Daily Tech Digest - November 18, 2019

5 disruptive storage technologies for 2020

big data / data center / server racks / storage / binary code / analytics
Supporting low-latency commands and parallel queues, NVMe is designed to exploit the performance of high-end SSDs. "It not only offers significantly higher performance and lower latencies for existing applications than legacy protocols, but also enables new capabilities for real-time data processing in the data center, cloud and edge environments," says Yan Huang, an assistant professor of business technologies at Carnegie Mellon University's Tepper School of Business. "These capabilities can help businesses stand out from their competition in the big data environment." NVMe is particularly valuable for data-driven businesses, especially those that require real-time data analytics or are built upon emerging technologies. The NVMe protocol is not limited to connecting flash drives; it also can serve as a networking protocol. The arrival of NVMe-oF (NVMe over Fabrics) now allows organizations to create a very high-performance storage network with latencies that rival direct attached storage (DAS). As a result, flash devices can be shared, when needed, among servers.



Book Review: A Leader's Guide to Cybersecurity

The authors note that certain standards may indicate what is not compliant but do not provide guidance on how to move the item into compliance. Otherwise, they observed the common state that many organizations are "perennially noncompliant with corporate standards." In one example used, a breach of Singhealth, the book lays out a series of occurrences where auditors gave a clean bill of compliance but the organization was compromised. While a no-finding audit may seem desirable to many at the time, these often simply shift costs forward: the audit was paid for, a breach happened, and the breach incurs significant cost. Post-breach, many organizations must patch the root cause plus anything else that was harmed after attackers made their beach-head, then the organization must deal with any regulatory/financial fall-out based on the type of data lost. Those previous clean audits offer no assistance in the aftermath, as they have been proven deficient.


Inside the Microsoft team tracking the world’s most dangerous hackers


Cyber threat intelligence is the discipline of tracking adversaries, following bread crumbs, and producing intelligence you can use to help your team and make the other side’s life harder. To achieve that, the five-year-old MSTIC team includes former spies and government intelligence operators whose experience at places like Fort Meade, home to the National Security Agency and US Cyber Command, translates immediately to their roles at Microsoft.  MSTIC names dozens of threats, but the geopolitics are complicated: China and the United States, two of the most significant players in cyberspace and the two biggest economies on earth, are virtually never called out the way countries like Iran, Russia, and North Korea frequently are. “Our team uses the data, connects the dots, tells the story, tracks the actor and their behaviors,” says Jeremy Dallman, a director of strategic programs and partnerships at MSTIC. “They’re hunting the actors—where they’re moving, what they’re planning next, who they are targeting—and getting ahead of that.”


explainable AI artificial intelligence
While it may seem trivial, the conflict here is a fundamental one in approaches to artificial intelligence. Namely, how far can you get with mere statistical associations between huge sets of data, and how much do you need to introduce abstract concepts for real intelligence to arise? At one end of the spectrum, Good Old-Fashioned AI or GOFAI dreamed up machines that would be entirely based on symbolic logic. The machine would be hard-coded with the concept of a dog, a flower, cars, and so forth, alongside all of the symbolic “rules” which we internalize, allowing us to distinguish between dogs, flowers, and cars.  Such a system would be able to explain itself, because it would deal in high-level, human-understandable concepts. The equation is closer to: “ball” + “stitches” + “white” = “baseball”, rather than a set of millions of numbers linking various pathways together. There are elements of GOFAI in Google’s new approach to explaining its image recognition: the new algorithm can recognize objects based on the sub-objects they contain.



The recent demand for low-code development comes from a desire to modernise IT environments quickly without taking a rip-and-replace approach, says Scheurman. “The push from the business on software development is to do things fast. They also want to automate. That is why I think low-code and robotic process automation (RPA) are part of a continuous spectrum.” Nick Ford, vice-president of product and solution marketing at low-code supplier Mendix, agrees that the hidden benefit of low-code is meeting user needs. “What often happens is there is an impetus for an idea – a new insurance product, for example,” he says. “That might be built as a prototype by a subject-matter expert who creates the data model on-screen in low-code, but over time that is fleshed out and made production-ready, including integration with back-office systems, by a developer collaborating on the same model. It is not waterfall – they have different windows into the model to do different things.”


Crossword Cybersecurity launches new family of ML based security ...

Many of today’s security and fraud problems occur within applications and are difficult, if not impossible, to detect externally to the applications. For example, if a fraudster has obtained a user’s login details via a credential attack, their access to the site while logging in can appear normal – but once inside the site, can start to behave maliciously. Nixer CyberML allows development teams to rapidly add machine learning based detection to online applications (online banking, ecommerce systems, ticket sites, critical business apps, etc.) that can learn to accurately distinguish between good and bad user behaviour. This initial release designed for developers, includes the Nixer CyberML architecture, code libraries for Spring framework based applications, and a local Nixer CyberML Engine designed to help with credential protection functionality. The Nixer CyberML Engine, stores and processes anonymous application event data, and contains the machine learning algorithms which determine whether events are normal or potentially malicious.


This 5G ambulance could be the future of emergency healthcare

nhs-1.jpg
Combined with real-time feeds of the patient's ultrasound scans, this lets the clinician recognise vital signs and decide whether a hospital intervention is needed, or if the wound can be managed directly in the vehicle. "To improve the efficiency of healthcare, we need to understand that not everyone needs to come to the hospital," said Clutton-Block. "With this technology, we can decide a lot better whether a wound should be healed on the spot, or if it requires further assistance." If the patient needs to be operated, he added, the clinician can make sure that the hospital has surgeons ready as soon as the ambulance pulls in. It is slightly premature, however, to expect to see smart ambulances driving around every city corner anytime soon. Clutton-Block explained that, contrary to preconceptions, this is not because the technology is too immature: "Actually, I don't think the technology is very difficult," he laughed. "And compared to some hospital equipment, which can reach hundreds of thousands of pounds, a VR headset isn't very expensive either."


