Daily Tech Digest - March 29, 2020

Microsoft Patents New Cryptocurrency System Using Body Activity Data
Microsoft Technology Licensing, the licensing arm of Microsoft Corp., has been granted an international patent for a “cryptocurrency system using body activity data.” The patent was published by the World Intellectual Property Organization (WIPO) on March 26. The application was filed on June 20 last year. “Human body activity associated with a task provided to a user may be used in a mining process of a cryptocurrency system,” the patent reads, adding as an example: A brain wave or body heat emitted from the user when the user performs the task provided by an information or service provider, such as viewing advertisement or using certain internet services, can be used in the mining process. ... Different types of sensors can be used to “measure or sense body activity or scan human body,” the patent explains. They include “functional magnetic resonance imaging (fMRI) scanners or sensors, electroencephalography (EEG) sensors, near infrared spectroscopy (NIRS) sensors, heart rate monitors, thermal sensors, optical sensors, radio frequency (RF) sensors, ultrasonic sensors, cameras, or any other sensor or scanner” that will do the same job.


Is Samsung Quietly Becoming a Significant Player in the Cryptocurrency and Blockchain Industry?


It is thought that Samsung has created a processor that is dedicated to protecting the user’s PIN, pattern, password, and Blockchain Private Key with a combination of their security Knox platform. This ensures that security on their new S20 range is secure. Introducing their Blockchain Keystore last year it initially only supported ERC-20 token but added bitcoin in August of last year. Using Samsung devices with Blockchain Keystore means users can store their bitcoin and crypto wallet private keys on the device. One of the most critical issues that is overlooked is the control over a private wallet key and in most cases is the reason why most crypto thefts and hacks happen, because users fail to store their tokens in the wallets they have private keys for. This then means that if bitcoin or crypto are stored on smartphone wallets, it gives users control over their private keys and removes the control and reliance on external companies. The adoption of crypto has fallen short in recent years concerning its expectations. However, user experience developments have helped innovate technology to make using crypto more accessible.



Network of fake QR code generators will steal your Bitcoin

Bitcoin cryptocurrency
A network of Bitcoin-to-QR-code generators has stolen more than $45,000 from users in the past four weeks, ZDNet has learned. The nine websites provided users with the ability to enter their Bitcoin address, a long string of text where Bitcoin funds are stored, and convert it into a QR code image they could save on their PC or smartphone. Today, it's a common practice to share a Bitcoin address as a QR code and request a payment from another person. The receiver scans the QR code with a Bitcoin wallet app and sends the requested payment without having to type a lengthy Bitcoin addresses by hand. By using QR codes, users eliminate the possibility of a mistype that might send funds to the wrong wallet. Last week, Harry Denley, Director of Security at the MyCrypto platform, ran across a suspicious site that converted Bitcoin addresses into QR codes. While many services like this exist, Denley realized that the website was malicious in nature. Instead of converting an inputted Bitcoin (BTC) address into its QR code equivalent, the website always generated the same QR code -- for a scammer's wallet.


The 5G Economic Impact

The 5G Economic Impact
Despite its nascent status, the 5G ecosystem is already swimming in financial might. That same GSMA report predicts 5G technology will add $2.2 trillion to the global economy over the next 15 years. And operators are expected to spend more than $1 trillion on mobile capex between 2020 and 2025, with 80% of that spend directed at their 5G networks. While past technology evolutions primarily targeted the consumer market, the spend and return on 5G has a larger focus on the broader enterprise space. This includes connecting not just traditional enterprise workers and their respective mobile devices but connecting all electronic devices. This will involve a broader push toward edge deployments that can serve what are expected to be billions of connected and IoT devices. “With greater reliability and data speeds that will surpass those of 4G networks, a combination of 5G and local edge compute will pave the way for new business value,” ABI Research noted in a recent report, citing benefits gained from agility and process optimization; better and more efficient quality assurance and productivity improvement.


Adopting robotic process automation in Internal Audit


​With automation technologies advancing quickly and early adopters demonstrating their effectiveness, now is the time to understand and prioritize opportunities for Internal Audit robotic process automation. And to take important steps to prepare for thoughtful, progressive deployment. The age of automation is here, and with it comes opportunities for integrating Internal Audit (IA) robotic process automation (RPA) into the third line of defense (aka Internal Audit). IA departments, large and small, have already begun their journey into the world of automation by expanding their use of traditional analytics to include predictive models, RPA, and cognitive intelligence (CI). This is leading to quality enhancements, risk reductions, and time savings—not to mention increased risk intelligence. The automation spectrum, as we define it, comprises a broad range of digital technologies. As shown below, at one end are predictive models and tools for data integration and visualization. At the other end are advanced technologies with cognitive elements that mimic human behavior. Many IA organizations are familiar with the first part of the automation spectrum, having already established foundational data integration and analytics programs to enhance the risk assessment, audit fieldwork, and reporting processes.


