Daily Tech Digest - March 02, 2020

5G and IoT security: Why cybersecurity experts are sounding an alarm

There are five ways in which 5G networks are more susceptible to cyberattacks than their predecessors, according to the 2019 Brookings report, Why 5G requires new approaches to cybersecurity. They are: The network has moved from centralized, hardware-based switching to distributed, software-defined digital routing. Previous networks had "hardware choke points" where cyber hygiene could be implemented. Not so with 5G; Higher-level network functions formerly performed by physical appliances are now being virtualized in software, increasing cyber vulnerability; Even if software vulnerabilities within the network are locked down, the 5G network is now managed by software. That means an attacker that gains control of the software managing the network can also control the network; The dramatic expansion of bandwidth in 5G creates additional avenues of attack; and Increased vulnerability by attaching tens of billions of hackable smart devices to an IoT network. ... The lack of regulations for 5G security, "is why these attacks happen day in and day out" and is also the reason, "2019 was considered the worst year for cybercrime,'' Bencenti said.

More than 40% of privacy compliance technology will rely on AI by 2023

At the forefront of a positive privacy user experience (UX) is the ability of an organization to promptly handle subject rights requests (SRRs). SRRs cover a defined set of rights, where individuals have the power to make requests regarding their data and organizations must respond to them in a defined time frame. According to the survey, many organizations are not capable of delivering swift and precise answers to the SRRs they receive. Two-thirds of respondents indicated it takes them two or more weeks to respond to a single SRR. Often done manually as well, the average costs of these workflows are roughly $1,400 USD, which pile up over time. “The speed and consistency by which AI-powered tools can help address large volumes of SRRs not only saves an organization excessive spend, but also repairs customer trust,” said Mr. Willemsen. “With the loss of customers serving as privacy leaders’ second highest concern, such tools will ensure that their privacy demands are met.”

Cisco security warnings include firewall holes, Nexus software weaknesses

The firewall and UCS vulnerabilities all have a severity level of “high” on the Common Vulnerability Scoring System and include: A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could let an authenticated, local attacker execute arbitrary commands on the underlying operating system (OS). The vulnerability is due to insufficient input validation. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS with the privileges of the currently logged-in user for all affected platforms excluding Cisco UCS 6400 Series Fabric Interconnects. On Cisco UCS 6400 Series Fabric Interconnects, the injected commands are executed with root privileges, Cisco stated. A second vulnerability in the local management of the same CLI interface in Cisco FXOS Software and Cisco UCS Manager Software could allow similar problems. A weakness in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could let an unauthenticated, adjacent attacker exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2-adjacent affected device.

Everything you need to know about the Chief Information Security Officer role

In short, crucial – ensuring that IT systems comply with security and regulatory requirements is the top priority for tech chiefs, according to Grant Thornton LLP and the Technology Business Management Council. They report as many as 83% of IT leaders have increased spending on cybersecurity in the past 12 months. Kind of. While it's good news that CISOs have an increasingly high-profile executive audience for their opinions, the strategic importance of cybersecurity is far from guaranteed. Almost half (43%) of CISOs feel that they are in direct competition with other business and IT initiatives for funding, reports 451 Research and Kaspersky. That battle for cash is at odds with wider business trends: almost every expert recognises businesses need to take security more seriously than ever before. But while 40% of CISOs say their organisation has been subjected to a security attack in the past two years, just 29% of CISOs believe they're very well-positioned to deal with security risks, according to KPMG and Harvey Nash. Consultant EY says organisations can only stay one step ahead of the cyber threat by creating what it refers to as "a culture of security by design". This approach relies on bridging the divide between the security function and the C-suite.

How to find the right zero trust strategy

Where data is anonymised, the security visibility needed for zero trust is reduced. Data anonymisation can mitigate some data protection concerns, but according to the GDPR, only completely anonymous data is not personal in nature. Data is pseudonymised in most cases, meaning it’s possible to re-identify individuals. However, the application of data anonymisation techniques complicates ZT visibility by making it harder to identify the sensitivity or criticality of data in its anonymised form. Colin McMillan, technical director for security at Cisco, says: “Data anonymisation has been used by some European customers to deal with data sovereignty issues. But when implementing ZT, they still want visibility. Customers have implemented technical solutions in non-standard ways to get around this, making maintenance and support challenging for everyone involved.” Non-security executives think that zero trust is just a network security architecture.

Is Artificial Intelligence (AI) A Threat To Humans?

AI will change the workplace and the jobs that humans do. Some jobs will be lost to AI technology, so humans will need to embrace the change and find new activities that will provide them the social and mental benefits their job provided. As Bostrom advises, rather than avoid pursuing AI innovation, "Our focus should be on putting ourselves in the best possible position so that when all the pieces fall into place, we've done our homework. We've developed scalable AI control methods, we've thought hard about the ethics and the governments, etc. And then proceed further and then hopefully have an extremely good outcome from that." If our governments and business institutions don't spend time now formulating rules, regulations, and responsibilities, there could be significant negative ramifications as AI continues to mature. Artificial intelligence will change the way conflicts are fought from autonomous drones, robotic swarms, and remote and nanorobot attacks. In addition to being concerned with a nuclear arms race, we'll need to monitor the global autonomous weapons race.

