firm decided to see what they could find about one of the APT groups the NSA was tracking, identified only as "framework #27" in the tool. In a report Tuesday, Kaspersky Lab said its investigation showed the group — which it has dubbed "DarkUniverse" — targeted organizations in Middle Eastern and African countries, as well as entities in Russia and Belarus. 

---

Quote for the day:

"Leadership is an opportunity to serve. It is not a trumpet call to self-importance." -- J. Donald Walters

---

Daily Tech Digest - November 06, 2019

A cure for unfair competition in open source

Some companies are born out of open source, and as a result believe deeply and invest significantly in their respective communities. With their help, open source has revolutionized software for the benefit of many. Let’s call these types of companies Makers. As the name implies, Makers help make open source projects; from investing in code to helping with marketing, growing the community of contributors, and much more. There are usually one or more Makers behind the success of large open source projects. For example, MongoDB helps make MongoDB, Red Hat helps make Linux, and Acquia helps make Drupal. ... Now that open source adoption is widespread, lots of companies, from technology startups to technology giants, monetize open source projects without contributing back to those projects. Let’s call them Takers. I understand and respect that some companies can give more than others, and that many might not be able to give back at all. Maybe one day, when they can, they’ll contribute. We limit the label of Takers to companies that have the means to give back, but choose not to.

NYC launching IoT system to monitor traffic and reboot malfunctioning signals

In addition to monitoring activity and collecting data, the new system includes a reboot feature. When there is a problem with a traffic signal, a technician goes out to check the device and reset it manually. Transportation officials will use this new system to reset the devices remotely, without having to close lanes and stop traffic. Transition's Device Management System software also creates an interactive map of all connected devices, making it easier for city engineers to identify problems in the system. The city is counting on these new tools and data collection to improve safety, traffic management and transportation citywide. New York needs all the help it can get with traffic. Uber and Lyft have increased traffic congestion and trucks deliver 1.5 million packages from Amazon to city residents every day. In Manhattan, the average speed is 7 mph, about 23% slower than 10 years ago. Transition, a unit of Communications Systems, produces services and devices to provide security and surveillance, data center networking, business Ethernet, Fiber-to-the-Desk and wireless backhaul. Customers include enterprises, integrators, service providers, federal agencies, and the military.

Is AI Bias a Corporate Social Responsibility Issue?

Algorithms cannot be trained to understand social context. In the case of employment, workplace politics often play a role in performance evaluations. For example, some employees may be evaluated as top performers because they are related to a senior executive, have seniority, or are in the same social groups as their managers. However, none of this is captured on the employee evaluation forms that were used to decide which resumes would be used to train the automated recruitment tools. Computer scientists simply pull the resumes of employees with the highest performance rates within each role. But, those resumes clearly don’t show the full picture. And they propagate the status-quo, and all of the inherent biases that come with it. This is why data scientist Cathy O’Neil argues the statistical models produced by algorithmic decision making systems are simply opinions written into code. She argues that we should not assume training datasets are accurate or impartial, because they are encoded with the biases of their largely white, male producers. This is what legal scholar Rashida Richardson calls dirty data.

A digital twin for security superpowers

For security, a digital twin leverages more than just access to resources and subject-matter expertise across disciplines. For each worker, a digital twin assures that work is continuously situationally aware and contextually risk-appropriate. Designed to optimize the overall experience, the oft-opposing forces of security, productivity, and cost are objectively balanced for individual work products and the overall workforce. Oh, and digital twins aren’t just for individuals, as they can mirror aspects of physical environments that include classrooms, operating theaters, and manufacturing floors. A security-focused environment can immerse the security practitioner in the threat landscape and visually show the impact of proposed policy, technology, and regulatory changes. To extend organizational intelligence, digital twins can be tuned to encourage and enforce cultural aspects that affect security outcomes. Advances in analytics, machine learning, augmented reality, virtual reality, and automation have provided the genesis for digital twins. Let’s get started designing your security superpowers.