A debate between AI experts shows a battle over the technology’s future

Why add classical AI to the mix? Well, we do all kinds of reasoning based on our knowledge in the world. Deep learning just doesn’t represent that. There’s no way in these systems to represent what a ball is or what a bottle is and what these things do to one another. So the results look great, but they’re typically not very generalizable. Classical AI—that’s its wheelhouse. It can, for example, parse a sentence to its semantic representation, or have knowledge about what’s going on in the world and then make inferences about that. It has its own problems: it usually doesn’t have enough coverage, because too much of it is hand-written and so forth. But at least in principle, it’s the only way we know to make systems that can do things like logical inference and inductive inference over abstract knowledge. It still doesn’t mean it’s absolutely right, but it’s by far the best that we have. And then there’s a lot of psychological evidence that people can do some level of symbolic representation.


Apache Flink in 10 Minutes


Apache Flink is an open-source stream processing framework. It is widely used by a lot of companies like Uber, ResearchGate, Zalando. At its core, it is all about the processing of stream data coming from external sources. It may operate with state-of-the-art messaging frameworks like Apache Kafka, Apache NiFi, Amazon Kinesis Streams, RabbitMQ. Let’s explore a simple Scala example of stream processing with Apache Flink. We'll ingest sensor data from Apache Kafka in JSON format, parse it, filter, calculate the distance that sensor has passed over the last 5 seconds, and send the processed data back to Kafka to a different topic. We'll need to get data from Kafka - we'll create a simple python-based Kafka producer. The code is in the appendix. ... Now we need a way to parse JSON string. As Scala has no inbuilt functionality for that, we'll use Play Framework. First, we need a case class to parse our json strings into. For simplicity, we will use automatic conversion from JSON strings to the JsonMessage. To transform elements in the stream we need to use .map transformation. The map transformation simply takes a single element as input and provides a single output. We'll also have to filter the elements that failed to parse.


Google Invents AI That Learns a Key Part of Chip Design

AI chip designing itself
“We believe that it is AI itself that will provide the means to shorten the chip design cycle, creating a symbiotic relationship between hardware and AI, with each fueling advances in the other,” they write in a paper describing the work that posted today to Arxiv. “We have already seen that there are algorithms or neural network architectures that… don’t perform as well on existing generations of accelerators, because the accelerators were designed like two years ago, and back then these neural nets didn't exist,” says Azalia Mirhoseini, a senior research scientist at Google. “If we reduce the design cycle, we can bridge the gap.” Mirhoseini and senior software engineer Anna Goldie have come up with a neural network that learn to do a particularly time-consuming part of design called placement. After studying chip designs long enough, it can produce a design for a Google Tensor Processing Unit in less than 24 hours that beats several weeks-worth of design effort by human experts in terms of power, performance, and area. Placement is so complex and time-consuming because it involves placing blocks of logic and memory or clusters of those blocks called macros in such a way that power and performance are maximized and the area of the chip is minimized.


This Simple WhatsApp Hack Will Hijack Your Account: Here’s What You Must Do Now

Photo Illustrations for Uber, Amazon, ISIS, Apple Health and more
The most obvious advice is NEVER to send a six-digit SMS to anyone for any reason. There have been other attacks covering other platforms using the same method. When a code is sent to your phone it relates to your phone. But there is a fix here that will protect your WhatsApp, even if the SMS code was sent onward. This fix will ensure you can’t fall victim to this crime. The code sent by SMS when you set up your WhatsApp account on a new phone comes directly from WhatsApp itself. The platform sets the code and sends it to you. But there is a totally separate setting in your own WhatsApp application that allows you to set your own six-digit PIN number. There is some confusion because these are both six-digit numbers—but they are entirely separate. Most people have still not set up this PIN number—the “Two-Step Verification” setting can be accessed under the Settings-Account from within the app. It takes less than a minute to set up. The PIN is for you to select, and even has the option of a backup email address. WhatsApp will ask you for the PIN when you change phones and also every so often when you’re using the app, that’s how secure it is.


How To Create Values & Ethics To AI In The Workplace?

AI
The widespread uptake in this technology use comes at a time when more and more businesses are proactively addressing diversity and inclusivity among their workforce. Reports suggest that the US needs a curious, ethical AI workforce that works collaboratively to make reliable AI systems. In this way, members of AI development teams need to act over deep discussions regarding the implications of their work on the warfighters using them. In order to build AI systems effectively and ethically, defense organizations must encourage an ethical, inclusive work environment and procure a diverse workforce. This workforce should involve curiosity experts, a team of professionals who focus on human needs and behaviors, who are more likely to envision unsolicited and unintended consequences associated with the system’s use and mismanagement, and ask tough questions about those consequences. According to a research report, building cognitively diverse teams solve problems faster than teams of cognitively similar people. This also paves ways for innovation and creativity to flow, minimizing the risk of homogenous ideas coming to the fore.



Quote for the day:


"A leader is not an administrator who loves to run others, but someone who carries water for his people so that they can get on with their jobs." -- Robert Townsend


Daily Tech Digest - March 28, 2020

Coronavirus transforms peak internet usage into the new normal


"We've been watching the network very closely," said Joel Shadle, a spokesman for Comcast. "We're seeing a shift in peak usage. Instead of everyone coming home and getting online, we're seeing sustained usage and peaks during the day." AT&T reported Monday that on Friday and again on Sunday it hit record highs of data traffic between its network and its peers, driven by heavy video streaming. The company also said it saw all-time highs in data traffic from Netflix on Friday and Saturday with a slight dip on Sunday. And the company reported that its voice calling traffic has been way up, too. Wireless voice calls were up 44% compared to a normal Sunday; Wi-Fi calling was up 88% and landline home phone calls were up 74%, the company said in its press release Monday.  AT&T also said it has deployed FirstNet portable cell sites to boost coverage for first responders in parts of Indiana, Connecticut, New Jersey, California and New York. Cloudflare, which provides cloud-based networking and cybersecurity services and which has been tracking worldwide data usage, noted in a blog post last week that it had seen network usage increase as much as 40% in Seattle, where the coronavirus first broke out in the US.