Cloud spending set to outpace traditional on-prem

Although many who follow the hype thought perhaps this shift took place a few years back, this is actually much earlier than I expected, and perhaps faster than most enterprises can manage. Part of this is a bit of “cloud washing,” considering that those with older, on-premises solutions have now rebranded their technology as “private clouds.” Although some of the technology is indeed private cloud technology, many so-called private cloud solutions predate cloud computing and don’t support cloud computing features such as auto- and self-provisioning or supporting automated elastic scalability. You would have to audit all of those technology providers who claim “private cloud” to determine how many of those exist, which is not likely to happen. Putting that issue aside for now, the fact that we’re spending more on cloud computing than traditional on-premises solutions has a few considerations for enterprise IT as we reach the tipping point. ... Most organizations are behind on skills and cultural changes needed to support cloud computing. Indeed, if skills are not updated to meet the needs of cloud-based solutions, they have no chance of succeeding. Most cloud computing failures can be traced to enterprises neglecting human factors.

What Disney+ Can Teach Businesses About Customer Security

Credential stuffing events are pretty straightforward: Hackers gather a massive repository of pre-existing login credentials secured from hundreds, if not thousands, of previous security breaches — leading to nearly 8 billion exposed records — and then attempt to use them to log in to other online services and platforms via automated tools, called bots, trying combinations in rapid succession. Password reuse is the basis for these attacks, given that 65% of Americans admit to using the same password for multiple websites, according to a 2019 Google poll. Aside from password reuse, the failure rate of stuffing attacks is low because launching an attack is easy — plus, subscription services with low price points and massive numbers of users are tempting targets. Once hackers gain access to an account, they also have access to just about any piece of a user's personal information they would need to carry out malicious activities, such as identity theft or credential sales on the Dark Web for as little as $3.

5 Things Google Duplex Means For The Future of Chatbots

Thanks to Duplex, people's expectations of what's possible just changed. Now, whether communicating via voice or text, bots need to be able to act and react in ways that make sense based on human conversational flows. In other words, being mid-flow in customizing your pie with the Pizza Hut bot shouldn't stop you from remembering that you want delivery at the office, not your home. And the bot should be smart enough to accept that input, react naturally, and re-start the tomatoes-or-olives toppings conversation without a hitch. That said, there are different use cases. "Duplex is a better version of a personal assistant," says Julie Blin, former strategy exec at Samsung Mobile. "I think they are complementary." To date, bots have been mostly about text. And that's great when you're in public, or don't want to disturb people, or need privacy. But it'd also be nice to be able to simply speak your requests on occasion ... and maybe even do that in full duplex mode. There are serious speed advantages to speech over texting, at least for those over the age of 15.

Microsoft Teams just added new Outlook integration, chat updates and more

Microsoft has also added the option to assign a tag to members of an organization, so that users can better target their messages. For instance, a store manager could @mention all the cashiers in a given channel and get their message across to all relevant members at once. Calls and meetings got an upgrade in the form of live captions, which can be turned on during Teams meetings to let participants read what people are saying in real time. Salazar wrote that the tool would improve the accessibility and effectiveness of meetings, say, if you are calling from a crowded airport terminal – but it is worth noting that the company recommends speaking clearly, slowly, and to avoid background noise, in order to make the most of the service. The feature supports English language for now, added Salazar, but more languages will be coming soon. And Teams administrators can record meetings to store them in Microsoft Stream cloud storage. Additional security measures also let administrators monitor the content shared on Teams more closely. Microsoft has turned on the option for a legal hold' on private channel chats, which are stored in user mailboxes, should it be necessary to preserve messages related to a specific topic or individual that are relevant to a case.

---

Quote for the day:

"Stand up for what you believe, let your team see your values and they will trust you more easily." -- Gordon Tredgold

---

Daily Tech Digest - March 01, 2020

Athenahealth CISO describes the company’s new ‘internal offense’ security strategy

The platform serves as a virtual mirror for nation-state actors and cybercriminals and unlike a simulation, which replays historical attacks inside artificial boundaries, it provides the ability to safely launch real-world attacks against production assets, he added. “Athenahealth uses Randori’s reconnaissance capabilities to understand the accessibility and value of assets that could be attacked and make determinations on how best to prioritize and protect them,” Hazzard continued. “The company’s tooling helps us identify internet-facing systems – where we are, how we appear to attackers on the internet, what avenues to access are available, and what data exists in the internet that could be used to acquire access.” Much of the reconnaissance is conducted automatically in the same way threat actors conduct such activities, he explained. “We’ve found opportunities in using the company’s data to improve our security posture and make certain attacks less possible, more difficult, or require a much higher level of sophistication to execute,” he said.

Reinventing tech finance: The evolution from IT budgets to technology investments

Agile and other flexible delivery styles are on the rise—the CIO survey found that 56 percent of CIOs expect to implement Agile, DevOps, or a similar flexible IT delivery model to increase IT responsiveness. But these efforts could be stymied by traditional budgeting processes, which aren’t optimized for the Agile development environment. Rather than promoting cross-functional teaming, iterative sprints, and the customer- and product-oriented mindset—the hallmarks of Agile development—fixed IT budgets are typically structured to provide incremental annual increases and encourage functional silos, inflexible requirements, and a project-focused mindset. Agile’s laissez-faire approach to project scope and requirements dictates more flexible timelines, processes, and financing, which fly in the face of the fixed annual budget’s insistence on predictable costs and resources.  ... To cultivate the most diverse set of investments, many CIOs are managing technology portfolios, allocating funding across various time horizons and according to potential risk, reward, and value. Depending on corporate strategy and competitive and market factors, CIOs look for the right balance of technology investments in three areas: existing business operations, business capability enhancements, and adjacent and new capabilities.