Ransomware authors seeking new ways to avoid being spotted

Sophos CTO Joe Levy said: “Every year, criminals adapt to the best-defences from operators and suppliers in the industry. At the same time, defenders must protect systems and processes with new functionality constantly being introduced, and with an ever-increasing global interdependency on these systems’ operation. “But you can’t defend against what you can’t understand. It isn’t always easy to visualise complex attack scenarios, especially given that the resultant cat-and-mouse game between attackers and defenders helps shape future threats. “Our report this year reflects both the broader range of the security domains we now observe and defend, and the wider reach of adversaries into new territory.” The annual report has this year broadened in scope to explore areas beyond Sophos’ historic purview around malware and spam prevention. Sophos principal researcher Andrew Brandt picked over some other key trends observed by the firm in the past 12 months in a newly published blog post.

5 tips on how to pick the right AI use cases

"The scope and scale of the data problem in AI is far larger than most people realize," explained Jen Snell, vice president of Verint, a chatbot development company. "So many organizations run into problems with their projects due to data -- from data quality to managing and wrangling data for meaningful insights to labeling and model building," she said. "In the beginning, it seems easy, but as you look to grow at scale, change models, manage and ensure control over the system, it gets tricky." ... One must be careful not to confuse the AI transformation with digital transformation. Sometimes, even non-AI-based automation tools are enough for the job. Before rushing into AI, proper research must be made to see if an AI project is the best way forward. Jonathan Duarte, who built AI-based chatbots for the likes of Wells Fargo, shared his experience.

Cisco forges tighter SD-WAN links to Microsoft Azure cloud, Office 365

The new agreement is expected to take that enhancement a step further and integrate Cisco SD-WAN more deeply with Microsoft Office 365 to bolster application insights that will enable the package “to manage optimal network paths more effectively and further improve user experience,” Gupta said. There will be additional details when the package is available in calendar year 2020, he said. Gupta said he expects trials to begin in the first quarter of 2020. SD-WANs use software to control the connectivity, management and services between data centers and remote branches or cloud instances. Cisco’s SD-WAN software lets customers set up a networking fabric to connect data centers, branches, campuses, and colocation facilities to improve network speed, security, and efficiency, the company says. Cisco’s package includes a menu of security features including support for URL filtering, Cisco Umbrella DNS security, intrusion/detection prevention, the ability to segment users across the WAN and embedded platform security, including the Cisco Trust Anchor module. The software also supports SD-WAN Cloud onRamp for CoLocation, which lets customers tie distributed multicloud applications back to a local branch office or local private data center.

Cryptocurrencies backed by cash could elude new regs

Shortly after the G7 report was released, the G20 published a statement agreeing that stablecoins have both potential benefits for financial innovation and risks. IOSCO said it would help the global G7's Financial Stability Board's work on stablecoins for the Group of 20 Economies. The IOSCO FinTech Network will also continue to assess and consider global stablecoin initiatives. "It is important that those seeking to launch stablecoins, particularly proposals with potential global scale, engage openly and constructively with all relevant regulatory bodies where they may be seeking to operate," Alder said. Unlike Bitcoin, which arguably has no intrinsic value because its based solely on supply and demand, "stablecoin" value is based on fiat currency or other assets to which it's tied such as real estate, precious metals or artwork. Facebook's Libra has become the public face for many other stablecoin initiatives because it could be launched globally and used by any of the social network's 2.4 billion active users. The cryptocurrency app will allow Facebook users to send, add or withdraw money "in just a few taps," using WhatsApp, and it will allow someone to fill their wallet, cash out or split a restaurant tab all using Messenger, the company said.

Smartphone and speaker voice assistants can be hacked using lasers

According to the researchers, as long as the light signal is carefully aimed using a telephoto lens with the correct amount of light, any MEMS-based microphone used in popular devices is vulnerable. The distances at which communication is possible varies by device, ranging from up to 110 meters for the Google Home and Echo Plus 1st Generation to just above 20 meters for the Apple iPhone XR and sixth-generation iPad. The equipment used to carry out the tests was a cheap five-milliwatt laser pointer, a laser driver, sound amplifier, and basic telephoto lens, together costing less than $600 combined. An objection that voice assistant manufacturers might make is that this kind of laser attack still needs a line of sight, for example from one building to another. It’s not clear how often this would be possible under real-world conditions. The obvious mitigation is to keep these devices away from windows. However, the researchers believe that making assumptions is the wrong way to understand vulnerabilities in this expanding class of gatekeeper devices.