The Ecommerce Surge: Guarding Against Fraud

As more consumers shift to online shopping during the COVID-19 pandemic, retailers must ramp up their efforts to guard against ecommerce payment fraud, says Toby McFarlane, a cybersecurity expert at CMSPI, a payments consultancy. "Retailers should have in place already tools to monitor fraud and approval rates" so they can be benchmarked, McFarlane says in an interview with Information Security Media Group. "If you see a spike in fraud, for example, you want to know if that's a general industry trend or if that is something specific to your business." The shift toward ecommerce in recent weeks presents opportunities to gain a competitive advantage, McFarlane says. "We've seen average transaction values are increasing online, so if merchants can ensure their online infrastructure and experience is set up to handle that, then we could see certain merchants taking market share from non-optimized merchants," he says.


How to refactor the God object antipattern


It's not good enough to simply write code that works. That code must be easily maintained, enhanced and debugged when problems happen. One of the reasons why object-oriented programming is so popular is because it delivers on these requirements. But antipatterns often appear when developers take shortcuts or focus more on the need to get things done instead of done right. One of those common antipatterns is the God object. One of the main concepts in object-oriented programming is that every component has a single purpose, and that component is only responsible for the properties and fields that allow it to perform its pertinent functions. ... Good object-oriented design sometimes takes a back seat to a need to get things done, and the single responsibility model gets thrown out the window. Then, out of nothingness, the God object emerges. In simple terms, the God object is a single Java file that violates the single-responsibility design pattern because it: performs multiple tasks; declares many unrelated properties; and maintains a collection of methods that have no logical relationship to one another, other than performing operations pivotal to the application function.


What’s Next in DevOps?

What’s Next in DevOps?
DevOps is aimed at "actualizing agile" by ensuring that teams have the technical capabilities to be truly agile, beyond just shortening their planning and work cadence. Importantly, DevOps also has Lean as part of its pedigree. This means that there is a focus on end-to-end lifecycle, flow optimisation, and thinking of improvement in terms of removing waste as opposed to just adding capacity. There are a huge number of organisations and teams that are still just taking their first steps in this process. For them, although the terminology and concepts may seem overwhelming at first, they benefit from a wide range of well-developed options to suit their development lifecycle needs. I anticipate that many software tools will be optimizing for ease-of-use, and continuing to compete on usability and the appearance of the UI. Whereas most early DevOps initiatives were strictly script and configuration file based, more recent offerings help to visualise processes and dependencies in a way that is easily digested by a broader segment of the organization.


Tips for cleaning data-center gear in response to coronavirus

server room / data center
Dell has come up with some guidance for cleaning its data center products. It's well timed, as data-center operators are tasked with implementing access and cleaning procedures in response to COVID-19. It's a real issue. The two biggest data center and colocation providers, Equinix and Digital Reality Trust, are restricting visitors to their facilities for the time being. Since the hardware in colocation data center is owned by the clients, they have every right to visit the facility to perform maintenance or upgrades – but not for now. Meanwhile, data-center staff have been declared essential and are exempt from California's "stay at home" order, so like grocery store and banking staff, data center workers can go to work. Right off the bat, Dell acknowledges that its data center products "are not high touch products," and that data centers should have a clean room policy where people are required to sanitize their hands before they enter. If your gear does need sterilization, Dell recommends engaging a professional cleaning company that specializes in sterilizing data center equipment. If that's not possible, then you can do it yourself as a last resort.


States of shock: Recovering our tech economy after COVID-19


Segal says the effects of the current economic downturn may be compounded by crises of confidence throughout the world, and reactions to the uncertain nature of the virus' transmissivity path — particularly in those countries where uncertainty preceded action. But that uncertainty, being a psychological factor, could be remedied in short order, giving her optimism that the global economy, including technology, could resume its previous course by the end of 2020. "We've certainly had at least a pause," remarked ZDNet contributor Ross Rubin, principal analyst with Reticle Research. He noted Apple's warning of supply chain disruptions for components for iPhone and other devices. As a supplier itself, it first closed its retail outlets inside China, and later as infection cases within China subsided, reopened those stores at roughly the same time it closed its retail outlets outside China. "The reports that we're getting back now is that the factories are starting to gear up again," Rubin continued. For example, Apple has announced product refreshes for iPad, still on schedule for May. "There seems to be some confidence there that, while those products do not ship in anywhere near the same volumes as iPhones — particularly the iPad Pro, which is a more premium product — they are introducing new, cellular-enabled products."