How to collaborate better by collaborating less

With fewer (but higher-quality) collaborative projects, the team needed fewer meetings. Fewer meetings meant less time developing agendas and building presentations and fewer invitations clogging already packed in-boxes. The best part? The meetings that they did have felt essential and relevant to everyone attending them, meaning they did better work. The M&M’s retail leadership team became better collaborators by collaborating less. Less collaboration cleared the calendar and mental space that allowed them to dig deeper for higher-quality work. The impact wasn’t only in dollars (though the business was more profitable than it had been in years.) Their engagement scores went up because employees were doing more meaningful collective work. It might seem counterintuitive to think about how you can collaborate less. But when you collaborate in projects that truly matter the most, you’ll get much better results. Sure, you could opt for hypercollaboration, and maybe you can’t undo all the apps already put in place for it.


Digital Realty jumps into interconnection business

digital transformation /finger tap causes waves of interconnected digital ripples
PlatformDIGITAL is intended to provide a foundation for customers to address the need for global coverage, capacity, and ecosystem connectivity from a single data center provider; tailor infrastructure deployments and controls matched to business needs; operate deployments as a seamless extension of any global infrastructure; and enable global distributed workflows at centers of data exchange to remove data gravity barriers and scale digital business. Digital Realty's PDx approach was developed by enterprise IT practitioners and was created by codifying hundreds of product deployment combinations into repeatable implementation patterns. The goal is to allow customers to quickly deploy enterprise infrastructure and to scale their digital businesses globally.  It’s a similar interconnection strategy to that of DRT’s chief rival Equinix, but slightly different, notes David Cappuccio, distinguished analyst with Gartner. “This is a move by Digital Realty to compete on a global scale with Equinix. They have 220+ sites and have interconnected them all, similar to Equinix. But rather than focusing on the interconnection strategy and being the infrastructure glue for global enterprises like Equinix, they are focusing on the data part, with the idea that as you move applications or workloads closer to the customer, or a specific geo to solve location or compliance issues, you are also moving data.


AI is here to make you work smarter, not harder

Although it might at first sound counterintuitive, AI enables marketers to create highly personalised consumer experiences. It does so by offering a deeper understanding of the consumer, particularly when it comes to how they perceive and interact with the company and brand. By analysing input such as social media activity, marketers can harness real-time data to see what is being said about their brand and specific marketing campaigns, and then use this information to modify the messaging to achieve maximum effectiveness. Data-driven AI solutions are also a massive aid when it comes to creating personalised marketing campaigns that gets the right message across to the right people.  Previous data that was available to marketers was typically made up of demographic data such as age, location and gender. Now, there’s an abundance of much more informative data that is readily available to capture and analyse, including customers' past and present behavioural patterns and previous interactions between the two parties. Just think how much time it would take a small team to capture and analyse each consumer interaction!



Quote for the day:


"People seldom improve when they have no other model but themselves." -- Oliver Goldsmith


Daily Tech Digest - November 17, 2019

How banks and fintechs can balance security, safety and convenience


Craig Schleicher, who heads innovation for City National Bank in California, said he thinks the industry will see more automation in security. "As we move toward a lot more transactions being automated with triggers, we're going to see an evolution from card controls to much more dynamic and robust controls around individual transactions and what you permit without a human in the loop and what you don't. It's going to be a fun space to see evolve," he said. Schleicher said the concept of a financial institution's fiduciary relationship — doing everything in the best interest of the client — can be applied to how banks can help customers manage their identity. "We're seeing a lot of appetite for value-add services around identity theft protection and dark web monitoring," he said. "Some of these services started out with preventing financial fraud, but are now looking to protect their clients in other ways." Jig Patel, chief innovation officer for Fiserv's digital banking group, said it's imperative that fintechs and banks forge partnerships to combat security threats.


Image 11
Angular and React have many similarities and many differences. Angular is an MVC framework and structures the application very well, but you have less flexibility. React only provides the “view” in MVC – you need to solve the M and C on your own. Due to this, you can choose any of your own libraries as you see fit. Both React and Angular are component based. A component receives an input, and returns a rendered UI template as output. React’s use of a virtual DOM is to make it so fast. A virtual DOM only looks at the differences between the previous and current HTML and changes the part that is required to be updated. Angular uses a regular DOM. This will update the entire tree structure of HTML tags until it reaches the user’s age. React decided to combine UI templates and inline JavaScript/Typescript logic, which no company had ever done before. The result is called “JSX”(javascript) or “TSX” (typescript). JSX/TSX is a big advantage for development, because you have everything in one place, and code completion and compile-time checks work better.


Enterprise Architecture Alignment for the Intelligent Enterprise


In many ways, disruptive technologies are like a travel adventure – a journey beyond “business as usual” to “business unusual and unexplored.” These technologies offer opportunities to go back to basics, reimagine processes in the context of today’s realities, and recreate satisfying customer and employee experiences. Silently and gradually, disruptive technologies – such as the Internet of Things (IoT), cloud platforms, analytics, robotic process automation (RPA), artificial intelligence (AI), and machine learning – have made it to the list of must-have technologies for most progressive and innovative organizations. With the cost of devices and storage falling, the variety of available protocols and technologies is deep, and the pool of experts is growing. However, the journey from initial experimentation to full deployment of disruptive solutions requires the ability to deal with the uncertainties of a complex enterprise application landscape.