DeepCode taps AI for code reviews

DeepCode learns from open source code bases and has built up a knowledge base to make suggestions on improving code. Code is analyzed with each change. The DeepCode cloud service integrates with code hosting platforms GitHub and Bitbucket, and supports on-premises deployments to watch over Bitbucket Server or GitLab. Core features of DeepCode include: AI QA Audits. DeepCode analyzes any branch of a repository and displays results in a web browser; and AI Code Reviews including commit analysis and pull request analysis. DeepCode analyzes all code commits and pull requests and notes any issues. DeepCode also offers semantic analysis, which examines changes before and after problems and understands context. Security and performance bugs are analyzed, as well as logical mistakes made by developers. Compatibility issues, such as when a new version of a language is being used, also are assessed. Formatting and API issues are checked as well. Other items looked for include resource leakage, null pointer exceptions, and date formatting issues.

Microsoft is expanding its antivirus software to iOS and Android

With the new release, Microsoft is staking out its place in a growing market of antivirus providers compatible with smartphones - and it's pitching its own security tech as a one-stop provider for companies with employees that use multiple devices and operating systems on the job (the newly announced software will be available for businesses, but not individual consumers). Microsoft engineers and executives who spoke to Business Insider about the offering said Defender primarily aims to prevent employees from falling for phishing scams and to detect insider threats, a rising security concern for companies. Corporate Vice President for cybersecurity solutions Ann Johnson touted Defender's features that give companies tools to more closely oversee individuals who might pose an insider threat. "Let's say I resigned from Microsoft tomorrow, and I give my two weeks notice," Johnson told Business Insider. "Insider risk management gives the organization, with the right HR and legal permissions, the ability to monitor me much more closely."

Changing the mindset of the CISO: From enforcer to enabler

Security leaders can no longer adopt the role of enforcer, but rather need to pivot to a new role: the enabler. CISOs today have the opportunity to help enable the organization to grow by delivering a digital experience that delights customers while mitigating digital risk. This requires the CISO to advise the business about when and where cyber risks could manifest. Security leaders must now be able to transform their security practices in lockstep with all the other changes wrought by business-wide digital transformation. Today’s CISO needs to be able to provide advice to the business to help it understand the risk landscape so that it can then make informed decisions about which risks are tolerable and which ones to avoid at all costs. In addition to providing this counsel, security leaders must be able to implement the technology to mitigate risks and protect the business as it continues on the path to digitally transform. As part of this change in mindset, security leadership needs to take into account the impact of friction on the user experience as it can “break or make” security initiatives.

Infosys CISO: Being good at technology is no longer enough

The future is going to be about cyber resilience, and CISOs need to lead the charge to recalibrate how security teams and entire companies think about security. Security leaders have to engage board members and team members in the right way and drive the shift to a new mindset about security. "A truly effective CISO can shape the thinking of the organization, and that's where influence comes in," he said. Salvi said that the pressure to shift to a secure-by-design approach is not yet as powerful as the need to get a product on the market as quickly as possible. "You need a leader who is willing to take the business loss for two weeks to make sure the product is secure," he said. Salvi spends a lot of time cultivating a secure-by-decision mindset in the industry and internally at Infosys. "You have to drive that thinking on an ongoing basis, it's not something that is easy because it is not natural," he said. Salvi's team at Infosys includes three direct reports, a leadership team of 50 people, and about 300 staff members. "The average tenure on the leadership team is 10 years, so compared to them, I am a newbie," Salvi said.

Bringing A Concierge Approach To Cyber Risk Management

Suhs’s experience with concierge medicine formed his vision for a new delivery model for cyber risk management, which today exists as Concierge Cyber®. Here’s how it works: “In return for a set annual membership fee, my firm provides businesses and individuals guaranteed quick and easy access to cyber risk resources,” explains Suhs, founder and managing director of Cyber Special Ops, LLC, which offers the product. “These include same-day appointments and phone or email access on evenings and weekends, information security policy templates, and pre- and post-breach services, as needed, at pre-negotiated rates. “We work with a respected and highly credentialed group of legal, information security, credit and identity restoration, and public relations specialists from firms located around the globe to deliver advanced cyber risk management services,” he adds. “The specialists operate under the umbrella of My-CERT™ which stands for My-Cyber Emergency Response Team; they provide what we describe as ‘expertise, experience and agility to effectively respond to a cyber incident under the protection of attorney-client privilege.’”

Massive DoD DevSecOps standards push may aid enterprise IT

As government agencies and private-sector enterprises increasingly use the same open source technologies, many commercial companies look to the government, particularly the DoD, as the gold standard for cybersecurity, one IT consultant said. "There's a saying, 'Nobody ever got fired for using IBM,'" said Jeremy Pullen, principal technical consultant at Polodis, a digital transformation consulting firm in Atlanta, who's closely following the DoD's DevSecOps work, including a recently published repository of hardened container images for general use. "There's a similar confidence in using systems hardened to the standards of the US government." Pullen said the breadth of the collaboration will also help legitimize the DevSecOps concept as a set of practices, rather than tying it to any particular tool, vendor or method used by specific household-name enterprise IT teams. "The last two years, I've had to educate people about what DevSecOps is and isn't -- it's not just using a tool from White Hat, Sonatype or Veracode," he said. "This paints a better picture of DevSecOps as an area of practice rather than just implementing somebody's product."