Aisera: The Next Generation For RPA (Robotic Process Automation)

Torso Of IT Manager Activating RPA Application
A good way to look at this is as a simple equation: AI + RPA = Conversational RPA. When you converge AI and RPA, you get Conversational RPA. AI provides a human-like dialogue interface for users providing similar consumer-like application experiences, like those of Alexa, Whatsapp, Instagram, and Snapchat. This simple natural human-like interface interacts and performs the duties, tasks, IT workflows, and business workflows. RPA is used to automate simple and complex workflows that are highly repetitive that are typical of back-office functions. Most of these should not require humans to manage, monitor or execute them. Conversational RPA’s self-learning ability reduces the barrier for user adoption and lends itself to expediting complex challenges like cloud and application integrations, compliance, audit trail creation, and user experience analysis that require complex workflows. Conversational RPA supports new workflows, existing workflows and provides a way to customize workflows to meet business needs.


Automate security testing and scans for DevSecOps success


Automated security testing analyzes environments to make sure they meet expectations. Organizations mandate particular environment configurations to meet security and performance goals, but you don't know that the configuration is as expected without testing. Processes like white box and black box testing can help QA engineers pinpoint potential vulnerabilities before it's too late. If configuration is out of specification, the software team can halt the release and remediate the security deficiencies themselves, or alert the security team. Remediation on the fly might be the better option if automation is in place, such as declarative configuration management, to handle configuration drift. If you have both red teams -- aggressive fake attackers -- and blue teams -- their counterparts enacting defenses -- in security, this is also the phase in which you should launch real attacks against your code. If the app can't handle it, it's time to go back to the drawing board with the developers to make the product more resilient. If the app passes, push to production with peace of mind.


Quantum entanglement breakthrough could boost encryption, secure communications


Generating photons at two micrometres had never been demonstrated before. A major challenge for the researchers was to get their hands on the appropriate technology to conduct their experiment. "You need detectors that are able to see single photons at two micrometres, and we had to develop the right technology for these measurements," says Clerici. "And on the other side, you also need a specific piece of technology to generate the photons." In partnership with technology manufacturer Covesion, Clerici and his team engineered a nonlinear crystal that was suitable for operating at two micrometers. Photons are generated when short pulses of light from a laser source pass through the crystal. In theory, the entangled photons generated at the new wavelength should be able to travel as far as the photons generated through existing methods, and used for satellite communication. But the new experiment is still in its early stages, and Clerici said that the team hasn't yet identified how much information the new technology can communicate, or how quickly.


Google's MediaPipe Machine Learning Framework Web-Enabled with WebAssembly


The browser-enabled version of MediaPipe graphs is implemented by compiling the C++ source code to WebAssembly using Emscripten, and creating an API for all necessary communications back and forth between JavaScript and C++. Required demo assets (ML models and auxiliary text/data files) are packaged as individual binary data packages, to be loaded at runtime. To optimize for performance, MediaPipe’s browser version leverages the GPU for image operations whenever possible, and resort to the lightest (yet accurate) available ML models. The XNNPack ML Inference Library is additionally used in connection with the TensorflowLite inference calculator (TfLiteInferenceCalculator), resulting in an estimated 2-3x speed gain in most of applications. Google plans to improve MediaPipe’s browser version and give developers more control over template graphs and assets used in the MediaPipe model files. Developers are invited to follow the Google Developer twitter account.



Quote for the day:


"Leadership is the other side of the coin of loneliness, and he who is a leader must always act alone. And acting alone, accept everything alone." -- Ferdinand Marcos


Daily Tech Digest - March 27, 2020

The Role Of Human Judgment As A Presumed Integral Ingredient For Achieving True AI

Human judgment is yet to be embodied into AI.
Some in AI would argue that human judgment is going to arise anyway within AI systems as a consequence of some form of “intelligence explosion” that might occur, and there’s no need to fret about how to code it or otherwise craft it by human hands. Essentially, some believe that if you make a large enough kind of Artificial Neural Network (ANN), oftentimes today referred to as Machine Learning or Deep Learning, there is going to be an arising emergence of true AI by the mere act of tossing together enough artificial neurons. One supposes that this is akin to an atomic explosion such that if you start by seeding a process and get it underway, there will be a chain reaction that becomes somewhat self-sustaining and grows iteratively. In the case of a large-scale (well, really, really, massively large-scale) computer-based neural network, such proponents presuppose that there would an emergence of intelligence in all respects of a human-like manner, and perhaps it would even exceed humans, becoming super-intelligent ... A few quick points to ground this discussion. The human brain has an estimated 86 billion neurons and perhaps a quadrillion synapses (for more on such estimates, see this link here). There is not yet any ANN that approaches that volume.


two colleagues having a business discussion  in front of a whiteboard
Mukherjee believes leaders need the ability to navigate the in-between places that experts avoid. He posits organizations should allocate leadership responsibilities across a network because leaders cannot be everywhere. Leadership today is distributed and takes place through teams. Given this, teams need access to key knowledge bases. As well, they need to be encouraged to bridge gaps in critical knowledge. According to James Staten, VP Disruptive Innovations at Forrester, "Our guidance is that leaders should not just form dedicated innovation teams, but they need to empower cross-company (and cross-ecosystem) innovation ideation so they have a broad set of ideas to choose from.” Mukherjee argues that digital transformation requires flat organizations. At the same time, he suggests it is important to ensure people understand their business's strategic intent. They need to “get to the higher ground versus go take the mountain.” Making this work involves acquiring team members who come up with solutions rather than just define problems. This starts by redesigning the work teams do. According to Jeanne Ross, it also involves creating an accountability framework.