How to Use Redis TimeSeries with Grafana for Real-time Analytics


Time-series data is broadly defined as a series of data stored in time order. Examples of time-series data can range from stock prices over a period of many years to CPU performance metrics from the past few hours. Time-series data is widely used across many industry verticals. It has carved out its own category of databases, because relational, document-oriented and streaming databases do not fulfill the needs of this particular type of data. ... A typical time-series database is usually built to only manage time-series data so one of the challenges it faces is with use cases that involve some sort of computation on top of time-series data. An example would be capturing a live video feed in a time-series database. If you were to apply some sort of an AI model for face recognition, you would have to extract the time-series data, apply some sort of data transformation and then do computation. This is not ideal for a real-time use case. Multi-model databases that also manage other data models solve for these use cases where multiple data models can be manipulated in place.



According to Forbes, with time the trust factor in the capabilities of blockchain is expected to rise. The real impact of a distributed ledger is still under speculation, but given the spurt of applications already crowding the markets, it is only a matter of time before blockchain penetrates every industry sector. This universality of blockchain can be compared to “all things digital,” which Gartner predicted in 2017, and within two years that prediction turned into a formidable reality. Something that could reduce the growth period for blockchain is the existing transactional-integrity features of cryptocurrency. In near future, critical data will reside on distributed data stores — combining on-premise, cloud, and remote facilities — and blockchain will emerge as a savior for transactional integrity. According to J. Christopher Giancarlo, Chairman of U.S. Commodity Futures Trading Commission, free markets foster “creativity and economic expression to promote human growth and advancement.” This assertion comes from the belief that “sustained prosperity” is a natural byproduct of “open and competitive markets, free of political interference, combined with free enterprise, personal choice, voluntary exchange and legal protection of person and property.”


The Enterprise Architecture Versus Business Architecture Vs Business Design ...

The mission of the Architecture of the Enterprise remains crucial though. It has to integrate all disparate views and diagrams in the enterprise in one enterprise blueprint. Hence, the IT Enterprise and Business Architectures approaches need to be properly merged/ linked though so that they can deliver the entire blueprint of the enterprise. In addition, the enterprise level architects should also consider integrating all enterprise level activities that deliver process modelling, quality processes and products, non-IT schematics and engineering disciplines that ensure the trimming of the operation by measuring and adjusting the processes, and provide security, availability and scaling of the enterprise.  To sum up, the top Architect of the Enterprise should operate higher up in the enterprise hierarchy to cover the business architecture and integrate it with the technology and people architecture. This architect should ensure that it is the full blueprint of the enterprise that it is delivered rather than the IT blueprint or solutions. The architect should make sure that the audience is the whole enterprise rather than IT.


Security in the supply chain – a post-GDPR approach


The crux of the issue is this: although the GDPR sets out requirements relating to security – appropriate technical and organisational measures – it is not very prescriptive. The text is inherently legalistic and businesses are often left wondering how to apply the requirements. So, while a processor may be required to comply with the legal requirements, the processor’s view of what technical and organisational security measures are appropriate may differ from the controller’s own views. Likewise, where processors perform commoditised processing activities, they may not have sufficient knowledge of the personal data and how the controller uses it to assess the risks adequately. ... Clearly, if a processor is responsible for a security failure in breach of the GDPR, then the processor will have direct responsibility under the regulation. 


Generate TypeScript Client API for ASP.NET Web API

If you have ever developed SOAP base Web services using WCF, you might have enjoyed using the client API codes generated by SvcUtil.exe or Web Service References of Visual Studio IDE. When moving to Web API, I felt that I had got back to the Stone Age, since I had to do a lot of data type checking at design time using my precious brain power while computers should have done the job. I had developed some RESTful Web services on top of IHttpHandler/IHttpModule in 2010 for some Web services that did not handle strongly typed data but arbitrary data like documents and streams. However, I have been getting more Web projects with complex business logic and data types, and I would utilize highly abstraction and semantic data types throughout SDLC. I see that ASP.NET Web API does support highly abstraction and strongly typed function prototypes through class ApiController, and ASP.NET MVC framework optionally provides nicely generated Help Page describing the API functions.


Can Data Security And Employee Privacy Coexist In A BYOD Enterprise?

uncaptioned
The enterprise security perimeter has all but dissolved, and business apps and data are increasingly dispersed across devices and networks that companies don’t own or control. Cybercriminals have jumped on this widespread disruption to take advantage of security gaps to launch all kinds of attacks, such as phishing, man-in-the-middle, device takeovers and more. In the past, security professionals were able to lock everything down behind a firewall, but now we can’t put the genie back in the bottle. Enterprise mobility is here to stay, and it’s up to every CIO to figure out how to make enterprise data and user privacy securely coexist on employee-owned devices. We need to address these challenges head-on because enterprise mobility and BYOD trends will only continue to expand rapidly around the globe. Worldwide, the BYOD and enterprise mobility market is projected to grow by $84 billion, driven by a compounded growth of 16.3%. So while it’s clear that mobile enterprise users aren’t going back to their old PC workstations any time soon, enterprise security strategies must catch up to the rapid evolution of modern mobility ASAP.


Proof Of Work Doesn't Solve Every Blockchain Use Case

Proof-of-Work Doesn’t Solve Every Blockchain Use Case
What is Bitcoin? A question with many answers. Digital gold, magic internet money, a hedge against macro risk, tulip mania? One thing is for certain, Bitcoin found a product–market fit as a new form of money owned by the people. The Bitcoin brand is well known around the globe, the userbase is growing fast, and it continues to attract developers to the ecosystem. However, Bitcoin is not a panacea. When Satoshi first launched Bitcoin, he made design choices that were optimal for becoming a hard money with a limited attack surface at the cost of base-layer scalability and an expressive scripting language. One of those major choices was to implement a distributed proof-of-work (PoW) system to form network consensus. In other words, Bitcoin is great at being money but not very good at all the other potential use cases for a blockchain. The lesson here is that design choices come with tradeoffs, and Bitcoin has already cemented its path. This leaves room open for alternative blockchain architectures to capture value in a different market — such as supply chain management, enterprise software, social media, voting, prediction markets and more.