One in four Americans won’t do business with data-breached companies

This study included data breaches that occurred from Jan. 1, 2018, to Dec. 31, 2018, regardless of the public reporting date. Only breaches leaking over 500,000 consumer records that affected consumers on a national scale were included. It found that most people were only loosely familiar with the total number of corporate breaches that occurred in 2018. Though the majority of people admitted to losing trust in corporations that experienced data breaches, most were unwilling to cut ties with these companies. To counter this, most people made their account passwords harder to guess and were more selective with whom they gave their financial information after learning of a breach, even though one in three people who experienced a data breach ultimately weren't sure which information was targeted. The findings showed that almost one in four Americans stop doing business with companies who have been hacked, and more than two in three people trust a company less after a data breach. Almost all respondents (92%) agree that companies are financially liable to their customers after a breach and over one in five people are unwilling to give their financial information to a company who's been hacked

Malaysia: A Flourishing Fintech Ecosystem

Developments in Malaysian fintech are altering the country’s financial sector landscape. For example, while fintech products offered by traditional financial institutions expand, the number of physical commercial bank branches is declining, and the number of automated teller machines has fallen over the last two years. Traditional Malaysian banks continue to dominate in deposits, lending, and raising capital while, at the same time, adopting new technologies and either competing or collaborating with new tech startups. As of April 2019, there were close to 200 startups in Malaysia in a range of fintech areas, including payments, lending, and blockchain. Of course, the rapidly evolving technology—alongside new consumer habits—is not without risk or challenges. Malaysia has been a leader on regulations to ensure that the financial system remains safe amid the possibility of cybersecurity incidents. Well aware that cyberattacks can undercut customer confidence and inflict widespread damage, Malaysian banks and regulators list cybersecurity among their issues of top concern.

---

Quote for the day:

"What I've really learned over time is that optimism is a very, very important part of leadership." -- Bob Iger

---

Daily Tech Digest - February 29, 2020

Why your brain is not a computer

The metaphors of neuroscience – computers, coding, wiring diagrams and so on – are inevitably partial. That is the nature of metaphors, which have been intensely studied by philosophers of science and by scientists, as they seem to be so central to the way scientists think. But metaphors are also rich and allow insight and discovery. There will come a point when the understanding they allow will be outweighed by the limits they impose, but in the case of computational and representational metaphors of the brain, there is no agreement that such a moment has arrived. From a historical point of view, the very fact that this debate is taking place suggests that we may indeed be approaching the end of the computational metaphor. What is not clear, however, is what would replace it. Scientists often get excited when they realise how their views have been shaped by the use of metaphor, and grasp that new analogies could alter how they understand their work, or even enable them to devise new experiments. Coming up with those new metaphors is challenging – most of those used in the past with regard to the brain have been related to new kinds of technology.

How Machine Learning Can Strengthen Insider Threat Detection

To mitigate insider threats, experts suggest that enterprises develop their own risk algorithms by coupling machine learning capabilities with behavioral analytics to understand discrepancies in employee activities. Companies can use human resources data to help create these new algorithms, said Dawn Cappelli, CISO of Rockwell Automation. "The key is having HR data. You can build your risk models by taking the contextual employee data along with their online activity and create risk algorithms." But the real challenge is refining and contextualizing this data in order to correctly identify potential threats, said Solomon Adote, CISO for the state of Delaware. "Data without context might not tell you the full story," Adote said. "It has to be about identifying what is abnormal about a particular activity." Once the data is contextualized, Adote noted, enterprises then can use this information to create alerts, advise employees about their activities and make them aware that the company is aware of what's happening internally. "That's sometimes all you need to prevent a significant catastrophe," Adote said.

Microsoft's Blazor for building mobile apps gains traction

While the mobile bindings project is still considered experimental, it is encouraging for fans of Blazor that Microsoft appears set to update it regularly and fix bugs. Microsoft has previously demonstrated how Blazor can be used to build all types of apps, including server-based web apps, offline web apps with WebAssembly, progressive web apps, hybrid .NET native apps that render to Electron and work offline, as well as native desktop and mobile apps. Blazor fan Chris Sainty, a UK-based developer, has posted a helpful explanation of Blazor on the Stack Overflow blog. He details what sets Blazor and its mobile bindings apart from other popular JavaScript UI frameworks, such as Angular and ReactJS, and how it leans towards web developers' existing work processes. "By using different renderers Blazor is able to create not only web based UIs, but also native mobile UIs as well," he notes. "This does require components to be authored differently, so components written for web renderers can't be used with native mobile renderers. However, the programming model is the same. Meaning once developers are familiar with it, they can create UIs using any renderer."

AI is helping Microsoft rethink Office for mobile

Microsoft this week launched an Office app that replaces Word, Excel, and PowerPoint on Android and iOS. Merging three apps into one, while adding more features, is quite the achievement. The new Office app is not just for consuming content and maybe a little light editing on the side, but actually creating content on the go. Most interestingly, a lot of these features fundamentally require AI and machine learning to achieve this new mobile productivity paradigm. Microsoft has been adding AI-driven features to its once most profitable product line for years now — we did a recap of just a handful last year. This week’s Office launch, however, showed Microsoft’s embrace of AI as not merely augmenting what you can already do with the productivity suite, but added new use cases altogether. Most of the new features are not simply traditional desktop features ported to mobile. They are use cases that are better on mobile, or not even possible on desktop. Office lets you take a picture of a document and turn it into a Word file.

3 ways AI is transforming the insurance industry

In the car insurance sector, insurers use telematics to collect real-time driving data from vehicles. As opposed to the past, where they had to rely on basic information about the vehicle and driver to craft their insurance policies, they can now analyze telematics data with machine learning algorithms to create personalized risk profiles for drivers. Many insurers use this data to give discounts to drivers who have safe driving habits and penalize dangerous behavior such as speeding, hard braking, harsh acceleration, and hard cornering. The same data can help reconstruct accident scenes and enable insurers to better understand and assess what happened, which results in much faster claims processing. In the health insurance sector, service providers use machine learning to help patients choose the best health insurance coverage options to fit their needs. Data collected from wearables such as fitness trackers and heart rate monitors help insurers monitor track and reward healthy habits such as regular exercise, and encourage preventive care by providing healthy nutrition tips.