Learn how New Relic works, and when to use it for IT monitoring


New Relic APM gathers metrics on web transactions, including response time on the web server side, throughput expressed in requests per minute and application errors over time, as well as metrics on individual HTTP requests. The tool also digs into the metrics of major database applications, such as SQL, to report response times and throughput, time per query, slow queries and other details that help pinpoint SQL statements that might bog down a website. New Relic APM supports Java and external environments. It can collect Java virtual machine (JVM) metrics, such as heap and non-heap memory, garbage collection, class count, thread pools, HTTP sessions and transactions. ... New Relic APM provides detailed error analytics that identify the exact error locations and classify the associated transactions and error types. Admins can filter results to tease out specific error details and attributes for each trace. A thread profiler shows the relative activity areas of the application to locate possible bottlenecks for remediation.


VueJS vs ReactJS: Which Will Reign in 2020?

reactjs vs vuejs
Well, both these are considered to be the best frameworks of Javascript. But still, they serve us with different features and functionalities. The basic difference between Vue.js and React is that Vue.js makes use of templates with declarative rendering, while on the other hand, React js uses JSX which is known as a JS extension which keeps HTML within it. This means that React needs more effort even for a simpler task in comparison to Vue. let’s have a look at the below-given images which are clearly showing the simple implementation of Vue and complex of React. ... Talking about the popularity of both these frameworks, it is already seen through some stats that Reactjs is more popular in comparison to Vuejs. It has been seen that javascript launches a number of frameworks and those frameworks keep on changing their positions in terms of popularity. According to the searches, React is on top with the number of 48,718 dependents, whereas, Vue.js is the second most popular JavaScript framework with half as many dependents — 21,575.


3 things I bet you didn’t know about multicloud security

3 things I bet you didn’t know about multicloud security
First, traditional approaches to security won’t work. Those of you who have had success in enterprises using traditional security approaches, such as role-based, won’t find the same results in multicloud. Multicloud requires that you deal with the complexity it brings and leverage security that’s able to configure around that complexity. IAM (identity access management) married with a good encryption system for both at rest and in flight are much better options. Second, you can’t use cloud-native security. Although the security that comes with AWS, Azure, and Google Cloud works great for the native platforms, they are not designed to secure a non-native or a competitor’s platform, for obvious reasons. Still, I run into enterprise users who use a cloud-native security platform as a centralized security manager and fail instantly. ... Finally, you’re responsible for more than you think. Public cloud providers put forth the shared-responsibility model as a way to help their cloud customers understand that although the providers do offer some rudimentary security, ultimately enterprise cloud users are responsible for their own security in the cloud. In a multicloud arrangement this is even more the case.


New attack on home routers sends users to spoofed sites that push malware

Photograph of a Linksys router.
It remains unclear how attackers are compromising the routers. The researchers, citing data collected from Bitdefender security products, suspect that the hackers are guessing passwords used to secure routers’ remote management console when that feature is turned on. Bitdefender also hypothesized that compromises may be carried out by guessing credentials for users’ Linksys cloud accounts. The router compromises allow attackers to designate the DNS servers connected devices use. DNS servers use the Internet domain name system to translate domain names into IP addresses so that computers can find the location of sites or servers users are trying to access. By sending devices to DNS servers that provide fraudulent lookups, attackers can redirect people to malicious sites that serve malware or attempt to phish passwords. The malicious DNS servers send targets to the domain they requested. Behind the scenes, however, the sites are spoofed, meaning they’re served from malicious IP addresses, rather than the legitimate IP address used by the domain owner.


Memory Issues For AI Edge Chips


AI chips — sometimes called deep-learning accelerators or processors — are optimized to handle various workloads in systems using machine learning. A subset of AI, machine learning utilizes a neural network to crunch data and identify patterns. It matches certain patterns and learns which of those attributes are important. These chips are targeted for a whole spectrum of compute applications, but there are distinct differences in those designs. For example, chips developed for the cloud typically are based on advanced processes, and they are expensive to design and manufacture. And edge devices, meanwhile, include chips developed for the automotive market, as well as drones, security cameras, smartphones, smart doorbells and voice assistants, according to The Linley Group. In this broad segment, each application has different requirements. For example, a smartphone chip is radically different than one created for a doorbell. For many edge products, the goal is to develop low-power devices with just enough compute power.


Visual Studio 2019: Now IntelliSense linter for C++ programming language cleans up code


The feature can be enabled in Visual Studio 2019 version 16.6 from the Preview Features within the Tools > Options menu. Microsoft developed the linter to make it easier developers to pick up C++ with a focus on finding and fixing logic and runtime errors in pre-build code. In future releases of the linter, Microsoft plans to let developers dial up or down the severity of individual checks and it will integrate it with other code-analysis tools. Microsoft has also released the third preview of the WebAssembly version of its Blazor renderer for building web apps that work offline. It follows last month's release of the second Mobile Blazor Bindings preview for building native iOS and Android apps using C# and .NET. This Blazor WebAssembly preview enables debugging in Visual Studio and Visual Studio Code, and automatic rebuilds in Visual Studio. It brings configuration updates as well as new HttpClient extension methods for JSON handling. Developers need to install Version 3.1.201 or later of the .NET Core SDK to use the latest Blazor WebAssembly preview, which Microsoft expects to reach general availability in May. Currently, the only Blazor renderer that has reached general availability is the Blazor Server remote renderer, while Microsoft has yet to fully commit to the future of Mobile Blazor Bindings.