Quote for the day:


"Ninety percent of leadership is the ability to communicate something people want." -- Dianne Feinstein


Daily Tech Digest - November 16, 2019

Facebook machine learning aims to modify faces, hands and… outfits

Facebook Facial Recognition
Deepfakes use a carefully cultivated understanding of the face’s features and landmarks to map one person’s expressions and movements onto a completely different face. The Facebook team used the same features and landmarks, but instead uses them to tweak the face just enough that it’s no longer recognizable to facial recognition engines. This could allow someone who, for whatever reason, wants to appear on video but not be recognized publicly to do so without something as clunky as a mask or completely fabricated face. Instead, they’d look a bit like themselves, but with slightly wider-set eyes, a thinner mouth, higher forehead and so on. The system they created appears to work well, but would of course require some optimization before it can be deployed as a product. But one can imagine how useful such a thing might be, either for those at risk of retribution from political oppressors or more garden variety privacy preferences. In virtual spaces it can be difficult to recognize someone at all — partly because of the lack of nonverbal cues we perceive constantly in real life.



Cybersecurity is heading into a recruitment crisis: Here's how we fix the problem


Part of the problem is how people get into cybersecurity. Only 42% of the security professionals in the survey started out working in the field. There are few university degrees in cybersecurity, and there isn't an A-level or GCSE in security. There are plenty of certifications (not least the CISSP program (ISC)2 runs) and almost half of the organizations in the survey are increasing their training budget for security - but cross-training existing staff isn't going to fill the whole gap. And to get people interested in gaining a certification, they have to know that it's a viable career in the first place. "When you choose what you're going to do in your life, you probably make your choice when you choose your university and your course, and even the first year of university may be too late [to reach people]," says (ISC)2 board member Biljana Cerin. "I think we need to give high school students a bit more information about the field and the different aspects of it." There are plenty of bootcamps and campaigns to encourage children (and adults who want to switch into a technology job) to go into coding; there are far fewer teaching IT administration or security.


Cybersecurity remains the top concern for middle market companies


"The middle market is low hanging fruit for attackers," said Brad LaPorte, senior director analyst of end security and threat intelligence at Gartner. "They often do not have the budget, skillset, or ability to implement proper security best practices."  Nearly half of organizations (47%) said they believe risk in their industry will increase in the next year, and almost the same number (48%) said they believe risk for their company will also grow, the report found. Cybersecurity remains the most challenged risk to manage for companies. In Q2, 47% of organizations rated cybersecurity as their top concern, and the trend followed in Q3, with cybersecurity taking the top spot at 46%, according to the report. "Midmarket enterprises have the same security concerns as larger enterprises," said Paul Furtado, senior director analyst at Gartner. ... However, stakeholders for middle market organizations are recognizing these issues and investing in proper security tools; and those that haven't, should, he said. Beneficial investments include cybersecurity awareness training, insider threat mitigation, cloud security, improved authentication, and managed security providers (MSSP) or managed detection response (MDR), Furtado said.


Could AI’s next chapter bring design of feeling machines?

New research paper from Kingson Man and Antonio Damasio at Brain and Creativity Institute, University of Southern California, Los Angeles, looks into robots with feeling. Feelings are a mental expression of the state of life in the body and play a critical role in regulating behavior. “Our goal here is to inquire about conditions,” said the authors, “that would potentially allow machines to care about what they do or think.” Jan Cortes in Medical Daily: “The gist is simple: Simply build a robot that would have the ability to be aware of its existence, and the perils of it… a modern A.I. brain could easily develop feelings and behavior that will help guide it to self-preservation and survival.” “Even if they would never achieve full-blown inner experience in the human sense,” said the authors about the robots, “their properly motivated behaviour would result in expanded intelligence and better-behaved autonomy.”


The Time To Tackle Cybersecurity In Self-Driving Cars Is Now


Futurists and experts predict that if self-driving cars become widely adopted by the public, the vehicle itself will transform into something of an entertainment or leisure zone. Parents could watch animated films with their children on long drives. Executives could conduct presentations and hold conference calls en route to their destination. And if passengers traveling from out-of-town forgot to pack their razor or toothpaste, some casual online shopping from the vehicle's network will ensure that new grooming and hygiene products await them when arrive at their hotel. For every instance of digital convenience a self-driving car may provide, there is an equal or greater cybersecurity risk associated with it. Hackers could manipulate a vehicle's AV system and disable screens or potentially stream malicious content. There may be an anonymous, unidentified viewer or eavesdropper on the executive's call taking note of confidential information, while also gaining access to other participants' computer systems and networks outside of the car.


5G Industrial Automation Isn't Right Around the Corner

Bosch is a leader in factory automation.
(Image source: Bosch)
"It is not enough if just industrial automation companies get together and discuss this because we are not necessarily the 5G experts," said Bosch's Andreas Mueller, who serves as chairman of 5G-ACIA, in explaining the purpose of the association. "It's hard to say what the infrastructure will be capable of. It's hard to say what the network operators will do. So that's why... we have to reach out to all these other stakeholders as well." The group counts almost 60 members spanning manufacturers, network operators, radio equipment vendors, chipmakers, module makers and test equipment vendors. "We are very much interested in attracting more companies," said Mueller. "We want to attract end users." End users of 5G industrial automation solutions are the big prize for the companies that are investing in and testing these new technologies. But so far, none of them have launched live production lines using 5G. Even at Bosch's own factories, the 5G trials run parallel to the live production lines, but are not responsible for actual manufactured deliverables. In the future, Mueller hopes to see Bosch and many other companies using 5G to connect mobile control panels that can instantaneously start and stop factory machines.