5 principles for a fulfilling career from the ‘Father of Digital Mobile Communication’

“You can do things very fast. You can also fail fast ... If it doesn’t work, you try something else. That, I think, is a very different way of doing the work to innovate and develop products.” There’s another fundamental difference between startup world and Stockholm, says Jan. “European leaders are usually businesspeople,” he explains. “Silicon Valley leaders are a little bit like half-crazy people. They are doing things that few can really dream of … And I think that seems to continue to be the case. Those people pop up all the time. The companies we have seen the last 10 years like Google, Facebook, Netflix and so on. They all are like that, I think. They have very visionary leaders.” ... While we wait for our self-driving Ubers to arrive, Jan is happy to share the hard-won wisdom he’s gained on the avant garde of wireless tech. “The main thing for me is to give back,” says Jan, who consults with Ericsson and Sony in addition to working with various startups. “For the next generation to learn from our generation. They will have a lot of things they will do anyway – that they don’t have to learn from us.

---

Quote for the day:

"The ultimate measure of a man is not where he stands in moments of comfort, but where he stands at times of challenge and controversy." -- Martin Luther King, Jr.

---

Daily Tech Digest - November 05, 2019

Boeing's poor information security posture threatens passenger safety

Among a litany of easily remedied security failures, Kubecka reported that Boeing's test development networks were publicly exposed to the internet, potentially enabling a sophisticated adversary to gain access to Boeing software source code and build systems. "Imagine if you are an enemy and you tainted flight control software and suddenly a sensor or detection method didn't work when you go to war with them," Kubecka says. (CSO was able to verify that at least one of Boeing's test servers is still online but won't be publishing technical details to avoid helping potential attackers.) Other basic security precautions that constitute rudimentary due diligence also appear not being followed, including a lack of a TLS certificate (to enable encrypted web traffic via HTTPS) on the Boeing.com website home page, which means a malicious adversary could inject malware into web traffic and infect unsuspecting users. As of last week, more than 90% of web traffic is now encrypted, according to netmarketshare.com, making Boeing an outlier in a sector with known nation-state adversaries. If a company of Boeing's size can't even properly deploy a TLS cert on their website, what other information security lapses might they have committed?

How HR leaders can prepare for the future of work: 5 strategies

"One of the realities of the future of work is that there's going to be more decisions that are left up to AI and automation," Kropp said. "There'll be more moral and responsibility decisions that are going to occur. HR will have a new job in the future of work, in addition to the jobs it already has. And that job will be to be the ethical steward of the company in an AI enhanced and embraced world."  ...  "While IT will be great at driving innovation, they won't be able to understand the full ethical questions that are out there to be able to balance across this team," Kropp said. "We believe that HR is uniquely responsible and uniquely positioned to do this from the organization." ... Employee training typically falls under HR's role, which means HR must consider how technology might change their employees' skillsets, Kropp said.  "As managerial tasks get automated and the role of the manager changes, for example, if you keep doing the same thing, you're going to waste money on developing and training managers that no longer have the right capabilities," Kropp said. "If you don't change your learning and development strategy and rely on old job learning approaches, you're not have the workforce that you need."

GDPR is missing the point, says Edward Snowden

Snowden was speaking via a video link from Russia, where he is now living after leaking details of secret US government surveillance programmes to reporters back in 2013. "Regulating the protection of data presumes that the collection of data in the first place was proper, was appropriate, that it doesn't represent a threat or a danger, that it's ok to spy on everyone all the time whether they are your customers or your citizens -- so long as it never leaks, so long as only you are in control of what it is that you've stolen from everybody," he added. Snowden said that while GDPR is a "good first effort" that the bar was set pretty low before: "What I'm saying is that it's not the solution, it's not the good internet that we want." One of the most significant features of GDPR is that organisations can face a maximum fine of 20 million euros or four percent of worldwide turnover -- whichever is greater. While some large GDPR fines have already landed, Snowden said: "Until we see those fines being applied every single year to the internet giants, until they reform their behaviour and begin complying not just with the letter but with the spirit of the law, it is a paper tiger that actually gives us a false sense of reassurance," he said.