Top 5 Machine Learning Algorithms You Need to Know

Top 5 ML algorithms you need to know
Logistic Regression is similar to linear regression, but is a binary classifier algorithm (it assigns a class to a given input, like saying an image of a pie is a "pie" or a "cake" or someone will come in 1st, 2nd, 3rd, 4th place) used to predict the probability of an event occurring given data. It works with binary data and is meant to predict a categorical "fit" (one being success and zero being failure, with probabilities in between), whereas Linear Regression's result could have infinite values and predict a value with a straight line. Logistic regression instead produces a logistic curve constrained to values between zero and one to examine the relationship between the variables ... Naive Bayes is a family of supervised classification algorithms that calculate conditional probabilities. They're based on Bayes’ Theorem which, assuming the presence of a particular feature in a class is independent of the presence of other features, finds a probability when other probabilities are known. For example, you could say a sphere is a tennis ball if it is yellow, small, and fuzzy.


Understanding Dynamics 365 for IT: Architecture, integration, and more

UIs for a suite of Microsoft Dynamics applications.
Central to Dynamics 365 is the Common Data Service (CDS) and its Common Data Model (CDM). This provides a foundation for data integration across all Dynamics 365 applications and services, your productivity and collaboration apps in Microsoft 365, your in-house systems, and even your SaaS applications in other clouds. The Common Data Service is a heterogeneous storage service for both structured tabular data and unstructured data such as images or log files. It runs in Microsoft Azure and is shared by Dynamics 365 applications, Microsoft 365, and the Microsoft Power Platform. The Common Data Service understands the shape of your data and the business logic over your data. The Common Data Model supports a consistent way of shaping and connecting your data, and we’ve open sourced the schemas we use in the Common Data Service which is the foundation of what we call the Common Data Model or CDM.



Quote for the day:


"Risks are the seeds from which successes grow." -- Gordon Tredgold


Daily Tech Digest - March 26, 2020

3 Ways Role-Based Access Control can Help Organizations

Device Control
RBAC is a policy-neutral access control solution built around roles and privileges. Also known as role-based security, RBAC helps restrict access to authorized users only. It supports both discretionary and mandatory access controls per business requirements. Its features including but not limited to permission groups, role permissions, and user-role or role-role relationships help block or restrict users from doing unauthorized actions or tasks or from using unauthorized data storage. Without an enforcing access control system, employees can do almost anything. For example, an employee can send a modified invoice or quote with his bank account information, stealing the payment from the organization’s clients. Or, he can provide access to third-party persons or organizations, allowing them to infiltrate in your organization, check or steal your sensitive data, and more. ... Wiith a role-based access control system, you can reduce the paperwork for onboarding employees, changing passwords, switching roles, etc. You can make use of the control system to add or switch roles quickly, implement roles and permissions to multiple employees or globally, and do more. Since the complete access control settings sit under one platform, it generates fewer errors and more efficiency when assigning roles and permissions to the employees.



Data-layer security is a new imperative as employees telecommute due to coronavirus


Cybersecurity began as an effort to wall off companies from the outside world, protecting trade secrets, customer data, and other sensitive information from unauthorized people. Since then, the world has grown far more complicated. Data has become increasingly important even as it has been moved to the "cloud," and accessed through the internet. No longer do just employees need access to that data--customers do, too. And no longer do just people need access to that data--other computer systems do, too. Corporate computer systems are no longer isolated forts, they are interconnected hives with information passing back and forth in myriad ways. The result has been a steady increase in ways for criminals to get that data, and a steady drumbeat of increasingly spectacular breaches, with criminals stealing everything from credit card and social security numbers to the blueprints for nuclear power plants. With virtual private networks that were built to handle modest numbers of workers now facing hordes, the threat vectors are proliferating.


Big Data: Leading trends in use, governance and technology


One of the benefits of using AI is that it can improve data quality. This improvement is needed within any analytics-driven organisation where the proliferation of personal, public, cloud, and on-premise data has made it nearly impossible for IT to keep up with user demand. Companies want to improve data quality by taking advanced design and visualisation concepts typically reserved for the final product of a BI solution, namely dashboards and reports, and putting them to work at the very beginning of the analytics lifecycle. AI-based data visualisation tools, such as Qlik’s Sense platform and Google Data Studio, are enabling enterprises to identify critical data sets which need attention for business decision-making, reducing human workloads. In an effort to speed time-to-market for custom-built AI tools, technology vendors are introducing pre-enriched, machine-readable data specific to given industries. Intended to help data scientists and AI engineers, these kits include the data necessary to create AI models that will speed the creation of those models. For example, the IBM Watson Data Kit for food menus includes 700,000 menus from across 21,000 US cities and dives into menu dynamics like price, cuisine, ingredients, etc.