Intel Capital Invests In Innovation To Improve Cybersecurity For Everyone

circuit board
Intel has put in a fair amount of effort in an attempt to fully bake cybersecurity into its technology strategy. The acquisition, integration, and eventual spinoff of McAfee played a central role in recent years and demonstrated that the road is not necessarily easy. Intel is still focused on improving cybersecurity, though, and has made a decision to disregard business as usual and try a different approach. Now, they’re focused on cybersecurity and will continue to invest in the industry. ... Kurkure explained to me that the Intel Capital investment philosophy around cybersecurity is to partner with innovative companies that can integrate and work with Intel to create a more holistic approach to cybersecurity. As opposed to the acquisition path Intel pursued with McAfee, the new strategy is to invest in companies that provide some synergy and that can collaborate with Intel—and with each other—in a way where the sum is hopefully greater than its parts. With Duality in particular, Kurkure stressed the importance of the privacy space right now.


Google Chrome experiment crashes browser tabs, impacts companies worldwide

Chrome logo
According to hundreds of reports, users said that Chrome tabs were going blank, all of a sudden, in what's called a "White Screen of Death" (WSOD) error. The issue was no joke. System administrators at many companies reported that hundreds and thousands of employees couldn't use Chrome to access the internet, as the active browser tab kept going blank while working. In tightly controlled enterprise environments, many employees didn't have the option to change browsers and were left unable to do their jobs. Similarly, system administrators couldn't just replace Chrome with another browser right away. "This has had a huge impact for all our Call Center agents and not being able to chat with our members," someone with a Costco email address said in a bug report. "We spent the last day and a half trying to figure this out." "Our organization with multiple large retail brands had 1000 call center agents and many IT people affected for 2 days. This had a very large financial impact," said another user.


Make people, not tools, the focus of DevOps initiatives


What differentiates high-performers from less-productive teams? It all starts with a dedicated approach to upskilling team members, Groll said, which can include online resources and other techniques. "Companies that have really adopted a digital approach, an immersive learning approach, are much more successful." There are several ways for organizations to establish community structures to promote learning, both to identify common internal struggles and be more resilient to personnel or product changes. According to Accelerate, more than half of elite performers use communities of practice -- small groups of voluntary practitioners -- which was a common thread among attendees at the conference, as well. The report also named bottom-up DevOps initiatives and proofs of concept as common elements among elite performers -- those who nailed DevOps.


3 Reasons to Do a 'Proof of Concept' With MDR Providers

Every security vendor promises the moon in their marketing materials. As a small organization, we need to be confident that any tool we buy will do what we need it to do in our environment. The only way to do that is to kick the tires. PowerPoint presentations and demos are a helpful starting point. But just like buying a new car, you need to take technology for a test drive. Otherwise, you risk wasting time and money, not to mention your own reputation. A POC won't answer every possible question about a piece of technology or a service provider. But a provider's willingness to engage with you - and the way they engage with you - will help you learn a great deal about what your relationship will be like once the ink on the contract is dry. One of the most surprising things I found as we evaluated managed detection and response providers was how few of them would even agree to do a POC. When vendors refused, I could only conclude that our business wasn't a good fit for them or they couldn't back up their marketing claims. Ultimately, we selected Expel.



Quote for the day:


"Your greatest area of leadership often comes out of your greatest area of pain and weakness." -- Wayde Goodall


Daily Tech Digest - November 15, 2019

IT Ecosystems Have Come of Age: Has Your Organization?

Image: metamorworks - stockadobe.com
Don’t allow chaos to take over. Ever heard the term, “organized chaos”? Transforming your team will likely mean you’re changing every person’s role in your organization. It’s challenging. There will be a point in time where no one will quite know what they should be doing. And that’s OK. But it’s also where planning comes in. The planning process helps you think through any potential drawbacks and anticipate where there may be friction. This means continually looking for opportunities to evolve your processes or replace them with new ones. Failure to spend enough time planning can lead to breakdowns, which can affect your systems availability or important programs. This could spell disaster, so be sure to spend enough time in the planning stage and organize the transformation as much as possible. There may be those in your organization who feel that jumping in feet first and making the changes very quickly is the best way to overcome the naysayers and show progress. Many times, the senior management team or your board may support this path. However, it can be the quickest way to fail.



Vulnerability in Qualcomm's Secure Execution Environment

Vulnerability in Qualcomm's Secure Execution Environment could allow hackers to steal sensitive data from Android devices
Researchers at cyber security firm Check Point have discovered a vulnerability in Qualcomm chipset, which could allow attackers to have unauthorised access to sensitive data. The vulnerability (CVE-2019-10574) exists in Qualcomm's Secure Execution Environment (QSEE), an implementation of Trusted Execution Environment (TEE) based on ARM TrustZone technology. QSEE, more commonly known as Qualcomm Secure World, is a secured area present on the main processor. The purpose of creating this hardware-protected space is to secure sensitive information, such as passwords, payment card credentials and encryption keys, from unauthorised access. ARM TrustZone has now become an integral part of all modern mobile devices. These devices come with specialised, trusted components that handle movement from device's Rich Execution Environment (REE) to TEE. In this way, the hardware-based security capabilities of the TEE can be prevented from being compromised by software or apps outside the trusted zone.