What Comes After Digital Transformation? One Answer Is The Self-Driving Enterprise

Data is often referred to as the new oil. But data is a bit more like crude oil. You have to first find and collect it from all of its vast repositories. Even when you do, it’s unrefined. Data is often bad. It’s all over the place. Oftentimes, key data points are missing, especially in an era of real-time and predictive analytics. You can’t just make decisions with what you have, you need to upgrade, organize and clean the sources, plug it all into an intelligent system and upgrade human capital to connect the dots and make the most informed decisions consistently all at the accelerating speed of business. Pretty much, every CEO knows they have data, operational and human capital problems. Digital transformation is one of the paths forward. You can’t solve it overnight and becoming digital is a game everyone is playing. But you can start making the investment in cognitive platforms that connect the disparate dots while also giving stakeholders the ability to literally ask different questions that beget different answers. This starts to change organizational behavior, develop new human and machine knowledge and capabilities that ultimately change organizational course. Gartner is already starting to track the space, adding several categories to its Hype Cycle for Supply Chain Planning Technologies. 

TechUK calls on datacentre sector to scale up climate change action efforts

“Datacentre operators, large and small, commercial (colocation) and in-house (enterprise), private and public sector need to establish baselines, set themselves targets and monitor progress. They should also consider commitments to public disclosure and customer transparency,” the tech trade body’s 28-page Datacentre energy routemap document states. These targets should be informed and aligned to the United Nation’s Sustainable Development Goals, particularly those focused on areas such as clean energy use and climate action, the document added. Some operators are already making waves in this regard, with the report calling out IBM and BT, in particular, for their “well-established and leading-edge climate change programmes”. While others, according to TechUK, still have some way to go to match their efforts. “The picture is not consistent across the industry and many operators can learn from their counterparts or adapt an industry template,” the report said.

Microsoft Security Setting Ironically Increases Risks for Office for Mac Users

By convincing a user to open specially crafted Microsoft Excel content on a Mac that has "Disable all macros without notification" enabled, a remote attacker can gain the same level of access to the system that the legitimate user has, CERT/CC said in its vulnerability note. "Attackers can do anything that they want by exploiting this issue," says Will Dormann, senior vulnerability analyst at CERT/CC. "They could install a virus, steal private files, or install ransomware. The sky's the limit." In a statement, a Microsoft spokeswoman said Microsoft was committed to investigating reported security incidents. "We will provide updates for impacted devices as soon as possible." The problem lies in how Microsoft Excel handles XLM content in SYLK (SYmbolic LinK) files, Dormann says. XLM is a macro format that used to be available in Excel versions up to and including Excel 4.0. Though Excel versions since then use VBA macros, Microsoft has continued to support XLM macros in later Excel releases, including those available with the latest Office versions for Mac.

What security companies – and all of us – can learn from the Deadspin debacle

If you don’t engage the people who make the company what it is, they’re going to walk. If you create a culture of uncertainty in the face of major changes, people are going to leave. If you mandate changes – not based on actual customer or user experience, but because of how it was done elsewhere – you’re going to drive a wedge further between the executive team and the rest of the company. Most importantly, if you put artificial barriers around what people do that are part of the reason for their success, and fire people for stepping out of them, you will cause a mass exodus. That’s what happened at Deadspin this past week. This is a clear example of how not to run a team. Effective managers keep teams engaged, communicate well and keep a culture of certainty even when there is turnover in senior leadership. Healthcare, like many other industries, is infamous for what we call “churn at the top,” where senior leadership changes significantly more rapidly than the levels beneath them. Each of those leaders has their own mandates from other leaders and board, and their own management style.