Executives: employees are the greatest threat to critical cyber security image
The independent report, “Weathering the Perfect Storm: Securing the Cyber-Physical Systems of Critical Infrastructure,” queried over 400 c-level executives from critical infrastructure organisations across North America, Europe and Asia/Pacific and found: 52% say employees are the biggest threat to operational security; Cyber incursion into IT data systems accounted for 53% of attacks in the last 12 months; 85% of security incursions made their way into Operational Technology networks – of those, 36% started in IT/data systems and 32% involved physical incursion into OT; More than half (64%) say it took a cyber or physical security breach to motivate them to move toward a more holistic approach to cyber security; and Only a quarter believe their existing security is adequate.  “The perfect storm of increasing cyber threats, digital transformation and IT/OT convergence means organisations must move swiftly to gain visibility and enhance cybersecurity into their OT and IoT networks,” said Kim Legelis, CMO, Nozomi Networks.


10 ways hackers are using automation to boost their attacks


The simple reason cyber criminals are automating processes is because they see it as an avenue for more successful attacks and generating larger amounts of profit, more quickly and more efficiently. "Threat actors have realized that, even though in the short term it may seem that you can have a bigger windfall if you do everything from beginning to end, in the long run, if you focus on doing one thing very well, you will likely make more money," Roman Sannikov, director of cybercrime and underground intelligence at Recorded Future, told ZDNet. The 10 types of automated tool listed in the report aren't in any particular order, but researchers note that they're all extremely useful to cyber criminals looking to boost their illicit activity. ... Powerful tools that are widely available on the dark web, banking injects are modules that are typically bundled within banking trojans that inject HTML or JavaScript code into processes to redirect users from legitimate banking websites, to fake ones designed to steal details. While these tools are typically expensive – they can sell for four figures on underground forums – they provide users with an automated kit that they can use to make that figure back many times over and with little effort.


China-Based Threat Group Launches Widespread Malicious Campaign

Researchers from FireEye who have been tracking the activity said APT41 attacked as many as 75 of its customers between January 20 and March 11 alone. The targeted organizations are scattered across 20 countries, including the US, UK, Canada, Australia, France, Japan, and India. Organizations from nearly 20 sectors have been impacted, including those in the government, defense, banking, healthcare, pharmaceutical, and telecommunication sectors. Though only a handful of the attacks resulted in an actual security compromise, FireEye described APT41's activity as one of the broadest malicious campaigns ever by a Chinese threat actor in recent years. Chris Glyer, chief security architect at FireEye, says the reason for APT41's sudden burst of activity is unclear. Based on FireEye's current visibility, the attacks appear to be targeted, but it is hard to ascribe a specific motive or intent behind APT41's behavior, he says. But likely triggers include the ongoing trade war between the US and China and the unfolding COVID-19 pandemic.


Apple Update Fixes WebKit Flaws in iOS, Safari


“This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari,” Dustin Childs, manager with Zero Day Initiative, told Threatpost. “The specific flaw exists within the object transition cache. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.” The issue “was addressed with improved memory handling,” according to Apple. Another type confusion issue (CVE-2020-3901) was found in WebKit, that could lead to arbitrary code execution. This flaw could be exploited if an attacker persuades a victim to process maliciously crafted web content, according to Apple. Apple also addressed a memory corruption issue (CVE-2020-3895, CVE-2020-3900), and a memory consumption issue (CVE-2020-3899) that could could enable attackers to launch code execution attacks. Finally, the tech giant also fixed an input validation bug in WebKit (CVE-2020-3902) that could allow attackers to launch a cross-site scripting attack. The attackers would need to first persuade victims to process maliciously crafted web content.


Organizations are moving their security to the cloud, but concerns remain

Cloud computing
Asked why they've been moving to cloud-based security, 29% of the respondents cited improvements in the monitoring and tracking of attacks, while 22% pointed to reduced maintenance. Other reasons included reductions in capital expenditures and access to the latest features. But organizations also have specific fears about switching their security tools to cloud-based variants. Asked about their concerns, 30% of the respondents pointed to the privacy of their data, 16% to unauthorized access, 14% to server outages, 14% to integration with other security tools, and 13% to the sovereignty of their data. Further, some 32% said they thought it would be too hard or too risky to migrate their security tools to the cloud. Another 32% said they didn't know what concerns their organization had about this type of migration. Among the organizations that have moved to cloud-based security tools, 22% cited email as the most widely protected type of data, 21% customer information, 20% file sharing, and 18% personnel files. Only 12% of the respondents said they're using cloud-based security to protect corporate financial data.


Edge Computing: 5 Design Considerations for Storage

istock 1129519394
Today’s challenges with data are heterogeneous. Data is scattered and unstructured in mixed storage and computing environments – endpoints, edge, on-premises, cloud, or a hybrid, which uses a mix of these. Data is also accessible across different architectures, including file-based, database, object, and containers. There are also issues of duplications and conflicts of data. 5G will surely add more complexity to today’s existing challenges. With 5G, even more data will be generated from endpoints and IoT devices, with more metadata and contextual data produced and consumed. As a result, there will be more demand for real-time processing and more edge compute processing, analyzing, and data storage scattered throughout the network. Each application and use case is unique and has different storage requirements and challenges, including performance, integrity of data, workloads, retention of data, and environmental restrictions. In the past, the capabilities of general-purpose storage greatly exceeded the requirements of networks, data, and applications.