Seven cybersecurity and privacy forecasts for 2020

Over the past ten years, personal medical devices such as insulin pumps, heart and glucose monitors, defibrillators and pacemakers have been connected to the internet as part of the Internet of Medical Things (IoMT). At the same time, researchers have identified a growing number of software vulnerabilities and demonstrated the feasibility of attacks on these products. This can lead to targeted attacks on both individuals and entire product classes. In some cases, the health information generated by the devices can also be intercepted. So far, the healthcare industry has struggled to respond to the problem – especially when the official life of the equipment has expired. As with so many IoT devices of this generation, networking was more important than the need for cybersecurity. The complex task of maintaining and repairing equipment is badly organized, inadequate or completely absent. Through the development of software and hardware platforms, vehicles and transport infrastructure are increasingly connected. 

Don't be like Bezos: How to keep your phone from being hacked

Turner explained, "In our own research we have shown that it is conceivable that the roots of trust pre-installed in all iOS devices can be a very fertile ground for attacking mobile devices in the way that the FTI Consulting report outlined. It is also very convenient that Apple does not allow for third party monitoring of their devices or operating systems, allowing attackers to completely remove any forensic evidence by merely forcing a shutdown of the device, with nearly all evidence destroyed once it is finished rebooting." But, you can't stop some cyberattacks from happening. "Unfortunately, in the case of zero-day exploits like the ones that were probably used in the Bezos case, even the best threat defense tools cannot protect users from that class of attacks. We have worked with several organizations to build programs to protect executives from these types of attacks, but they require resources and operational discipline to be effective," he said. Turner said that anyone without a properly maintained mobile device, meaning security updates installed within three weeks of release, is at risk. First and foremost, get rid of WhatsApp on anyone's phone at your company.

The Need for a 'Collective Defense'

Breaching private companies can create doorways into government networks as the two heavily rely on each other, he notes in an interview with Information Security Media Group. For example, Granicus, one of the largest IT service providers for U.S. federal and local government agencies, recently left a massive Elasticsearch database exposed to the internet. Alexander says private sector organizations need to share anonymized information on cybersecurity issues with the government so that further attacks can be prevented. "In cyber, each company works by itself and shares what is important. But you don't get the whole picture so you don't see what's going on," Alexander says. A "collective defense" approach means the entire cybersecurity community would work together, he explains. The Cybersecurity Information Sharing Act of 2015 provides a legal framework for government agencies and private sector organizations to voluntarily share cybersecurity information and other security data, Alexander points out.

4 fundamental microservices security best practices

Defense-in-depth is a strategy in which several layers of security control are introduced in an application. Sensitive services get layers of security cover, so a potential attacker who has exploited one of the microservices in the application may not be able to do so to another microservice or other layers of the application. Rather than depending on a single, seemingly robust security measure, use all the security measures at your disposal to create layers of security that potential attackers will have to break through. For instance, even if you already have a strong network perimeter firewall in place, ensure that you still practice strong token-based identification, keep addresses of sensitive microservices private and maintain a strong monitoring layer that diligently identifies unusual behavior. In a typical microservices-based application, it's ideal that service consumers do not communicate with microservices directly.

Three things CISOs need to do differently in 2020

The entire security team needs to be a learning organization to attract talent and keep up with new threats and new defenses, Michaux said. Developing this attitude will let prospective employees know that they are joining a company that is open to innovation and experimentation, not one that hyper-risk-averse and slow moving. To reinforce this culture, security leaders should think small and act fast and use the cloud to break things, rebuild, and improve. "Security teams have to realize that it's OK to break things as long as you learn something from it and quickly and apply that knowledge productively," said Caleb Queern, a director of KPMG cybersecurity services. CISOs should take an honest look at automation in 2020 as well. Ask what artificial intelligence can handle and what requires human attention. The goal should be to automate at least 50% of the basic controls of the security environment. Finally, security professionals should be able to read and write basic code. This has two benefits: it will earn the respect of DevOps engineers and it will help security pros know when to influence the development process.

---

Quote for the day:

"Even the demons are encouraged when their chief is "not lost in loss itself." -- John Milton

---

Daily Tech Digest - February 28, 2020

Google says Microsoft Edge isn't secure.

"Google recommends switching to Chrome to use extensions securely," says a pop-up. Oh, so Edge is insecure? That's terrible. Oddly, when I tried the browser, I found it a touch faster and privacy-friendlier than Google's. It didn't seem so insecure. Why would Google be so worried on my behalf? Worse, Techdows reported that Google is also offering more desperate warnings for users of Google Docs, Google News and Google Translate. The essential message: don't pair these with Edge. This verged on terrible mean-spiritedness, I feared. After all, Edge is based on Google's own Chromium platform. Just as I was about to punish Google by using Bing for a day, another piece of troubling information assaulted me. According to PC World, Microsoft is apparently telling those who use Edge and go to the Chrome web store to get an extension: "Extensions installed from sources other than the Microsoft Store are unverified, and may affect browser performance." Can't we rely on anything these days? Naturally, I instantly contacted Google to ask in what way Edge was insecure. Without pausing for breath or to curse at the new space bar issues with my MacBook Air, I asked Microsoft why extensions from the Chrome store might make Edge a little edgy.

Multi-Runtime Microservices Architecture

One of the well-known traditional solutions satisfying an older generation of the above-listed needs is the Enterprise Service Bus and its variants, such as Message Oriented Middleware, lighter integration frameworks, and others. An ESB is a middleware that enables interoperability among heterogeneous environments using a service-oriented architecture. While an ESB would offer you a good feature set, the main challenge with ESBs was the monolithic architecture and tight technological coupling between business logic and platform, which led to technological and organizational centralization. When a service was developed and deployed into such a system, it was deeply coupled with the distributed system framework, which in turn limited the evolution of the service. This often only became apparent later in the life of the software. Here are a few of the issues and limitations of each category of needs that makes ESBs not useful in the modern era. In traditional middleware, there is usually a single supported language runtime, which dictates how the software is packaged, what libraries are available, how often they have to be patched, etc.