Digital Realty acquisition of Interxion to reshape data-center landscape

DRT didn’t really get into the interconnection business until 2015, when it acquired Telx. That gave it a boost in the U.S. but not the rest of the world. "This strategic and complementary transaction builds upon Digital Realty's established foundation of serving market demand for colocation, scale and hyperscale requirements in the Americas, EMEA and Asia Pacific and leverages Interxion's European colocation and interconnection expertise, enhancing the combined company's capabilities to enable customers to solve for the full spectrum of data center requirements across a global platform," said Digital Realty CEO A. William Stein in a statement. Interxion's well-established business relationships will give DRT a huge boost in Europe, Middle East, and Africa. Likewise, DRT touts its relationships with leading cloud platform operators and global enterprises as an opportunity to extend its value proposition to a global customer base. “The combination of Digital Realty with Interxion adds interconnection-rich sites in Europe to Digital’s global platform,” said Kelly Morgan, senior vice president for systems at 451 Research, in an email comment to Network World.

After Brexit, will 5G survive the age of the European empire?

DT and Huawei have already been close partners in some of Germany's first 5G rollouts, including what is said to be the first working 5G transmitter in Europe, located just above rooftop level on the antenna shown above, along Winterfeldstrasse in Central Berlin. In late October, Chancellor Merkel once again resisted calls from opposition ministers to take a harder stance on Huawei. The country maintains what it calls a "security catalog" listing global equipment suppliers that have pledged to refrain from including tools that may be leveraged in clandestine surveillance and spying. Although ostensibly toughening its "no-spy" regulations last May, the following October, Huawei officially made the revised approval list, and will continue to be a part of Germany's core 5G network for the foreseeable future. These telcos are among 5G's premier customers. Despite how the EU government would position itself, these companies are the ones tasked with implementing 5G standards, and maintaining interoperability among its implementations,

Q&A on the Book Agile Leadership Toolkit

Culture can’t be manipulated or altered directly, only indirectly. Things like trust, relationship, Rome and culture need time to grow and improve, and they can’t be built in a day. Successful leaders create the right structure so the culture can grow. Agile leaders give their teams a lot of freedom, space, trust, and inspiration for their daily work to increase their customer impact. Agile leaders focus on two important things to improve the culture: habits and informal leaders. The habits of a leader really influence the culture. Take for example when something goes wrong; what is the routine of the leader? Do they appoint firefighters to solely fix the important issue, or do they let the product owner decide how to solve it with the whole team? If the leader appoints firefighters, they probably will never achieve a culture of teamwork and collaboration. Another important thing to focus on is the informal leader. Every team has this role, and this person heavily influences the values – and therefore the local culture – of the team.

---

Quote for the day:

"Leadership is, among other things, the ability to inflict pain and get away with it - short-term pain for long-term gain." -- George Will

---

Daily Tech Digest - November 04, 2019

A VPN service that gets around the Great Firewall of China legally

Now there is a third option for WAN connectivity outside China. Teridion has developed an SD-WAN solution that leverages the plentiful, fast, low-cost domestic broadband and builds on it to provide access into high speed WAN connectivity outside the country in a way that’s consistent with the regulatory environment. To develop its SD-WAN Service for China, Teridion worked with legal authorities within China to ensure that this solution meets all Chinese regulations while being available to the world. Outside of China, Teridion has built a global WAN service that utilizes the public Internet as a backbone with unique capabilities to direct and manage the routing of traffic across this network. Teridion leverages a private routing infrastructure using Teridion Cloud Routers (TCRs) at the edge to establish the fastest path, at any given time, between a source and a destination. This approach provides accelerated access from one user site to another, or from user to SaaS applications and cloud workloads. Because Teridion has a lot of flexibility in choosing routes, this approach eliminates the reliability and performance gaps that are introduced when relying on the public Internet. 