Monoliths to microservices: What to know about modernising enterprise applications

What to know about modernising enterprise applications image
Shifting to microservices can be done in one of two ways. The first option is to keep a solid monolithic base and start building microservices around it. The second option is to iteratively transform whole applications to microservices. In either case, teams need to identify the boundaries of each microservice — they must encapsulate each business function as a ‘bounded context.’ To do so, teams must minimise dependencies of newly formed microservices to monolith applications. They must establish service-to-service intercommunication outside monoliths and begin fostering trust in a new, decomposed application environment. In this setting, they can extract bounded contexts to a single microservice and its database. ... Deploying microservices in this way increases the organisation’s ability to provide cross-unit and cross-application functions. Companies can create a perpetual evolution of their architecture and support new business processes by enforcing the established boundaries between new and existing modules as well.


3 ways to implement a functional programming architecture


While functional programming falls outside of the mainstream code languages, developers and architects interested in it should consider three ways to implement it: as part of a functional architecture, as part of an isolated or independent architecture, or as part of a hybrid programming model. Fundamentally, a pure functional programming language should not retain state and is more like a math expression than a procedural program. This architecture works for compiler construction or, perhaps, for APIs. A program to shorten and forward a URL, for example, might better fit a pure functional language than other, more common approaches. List processing, or LISP, is an impure functional language in that it can mix in traditional procedural programming along with the functional approach by using states and control flow. Unfortunately, few applications tend to fit a pure functional approach, and few programmers want to program in a mixed language like LISP. Software architectures, however, allow for two other functional programming approaches that fit some projects.


Why retailers can’t get enough data scientists

Why retailers can’t get enough data scientists
Retailers are on the hunt for data scientists, now more than ever. Given the rise in online shopping and the cut-throat competition from e-commerce giant Amazon, smaller retailers have begun closing their physical locations around the world. Dubbed the “retail apocalypse,” 8,600 stores will close in 2019 alone. Studies show that retailers are also forced to shift their sales strategies, offering more personalized online experiences to customers. Given this shift, retailers are actively seeking candidates in the data world who can help capture customer loyalty and keep sales high. The shift to a more data-centric approach in retail is not necessarily new, though there has been a big push in recent years. Retail giant Target Corporation arguably led the charge when, in 2013, the company hired Paritosh Desai as vice president of business intelligence, analytics and testing. Not only did Desai hire a robust data team, but he also created a data-driven culture company-wide. He established fluidity between the data team and managers by creating an analytics system that managers could use themselves, promoting data-driven decision-making across the board.


DevSecOps: The Answer to the Cloud Security Skills Gap

As security moves into the cloud, that team is going to be responsible for rebuilding that infrastructure in the cloud, and if security isn't a part of the conversations around this infrastructure, organizations are missing a huge opportunity. When organizations decide they want to do DevSecOps, they turn to a team, be it development, operations, or security, and tell them they need to get on board with transforming, often without the proper skills, resources, or guidelines. You need to know your DevOps teams' comfort level with security, and around digital transformation. For example, if they don't know about serverless infrastructure, beyond the obvious, then you're in for trouble. Expecting a team to exclusively learn on the fly is basing a strategy on hope, which is always doomed to fail. Instead, take your spare moments and offer your DevSecOps team opportunities to learn from their blind spots, whether with additional certifications or shadowing. It doesn't have to be perfect, but every bit helps.


IT heads praise hybrid cloud models but still opt for traditional data centers

IT Technician with a Laptop Computer and Black Male Engineer Colleague are Talking in Data Center while Walking Next to Server Racks. Running Diagnostics or Doing Maintenance Work.
"As organizations continue to grapple with complex digital transformation initiatives, flexibility and security are critical components to enable seamless and reliable cloud adoption," said Wendy Pfeiffer, CIO of Nutanix, in a statement. "The enterprise has progressed in its understanding and adoption of hybrid cloud, but there is still work to do when it comes to reaping all of its benefits. In the next few years, we'll see businesses rethinking how to best utilize hybrid cloud, including hiring for hybrid computing skills and reskilling IT teams to keep up with emerging technologies," she added. More than 80% of respondents told the survey that hybrid cloud environments were the ideal model for IT operations, especially in the Americas. Three out of every five IT managers surveyed said flexibility and mobility are some of the main features they look for in a cloud system, and the report said, "cherry-picking infrastructure in this way to match the right resources to each workload as needs change results in a growing mixture of on- and off-prem cloud resources, like the hybrid cloud."


The success of machine learning rests on scalability

MIT ARM Logo
For some years embedded processors have had the ability to vary their operating frequency and supply voltage based on workload. Essentially, a processor’s core can run slower when it isn’t busy; scaling back the main clock frequency directly translates to fewer transistors switching on and off per second, which saves power. When the core really needs to get busy, the clock frequency is scaled up, increasing the throughput. There is a relationship between supply voltage and clock frequency; by reducing both, the amount of power conserved is amplified. This kind of scaling isn’t going to be enough to deliver the power and performance needed in the embedded devices now being developed to run ML models. That’s because the way we measure performance is going to change. Right now, processors are typically measured in terms of operations per second; we’re now measuring that in teraops, or trillions of operations per second (TOPS). Using TOPS to measure the performance of a processor executing inferences won’t make as much sense as it does when executing sequential code, because the way the model runs isn’t directly comparable to regular embedded software. ML processors will be measured on the accuracy they achieve when delivering a given number of inferences per second for a given amount of power.