Intel takes aim at Huawei 5G market presence

Intel on Monday introduced a raft of new processors, and while updates to the Xeon Scalable lineup led the parade, the real news is Intel's efforts to go after the embattled Huawei Technologies in the 5G market. Intel unveiled its first ever 5G integrated chip platform, the Atom P5900, for use in base stations. Navin Shenoy, executive vice president and general manager of the data platforms group at Intel, said the product is designed for 5G's high bandwidth and low latency and combines compute, 100Gb performance and acceleration into a single SoC. "It delivers a performance punch in packet security throughput, and improved packet balancing throughput versus using software alone," Shenoy said in the video accompanying the announcement. Intel claims the dynamic load balancer native to the Atom P5900 chip is 3.7 times more efficient at packet balancing throughput than software alone. Shenoy said Ericsson, Nokia, and ZTE have announced that they will use the Atom P5900 in their base stations. Intel hopes to be the market leader for silicon base station chips by 2021, aiming for 40% of the market and six million 5G base stations by 2024.

Can Deutsche Bank’s PaaS help turn the bank around?

It’s a rapid success story for a highly leveraged and highly regulated international bank – which is in the midst of a turnaround effort and that registered a loss of €5.7 billion ($7.4 billion) last year – and one that even has management considering whether Fabric is good enough to sell to rival banks to eventually turn its technology investments into a revenue stream. A key problem Fabric helped solve was one that confronted the bank’s new leadership when it arrived in 2015: a sizeable virtual machine (VM) estate that was only being utilised at a rate of around eight percent. “The CIOs got together and realised they had a problem to fix because this is just money that’s bleeding out to the organisation,” platform-as-a-service product owner at Deutsche Bank, Emma Williamson, said during a recent Red Hat OpenShift Commons event in London. So the bank set out to drastically modernise its application estate around cloud native technologies like containers and Kubernetes, all with the aim of cutting this waste tied to its legacy platforms and help drive a broader shift towards the cloud.

The 9 Best Free Online Data Science Courses In 2020

You don't have to spend a fortune and study for years to start working with big data, analytics, and artificial intelligence. Demand for "armchair data scientists" – those without formal qualifications in the subject but with the skills and knowledge to analyze data in their everyday work, is predicted to outstrip demand for traditionally qualified data scientists in the coming years. ... Some of these might require payment at the end of the course if you want official certification or accreditation of completing the course, but the learning material is freely available to anyone who wants to level up their data knowledge and skills. ... As it is a Microsoft course, its cloud-based components focus on the company's Azure framework, but the concepts that are taught are equally applicable in organizations that are tied to competing cloud frameworks such as AWS. It assumes a basic understanding of R or Python, the two most frequently used programming languages in data science, so it may be useful to look at one of the courses covering those that are mentioned below, first.

Microsoft Makes Progress on PowerShell Secrets Management Module

The idea behind the module is that it has been difficult for organizations to manage secrets securely, especially when running scripts across heterogeneous cloud environments. Developers writing scripts want them to run across different platforms, but that might involve handling multiple secrets and multiple secrets types. The team sees PowerShell serving as a connection point between different systems. Consequently, it built an abstraction layer in PowerShell that can be used to manage secrets, both with local vaults and remote vaults, Smith explained in a November Ignite talk. The module helps manage local and remote secrets in unified way, Smith added. It might be used to run a script in various environments, where just the vault parameter would need to be changed. Scripts could be shared across an organization, and it wouldn't be necessary to know the local vaults of the various users. Keys could be shared with users in test environments, but deployment keys could be individualized. It would be less necessary to hard-code secrets into scripts. The PowerShell Secret Management Module is being designed to work with various vault extensions.

Facebook sues SDK maker for secretly harvesting user data

According to court documents obtained by ZDNet, the SDK was embedded in shopping, gaming, and utility-type apps, some of which were made available through the official Google Play Store. "After a user installed one of these apps on their device, the malicious SDK enabled OneAudience to collect information about the user from their device and their Facebook, Google, or Twitter accounts, in instances where the user logged into the app using those accounts," the complaint reads. "With respect to Facebook, OneAudience used the malicious SDK – without authorization from Facebook – to access and obtain a user's name, email address, locale (i.e. the country that the user logged in from), time zone, Facebook ID, and, in limited instances, gender," Facebook said. Twitter was the first to expose OneAudience's secret data harvesting practices on November 26, last year. Facebook confirmed on the same day. In a blog post at the time, Twitter also confirmed that beside itself and Facebook, the data harvesting behavior also targeted the users of other companies, such as Apple and Google.

Product Development with Continuous Delivery Indicators

Software product delivery organizations deliver complex software systems on an evermore frequent basis. The main activities involved in the software delivery are Product Management, Development and Operations (by this we really mean activities as opposed to separate siloed departments that we do not recommend). In each of the activities many decisions have to be made fast to advance the delivery. In Product Management, the decisions are about feature prioritization. In Development, it is about the efficiency of the development process. And in Operations, it is about reliability. The decisions can be made based on the experience of the team members. Additionally, the decisions can be made based on data. This should lead to a more objective and transparent decision making process. Especially with the increasing speed of the delivery and the growing number of delivery teams, an organization’s ability to be transparent is an important means for everyone’s continuous alignment without time-consuming synchronization meetings.