DNS over HTTPS: Google hits back at 'misinformation and confusion' over its plans

Chrome will check if the users' DNS provider is on a its list of participating DoH providers, which currently include Cleanbrowsing, Cloudflare, Comcast, DNS.SB, Google, OpenDNS and Quad9. This list could expand in future experiments. "If the DNS provider is not on the list, Chrome won't enable DoH and will continue to operate as it does today. As DoH adoption increases, we expect to see the number of DoH-enabled DNS providers grow," noted Baheux. Mozilla is also implementing DoH in Firefox, albeit differently. Mozilla has also opted not to enable DoH by default for UK users because of pressure from the UK government. Another misunderstanding, according to Baheux, is that Chrome's DoH will prevent ISPs offering family-safe content filtering. Paul Vixie, a pioneer of DNS, who has called DoH a "cluster duck for internet security", this week applauded Google's approach to DoH, particularly for how it's enabling network admins to implement security controls. He also reckons Mozilla and Cloudflare should follow Google's lead.

What is cryptojacking? How to prevent, detect, and recover from it

Hackers have two primary ways to get a victim’s computer to secretly mine cryptocurrencies. One is to trick victims into loading cryptomining code onto their computers. This is done through phishing-like tactics: Victims receive a legitimate-looking email that encourages them to click on a link. The link runs code that places the cryptomining script on the computer. The script then runs in the background as the victim works. The other method is to inject a script on a website or an ad that is delivered to multiple websites. Once victims visit the website or the infected ad pops up in their browsers, the script automatically executes. No code is stored on the victims’ computers. Whichever method is used, the code runs complex mathematical problems on the victims’ computers and sends the results to a server that the hacker controls. Hackers often will use both methods to maximize their return. “Attacks use old malware tricks to deliver more reliable and persistent software [to the victims’ computers] as a fall back,” says Vaystikh. For example, of 100 devices mining cryptocurrencies for a hacker, 10 percent might be generating income from code on the victims’ machines, while 90 percent do so through their web browsers.

Forrester: The 5 IoT predictions paving the way for 2020

While IoT devices provide a bevy of benefits, the increase in devices creates more threat vectors for cybercriminals to exploit. "IoT is the cause of the vulnerability," Gillett said. "If these products weren't connected, then the crooks couldn't get in there and try to mess with the connection or the electronics." In 2020, attackers will target both consumer and enterprise IoT devices for ransom, the report found. This means cybercriminals could attempt to exploit regular customers and device manufacturers. To prevent attackers from taking advantage of IoT devices, designers must work closely with security teams in the company or hire experts that can integrate risk-mitigating techniques, Gillett said. ... IoT will also pave the way for increased truck driver assistance, or technology that helps truck drivers notice if they are becoming drowsy or inattentive, Gillett said. While fully self-driving trucks won't be in the cards for 2020, movement toward self-driving technology on the highway will progress next year, he said.

DevOps security shifts left, but miles to go to pass hackers

DevOps security, or DevSecOps, teams have locked down many of the technical weak points within infrastructure and app deployment processes, but all too often, the initial attack takes a very human form, such as a spoofed email that seems to come from a company executive, directing the recipient to transfer funds to what turns out to be an attacker's account. "Often, breaches don't even require hacking," Sanabria said. "It requires understanding of financial processes, who's who in the company and the timing of certain transactions." Preventing such attacks requires that employees be equally familiar with that information, Sanabria said. That lack of awareness is driving a surge in ransomware attacks, which rely almost entirely on social engineering to hold vital company data hostage. ... "Developers and operations may be blind to application security issues, while security tends to focus on physical and infrastructure security, which is most clearly defined in their threat models," Pullen said.

Microsoft rebrands Flow to 'Power Automate'; adds no-code Power Platform virtual agents

Mirosoft's Power Platform is the collection of Power BI analytics, PowerApps app-development platform and Flow, its workflow-automation engine. As of this week, Microsoft is rebranding Flow -- which is a lot like the If This Then That (IFTTT) platform -- as "Power Automate" to make its brands more consistent. Microsoft is adding robotic process automation (RPA) to Power Automate to help automate repetitive tasks. A public preview of the RPA capability, which is called UI Flows, is available this week. Microsoft also is introducing a new capability called Power Virtual Agents in public preview as of today, November 4. Power Virtual Agents is meant to enable anyone to build a no-code, no-AI-training required intelligent bot. It combines the Microsoft Bot Framework technology with the Power Platform technologies. Those who want to make a more complex bot can take advantage of the integrations that exist between the Bot Framework and Microsoft's Cognitive Services. Mirosoft's Power Platform is the collection of Power BI analytics, PowerApps app-development platform and Flow, its workflow-automation engine.