How The Internet Of Things Will Turn Us Into Connected Workers

Smart watches
There's little doubt that connected workers are the future, but one thing that employees and unions should be mindful of is the possibility of mission creep. Sure, IoT wearables are now helping workers stay safe and helping them be more efficient in their work, but there's a risk that this seemingly innocent beginning will provide the groundwork for the gradual yet inevitable encroachment of smart technology into most or all aspects of an employee's day. In the future, wearables and smart tech may be used to push employer control over employees to excessive, even counterproductive levels. Does this sound like an exaggerated prediction? Maybe, but there are signs that at least some companies may end up moving in a recognisably dystopian direction. Most notably, Amazon patented a wristband in 2018 that tracks employee movements within warehouses, and that even uses ultrasonic detectors and vibrations to direct workers' hands in the right direction of ordered items. Coupled with reports of how Amazon summarily and routinely fires employees who don't labor speedily enough, this kind of development invokes a future where IoT is exploited by employers to increasingly tighten the yoke they tie around the necks of their employees.


9 Recommendations to Manage Cloud Migration Complexities

9 Recommendations to Manage Cloud Migration Complexities
Is your organization still in a state of flux on how to leverage this trend? Or, are you among the innovators who are inclined to adopt cloud-first strategies and encash the cloud opportunity? For most of the SMBs experiencing the high operational cost of IT infrastructure and compromised app performance, migration to the cloud environment seems like a lucrative option. With the multitude of benefits such as the pay-as-you-go purchase model, enhanced collaboration with globally distributed teams, robust database backup, seamless implementation of the disaster recovery system, and faster application implementation—cloud migration is the right mainstream strategy for any evolving business. But for a cloud newbie, considering to migrate their first workload to the cloud, a little consideration into prerequisites and caution in implementation will ensure that they can maximize cloud investments. A stalled cloud implementation will increase cost, lead to loss of sensitive information and operational disruption. While the implementation of any new technology is bound to encounter minor glitches, complying with the below-listed recommendations can help in minimizing errors.



Quote for the day:


"If a leader loves you, he makes sure you build your house on rock." -- Ugandan Proverb


Daily Tech Digest - November 14, 2019

Digital Transformation is the Industrial Revolution of our age

digital transformation
Digital transformation isn’t just about technology. It’s about leadership and partnership and stewardship. It should come as no surprise that one of the most important influences McKinsey identified when it comes to determining the ultimate outcome of any transformation is a team of leaders who not only understand digital tech but also feel a sense of urgency about leveraging it; who can’t wait to start the process and bring the rest of the organization along. That’s a tall order, becoming that kind of leader. Being someone who’s willing to challenge the status quo, experiment with the unfamiliar and get comfortable with the prospect of failure. But the only time I’ve ever seen any organization enjoy dramatic growth is when they tried something (and hired someone) dramatically different. Which brings us to an equally important ingredient of transformational leadership: Integrators. According to McKinsey, the leaders most likely to succeed in exacting change are those willing to step back and recruit uniquely qualified partners who’ll help them integrate -- and translate -- new digital tactics into existing and evolving business strategies.



Atlassian expands Jira Service Desk to non-IT biz teams


Although billed as a collaborative IT service management (ITSM) tool, many Jira Service Desk customers have, in practice, adapted the application to deliver a variety of services to end users in the enterprise, Atlassian said. With that in mind, the company today introduced new templates and workflows in Jira Service Desk to encourage its use outside of IT. Templates make it easier to configure the application to better meet the demands from HR, facilities and legal teams. The “out-of-the-box” functionality allows HR or operations managers to create and maintain their own service desks with minimal involvement from IT, Atlassian said. “HR and facilities teams can now leverage Jira Service Desk to more easily manage tasks like employee on-boarding and fielding maintenance requests, and legal teams can shift from manually chasing down signatures to working collaboratively with an automated digital workflow,” the company said in a blog post. The announcement comes as a range of vendors in the market, including ServiceNow and others, have also moved to expand their products with modules that support non-IT use, driving a trend around enterprise service management (ESM).


Cybercrime, meet AI


The good news is that any such automated APTs will arrive slowly, because AI is complicated. An AI algorithm isn’t usually designed to be user friendly. Instead of pointing and clicking, you have to customise the hacking tool to a degree that needs AI expertise. Those skills are in short supply in the industry, let alone the hackersphere, so we’re likely to see this achieved first by nation-states, not by hobbyists – which means that the first likely targets are those with national interest. Let’s look at some public examples. A while ago there were hacks on Anthem, Primera and Care First, major healthcare providers in the US, all of which worked with a lot of federal employees. At the same time, Lockheed and the Office of Personnel Management, which handles Class 5 security clearance, were hacked, losing fingerprint and personal data for thousands of people. One theory about these hacks was that a nation state stole the data. As it didn’t turn up on the dark web for sale, where did it end up? If this nation does now possess it, they have terabytes of healthcare, HR, federal background check and contractor data at their command.


3 emerging memory technologies that will change how you handle data


Intel’s Optane DC persistent memory drops into a standard DIMM slot connected to a CPU’s memory controller. Available in capacities of up to 512GB, it can hold several times more data than the largest DDR4 module. The information on an Optane DC persistent memory DIMM operating in App Direct Mode is retained when the power goes out. In contrast, volatile memory technologies like DRAM lose data quickly if they aren’t constantly refreshed. Software does need to be optimized for Intel’s technology. However, the right tweaks allow performance-bound applications to access Optane DC persistent memory with low-latency memory operations,. Alternatively, the DIMMs can be used in Memory Mode, where they coexist with volatile memory to expand capacity. Software doesn’t need to be rewritten to deploy Optane DC persistent memory in Memory Mode. The technology can also be used in what Intel calls Storage Over App Direct Mode, where persistent memory address space becomes accessible through standard file APIs.