Can Machines And Artificial Intelligence Be Creative?

If AI can enhance creativity in visual art, can it do the same for musicians? David Cope has spent the last 30 years working on Experiments in Musical Intelligence or EMI. Cope is a traditional musician and composer but turned to computers to help get past composer’s block back in 1982. Since that time, his algorithms have produced numerous original compositions in a variety of genres as well as created Emily Howell, an AI that can compose music based on her own style rather than just replicate the styles of yesterday’s composers. In many cases, AI is a new collaborator for today’s popular musicians. Sony's Flow Machine and IBM's Watson are just two of the tools music producers, YouTubers, and other artists are relying on to churn out today's hits. Alex Da Kid, a Grammy-nominated producer, used IBM’s Watson to inform his creative process. The AI analyzed the "emotional temperature" of the time by scraping conversations, newspapers, and headlines over a five-year period. Then Alex used the analytics to determine the theme for his next single.

Educating Educators: Microsoft's Tips for Security Awareness Training

The key challenge is creating an engaging, relatable training course that effectively teaches employees the concepts they need to know, Sexsmith said. Sexsmith pointed to a few tricks he uses in his programs. One of these is the "Social Proof Theory," a social and psychological concept that describes how people copy other people's behavior – if your colleagues are doing a training, you'll do it, too. Gamification also helps: "People want to learn; people want to master skills, but there's also a competitive nature around that," he said. Some trainings use videos that make security concepts more accessible. One problem, he said, is lessons that aren't reinforced aren't retained. Humans forget half of new information learned within an hour and 70% of new information within a day. "By lunchtime, you're going to forget 50% of the stuff I'm up here saying," he joked to his morning audience. To fight this, Microsoft uses a training reinforcement platform called Elephants Don't Forget to help employees build muscle memory around new concepts. During the gap between trainings, the program sends participants two daily emails with a link to questions tailored to the course.

---

Quote for the day:

"Eventually relationships determine the size and the length of leadership." -- John C. Maxwell

---

Daily Tech Digest - February 27, 2020

Unpatched Security Flaws Open Connected Vacuum to Takeover

Researchers have discovered several high-severity vulnerabilities in a connected vacuum cleaner. The security holes could give remote attackers the capability to launch an array of attacks — from a denial of service (DoS) attack that renders the vacuum unusable, to viewing private home footage through the vacuum’s embedded camera. The Ironpie M6, which is available for $230 on Amazon, comes equipped with a corresponding mobile app and a security camera. The vacuum cleaner is built by artificial intelligence home robot company Trifo, and was first launched IronPie at CES 2019. Researchers on Wednesday said that they uncovered six flaws, stemming from the vacuum’s mobile app and its connectivity protocol, at RSA Conference 2020, this week in San Francisco. “The most severe vulnerability allows attackers to access any video stream from any Trifo device across the world,” Erez Yalon, director of security research with Checkmarx, told Threatpost. “Through this vulnerability, every single user – whether in a home or office setting as shown in our PoC video – is at risk of a hacker obtaining a live video feed. Needless to say, this represents a total loss of privacy.”

The Amazing Ways Goodyear Uses Artificial Intelligence And IoT For Digital Transformation

Regardless if it's an autonomous, electric, or a traditional vehicle, they all need a solid foundation of the right tire for the specific demands of the vehicle. Goodyear uses internet of things technology in its Eagle 360 Urban tire. The tire is 3D printed with super-elastic polymer and embedded with sensors. These sensors send road and tire data back to the artificial intelligence-enhanced control panel that can then change the tread design to respond to current road conditions on the fly and share info about conditions with the broader network. If the tire tread is damaged, the tire moves the material and begins self-repair. Goodyear’s intelligent tires are in use on a new pilot program with Redspher, a European transportation and logistics company operating in 19 countries. The fleet benefits from the tire's ability to monitor and track tire pressure, vehicle data, and road conditions. This data is then analyzed by Goodyear’s algorithms to gain insights about maintenance needs and ways to improve the safety and performance of the fleet.

Google Teaches AI To Play The Game Of Chip Design

One of the promising frontiers of research right now in chip design is using machine learning techniques to actually help with some of the tasks in the design process. We will be discussing this at our upcoming The Next AI Platform event in San Jose on March 10 with Elias Fallon, engineering director at Cadence Design Systems. The use of machine learning in chip design was also one of the topics that Jeff Dean, a senior fellow in the Research Group at Google who has helped invent many of the hyperscaler’s key technologies, talked about in his keynote address at this week’s 2020 International Solid State Circuits Conference in San Francisco. Google, as it turns out, has more than a passing interest in compute engines, being one of the large consumers of CPUs and GPUs in the world and also the designer of TPUs spanning from the edge to the datacenter for doing both machine learning inference and training. So this is not just an academic exercise for the search engine giant and public cloud contender – particularly if it intends to keep advancing its TPU roadmap and if it decides, like rival Amazon Web Services, to start designing its own custom Arm server chips or decides to do custom Arm chips for its phones and other consumer devices.

JFrog touts DevSecOps edge in CI/CD tools

Most CI/CD tools integrate with package managers for similar purposes. But JFrog could differentiate its Pipelines product based on its experience developing the Artifactory artifact repository manager, as well as its messaging. "Everyone is really doing the same thing -- transforming code into software packages and then shipping those packages to production," said Tom Petrocelli, an analyst at Amalgam Insights. "But there are security advantages as a side effect of the way [JFrog thinks]." This relates to the fact that enterprise DevOps shops in the Linux world increasingly use package managers to centralize corporate governance, explained Charles Betz, an analyst at Forrester Research. "There's a heck of a lot of digital management that revolves around artifacts when you don't own the source code, when that code is written by open source communities and vendors," Betz said.