Why the Rust language is on the rise

You’ve probably never written anything in Rust, the open source, systems-level programming language created by Mozilla, but you likely will at some point. Developers crowned Rust their “most loved” language in Stack Overflow’s 2019 developer survey, while Redmonk’s semi-annual language rankings saw Rust get within spitting distance of the top 20 (ranking #21). This, despite Rust users “find[ing] difficulty and frustration with the language’s highly touted features for memory safety and correctness.” ... You’ve probably never written anything in Rust, the open source, systems-level programming language created by Mozilla, but you likely will at some point. Developers crowned Rust their “most loved” language in Stack Overflow’s 2019 developer survey, while Redmonk’s semi-annual language rankings saw Rust get within spitting distance of the top 20 (ranking #21). This, despite Rust users “find[ing] difficulty and frustration with the language’s highly touted features for memory safety and correctness.”

Take advantage of LinkedIn to prepare for interviews and meetings

Connect your LinkedIn account and the People Card will show job titles and profile images from LinkedIn. If it's someone in your LinkedIn network, you can see who you both know, and you can email people even if you don't have their email address saved in Outlook. Plus you can see all the email conversations you've had and any files they've sent you. Click on the LinkedIn icon at the top of the card, the LinkedIn heading in the middle or the 'Show more' link at the bottom to get a bigger window where you can see more emails, filter the files and see the highlights of their LinkedIn profile. If they have a new position or a work anniversary (or a birthday), that will show up, and you can click through to see their full profile -- helpful to see if they've posted anything that might be relevant in your meeting. If you use the Office 365 MyAnalytics feature, this will also show up on the People Card. MyAnalytics (formerly known as Delve) tracks your work habits in email, meetings and Office documents, spots who you frequently collaborate with and makes suggestions like blocking time in your calendar to get work done.

How SD-WAN is evolving into Secure Access Service Edge

An architectural transformation of the traditional data center-centric networking and security is underway to better meet the needs of today’s mobile workforces. Gartner predicts that the adoption of SASE will take place over the next five to 10 years, rendering existing network and security models obsolete. In my opinion, the term "obsolete" is a bit aggressive, but I do agree there is a need to bring networking and security together. Having them be procured and managed by separate teams is inefficient and leads to inconsistencies and blind spots. SD-WANs enable a number of new design principals, such as direct to cloud or user access, and necessitate the need for a new architecture – enter SASE. SASE combines elements of SD-WAN and network security into a single cloud-based service. It supports all types of edges, including WAN, mobile, cloud, and edge computing. So, instead of connecting a branch to the central office, it connects individual users and devices to a centralized cloud-based service. With this model, the endpoint is the individual user, device, or application, not the data center.

These 6 AI technologies will dramatically reshape enterprise project management

AI can play a key role in helping project managers make crucial decisions. Currently, 29% of organizations have already been affected by decision management, but 68% expect a high or moderate future impact, the report found. "As decisions need to be made throughout the project, project managers will rely on predictive models to assess options and select those that provide the highest likelihood of a positive outcome," Broome said.  This is also where machine learning algorithms come in, Schmelzer added, as they can show what features of a product consumer are or aren't using, for example, and help project managers make decisions accordingly.  Going hand in hand with decision management, expert systems also provide project managers with expert thinking. Some 21% of organizations have already been impacted by expert systems, and 64% expect a high or moderate future impact, the report found. "You can actually have machines automatically create these things called decision trees to help you," Schmelzer said. "It's like taking the ideas of the expert and putting them into machine learning."

---

Quote for the day:

"The successful man doesn't use others. Other people use the successful man. For above all the success is of service" -- Mark Kainee

---