Consumer Data Privacy Rights: Emerging Tech Blurs Lines

emerging technologies alexa data collection
Security experts say that consumers should have fundamental data-privacy rights. If a company or government collects a consumer’s private data, it must have a legal basis, and must also have correct security measures in place to properly protect it. Individuals should also have the right to decide what and how their personal data is stored, experts like De Guzman have agreed. However, over the years court systems, companies and lawmakers have mulled over the data privacy implications of new tech, as exemplified through various legal cases throughout the years. For instance, Riley v. California shed light on warrantless searches of cell phones. In 2014, the Supreme Court ruled that the “search incident to arrest” exception does not extend to a cell phone, and police need to obtain search warrants to search cellphone data. Another case, U.S. v Microsoft, in 2013 brought data ownership and privacy into the spotlight, after U.S. authorities tried to access customer emails through Microsoft from a data center housed in Dublin, Ireland as part of a U.S. trafficking investigation.


Employees – the weakest link in email security?

BEC scams
Email is not only one of the most important channels of communication in day-to-day business, but unfortunately also one of the biggest gateways for cyber attacks. According to the safety and network specialists Barracuda Networks, 91% of all attacks start with an email. Gateway solutions such as Barracuda Essentials therefore represent an important first line of defence against the dangers posed by malicious emails. Not only do such solutions reliably recognise spam and phishing emails, they also provide protection against sophisticated attacks like zero-day attacks in which cyber criminals exploit unpatched security flaws in firmware and software in order to release malware or steal data. Thanks to the use of cutting-edge techniques such as sandboxing and artificial intelligence, it is becoming increasingly difficult for cybercriminals to overcome these defence systems. They are, therefore, increasingly mounting targeted attacks on workers by sending personal messages tailored to the recipient. Such emails are often not recognised as spam or phishing attempts by the defence systems, and these messages are therefore able to thwart the shield settings in place.


When it comes to cybersecurity, is your company taking action the way it should be?
IT teams are under enormous pressure to keep up with changing tech trends. The list of current tech capabilities is long and growing by the day — right-speed IT, blockchain, augmented and virtual reality, machine learning, and advanced analytics are just a few examples of technologies that IT teams are expected to be experts in. While businesses are happy to invest in the technology itself, they often neglect to likewise invest in the team making it all work. A Business Reality Check survey found that upwards of 40% of senior executives are increasing spending on tech, but fewer are investing in tech talent. As a result, many IT teams are stranded in firefighting mode, cleaning up after attacks, mitigating vulnerabilities, and improving security defenses rather than leveraging new technology to its full strategic potential. To solve this problem, organizations are turning to cybersecurity automation. A 2019 Domain Tools/Ponemon survey found that 53% of respondents don’t have enough staff to monitor their organization’s cyberthreats 24/7, and 60% believed automation will be used in the next few years for threat hunting.


Attention cybersecurity entrepreneurs: CISOs want simplicity!

easy simple pixel hand computer pointer
Like many CISOs today, Guttman has a mission to simplify her organizational security. To that end, she warns that “CISOs must be ruthless about selecting and leveraging products and security environments,” explaining that tight budgets require IT organizations to adopt a strict and systematic evaluation process. “I'm looking at strategic gaps in cybersecurity, and whether legacy products provide the needed coverage. To some degree, it’s a zero-sum game – I often need to shed incumbent components and solutions to free up budget for new tech.” Adam Ely concurs, citing the popular “shift-left” approach to managing solutions at Walmart. “I'm looking at how can we build security into the fabric of our operations, as a process, as a technology, so that we can stop bolting on tech ad hoc, force-fitting tools and solutions that were not designed for a given workflow.” He warns cybersecurity vendors against narrow point solutions, as large companies are increasingly drawn towards migration to a single platform that can be leveraged across use cases and applications.


Plugging the Data Leak in Manufacturing


IIoT helps bring visibility to managers, allowing them to see whether machines are on, if they’re running efficiently and if there are any issues to address. In the event an issue arises, because of the data that IIoT provides, the technology can also allow manufacturers to trace back parts to where they were made and assess whether there’s been a problem with the machine, the part or something else entirely. As IIoT systems depend on these sensors to collect and parse through vast amounts of data, it’s vital to ensure that there are controls in place to safeguard that data and ensure its integrity. However, it can be easy to overlook the fact that this data needs to be protected in the first place. After all, it’s unlikely these systems are handling sensitive data that’s subject to regulatory compliance like protected health information (PHI) or personally identifiable information (PII). However, IIoT-generated data – calibrations, measurements and other parameters – still need to be stored, managed and shared securely to provide a company with maximum impact.


How retail companies can better protect themselves against cyberattacks

The "carders" who obtain stolen cards are able to upload them to a website, which then sells them anonymously and at huge discounts to their customers. This type of scam costs retailers millions of dollars in lost sales from both the gift cards and the products they're used to purchase, according to IntSights. Another popular method is card-not-present (CNP) fraud, a type of scam in which the customer doesn't have to physically present the card to a merchant during a transaction. Typically occurring online, this kind of fraud has risen due to the increased popularity of e-commerce sites. To fight this type of crime, many online retailers now require the CVV code from the card during a transaction. However, even CVV codes are now available on the Dark Web. In fact, full profiles of victims with their ZIP codes, PINs, and CVVs are worth more on the Dark Web because they help criminals more easily sneak past any security measures on a retail site. The Dark Web is home to many marketplaces that sell such credit card information, including one known as the Jokers Stash, according to the report. The underground credit card theft industry even works like a regular business with customer support and user reviews.



Quote for the day:


"Don't necessarily avoid sharp edges. Occasionally they are necessary to leadership." -- Donald Rumsfeld