Hidden cost of cloud puts brakes on migration projects

More than half (58%) of the IT decision-makers surveyed believe the cloud over-promised and under-delivered, while 43% admit that the cloud is more costly than they thought. Only 27% of IT decision-makers surveyed claim they have been able to reduce labour and logistical costs by moving to the cloud. Mark Cook, divisional executive officer at Capita, said: “Every migration journey is unique in both its destination and starting point. While some organisations are either ‘born’ digital or can gather the resources to transform in a relatively short space of time, the majority will have a much slower, more complex path. “Many larger organisations will have heritage technology and processes that can’t simply be lifted and converted, but will need some degree of ‘hybrid by design’,” he added. When asked what unforeseen factors had delayed cloud migration projects, 39% had cost as the main factor, followed by workload and application rearchitecting issues (38%) and security concerns (37%).

IoT Can Put Your Data at Risk, Here’s How

The data processed by IoT devices is potentially extremely sensitive. With office and home security systems increasingly mediated by IoT (doorbells and surveillance cameras being just a couple of examples), criminal attacks can pose a serious problem. The huge volume of data habitually collected by IoT devices was exposed this year when a database owned by the Chinese firm Orvibo, who offer a smart home appliance platform, was found to have no password protection despite containing logs relating to 2 million worldwide users, including individuals and hotel chains. The data included insufficiently-protected user passwords, reset codes, precise locations, and even a recorded conversation. Botnets are another way for cybercriminals to wreak havoc using IoT devices. Botnets consist of, as their name suggests, networks of bots running on Internet-connected devices. They are primarily known for their role in DDoS (Distributed Denial of Service) attacks, in which a stream of network requests is sent to a network that a malicious entity wishes to bring down.

DesignOps — scaling design to create a productive internal environment for IBMers

DesignOps is a collective term for creating a productive workforce, by addressing challenges such as: growing and evolving design teams, finding and hiring people with the right skills, creating efficient workflows and improving the quality and impact of design outputs. It’s a method of optimising people, processes and workflow, and at IBM, the practice has been deployed to increase efficiency, productivity and general well-being among the the whole organisation, including the thousands-strong IT team. Satisfying this level of individuals and teams is no easy feat, which is why IBM has a specific department dedicated to creating great experiences for IBMers. Kristin Wisnewski — who is on the advisory board for Information Age’s Women in IT Summit in New York on March 25th 2020 at the Grand Hyatt Hotel — leads the CIO Design team at IBM as vice president, whose purpose is to create a productive internal environment at IBM. “We’re here to create, design and improve the experience of employees in their daily jobs. Our team is made up of 140 people, and so it is a big mission to help the hundreds of thousands of employees here at IBM,” she said.

Cloud misconfigurations are a new risk for the enterprise

Cloud misconfigurations are becoming another risk for corporations. At RSA 2020, Steve Grobman, senior vice president and chief technology officer at McAfee, explained how easy it is to take advantage of cloud misconfigurations, an expensive security problem for corporations. He compared cyber security to infectious disease control: an imperfect science. ... In addition to making sure cloud configurations are secure, security teams have to address tomorrow's security risks today, Grobman said. Advances in quantum computing will be a double-edged sword with the downside being the threat to existing encryption systems. "Nation-states will use quantum computing to break our public key encryption systems," he said. "Our adversaries are getting the data today and counting on quantum to unlock in tomorrow." Grubman said that companies need to think about how long data will need to be protected. "Even in 2020, there are documents in the National Archives in relation to the Kennedy assignation that still have redacted information due to national security concerns of today," he said.

Data Science Is A Team Sport: Oracle’s New Cloud Platform Provides The Playing Field

Unlike other data science products that focus on helping individual data scientists, Oracle Cloud Infrastructure Data Science helps improve the effectiveness of data science teams with capabilities like shared projects, model catalogs, team security policies, and reproducibility and auditability features. “Data scientists are experimenters. They want to try stuff and see how it works,” says Pavlik. “They grab sample datasets, they pull in all kinds of open source tools, and they're doing great stuff. What we want to do is let them keep doing that, but improve their productivity by automating their entire workflow and adding strong team support for collaboration to help ensure that data science projects deliver real value to businesses.” The starting point for data science to deliver value is doing more with machine learning, and being more efficient with the data and algorithms involved.  “Effective machine learning models are the foundation of successful data science projects,” Pavlik says, but the volume and variety of data facing data science teams “can stall these initiatives before they ever get off the ground.”

Getting closer to no-battery devices

The technique being exploited takes advantage of backscattering. That's a way of parasitically using radio signals inherent in everyday environments. In this case, the chip piggybacks on existing Wi-Fi transmissions to send its data. This method of sending data is power-light, because the carrier needed for the radio transmission is already created—it doesn’t need new energy for the message to be sent. Interestingly, two principal scientists involved in this backscattering project, which was announced by UC San Diego's Jacobs School of Engineering, have also been heavily involved in the development of "wake-up" radios. Wake-up is when a Wi-Fi or other radio comes alive to communicate only when it has something to transmit or receive. The technology uses two radios. One radio is for the wake-up signaling; that radio's only purpose is to listen for a signature. The second is a more heavy-duty radio for the data send. Power is saved because the main radio isn't on all the time. Dinesh Bharadia, now a professor of electrical and computer engineering at UC San Diego, was at Stanford University working on a wake-up radio that I’ve written about.

---

Quote for the day:

"The greatest good you can do for another is not just share your riches, but reveal to them their own." -- Benjamin Disraeli

---