GitOps brings the power of Git into Ops

GitOps brings the power of Git into Ops
Linus Torvalds might be best known as the creator of Linux, but Git, the distributed version control system of his invention, is arguably even more important. Torvalds has said that “Git proved I could be more than a one-hit wonder,” but this is an understatement in the extreme. While there were version control systems before Git (e.g., Subversion), Git has revolutionized how developers build software since its introduction in 2005. Today Git is a “near universal” ingredient of software development, according to studies pulled together by analyst Lawrence Hecht. How “near universal?” Well, Stack Overflow surveys put it at 87 percent in 2018, while JetBrains data has it jumping from 79 percent (2017) to 90 percent (2019) adoption. Because so much code sits in public and (even more in) private Git repositories, we’re in a fantastic position to wrap operations around Git. To quote Weaveworks CEO Alexis Richardson, “Git is the power option, [and] we would always recommend it if we could, but it is very wrong to say that GitOps requires expertise in Git. Using Git as the UI is not required. Git is the source of truth, not the UI.” Banks, for example, have old repositories sitting in Subversion or Mercurial. Can they do GitOps with these repositories?



Quote for the day:


"All organizations are perfectly designed to get the results they are now getting. If we want different results, we must change the way we do things." -- Tom Northup


Daily Tech Digest - March 25, 2020

Windows has a zero-day that won’t be patched for weeks


For now, there are no CVE identifiers and the only confirmed details are in Microsoft’s warning: Microsoft is aware of limited targeted attacks that could leverage un-patched vulnerabilities in the Adobe Type Manager Library and is providing the following guidance to help reduce customer risk until the security update is released. Attackers could exploit the flaw by persuading users to open a malicious document. Importantly, however, the same danger would arise even if users viewed that document using the Windows Explorer file manager preview pane. The latter is significant because, for now, there’s no software fix, which could be as far away as the next Patch Tuesday update, scheduled for 14 April 2020: Microsoft is aware of this vulnerability and working on a fix. Updates that address security vulnerabilities in Microsoft software are typically released on Update Tuesday, the second Tuesday of each month. Until then, the only countermeasure is to use one of the recommended workarounds, which involves disabling Explorer’s preview and details pane.


Six industries that need to hire a data protection officer image
The fintech sector encompasses banking, investments, trading, payments and other related areas. It involves applying technology for improved decision-making, better transparency, enhanced security and more. Companies that deal with matters like stock trading and investments should strongly consider hiring data protection officers to help maintain best practices for security. Doing so is particularly important considering the amount of evaluation that a person or company typically goes through before making such investments. For example, some databases contain complete historical records of end-of-day data for exchange-traded and equity options in the United States. Clients need continual and reliable access to such data so that they can decide when to invest and which companies on the stock exchange deserve their attention. The fintech sector assists everyday people who are not investors, too. Many banks and financial apps track a consumer’s spending habits.


istock 1090857252
Historically, security systems often simply used a low-resolution camera to passively capture video. This trend held whether at private residences, commercial properties, or on-board public transportation. Now, smart security systems are being purpose-built to capture, store, and analyze continuous video streams. On top of the 4K video captured by high-resolution cameras, these systems can use an analytics layer with machine learning software to carry out pattern recognition and motion detection. ... Today’s factories are using IoT-enabled machines to work smarter, not harder. By equipping machines with sensors, factory managers can more accurately map machine workloads, inputs, and outputs. They can also more closely track machine wear-and-tear, which leads to maintenance that is predictive rather than reactive and improves lifespan. With these features, factories are increasingly becoming automated, thanks to the wave of Industry 4.0. Machine-to-machine (M2M) devices typically use embedded and removable flash solutions to aggregate data into a single stream at the edge.


COVID-19 stress tests cloud services
Amazon Web Services has included pandemic response in its resiliency planning and regularly scales to handle spikes in demand, such as on Black Friday. Pandemic response policies and procedures have been incorporated into disaster recovery planning. Measures have been taken to ensure ample capacity and service continuity. Google Cloud has formed an internal working group to plan for and mitigate against business impacts resulting from COVID-19. The company expressed confidence its systems can continue to support customers during this time. Microsoft Azure has seen a 500 percent increase in meetings, calling, and conferences on its Teams remote collaboration platform since January 31. In the same time frame, it has seen a 200 percent increase in Teams usage on mobile devices. The company maintains cloud service availability by running multiple instances in geographically dispersed locations. Forrester advises cloud users not to panic about cloud capacity, given the past decade of massive cloud buildouts. While the long-term impact of how people will work in the future is unclear, the pandemic offers a powerful case study and a first look at the promise of cloud computing.


How Microsoft is building new tech to bring precision agriculture to the world’s poorest farmers

A person holding FarmBeats soil sensor which is connected to an IOT network.
While the team could innovate their way to recreate a drone’s functionality, there was no replacement for sensors that provide critical soil-level data for insights. To capture data, one needs multiple sensors spread across the field, which costs hundreds of dollars. The technology is too expensive for small farmers. “That technology does not exist. It has to be built,” Chandra says. So they built it. The FarmBeats team has come up with a solution that can provide soil level data without requiring expensive sensors on the ground. “While it might not be possible for these farmers to buy multiple sensors, we realized they already have a sensor that they use—their Android smartphones,” Chandra says as his eyes light up. Instead of using a network of sensors, the solution uses a smartphone’s Wi-Fi chipset to beam signals to the ground. By analyzing the “time of flight” of the Wi-Fi signal, they can detect the soil moisture and conductivity, which provides insights about watering the field and fertilizer input.


Boost security defenses against Kwampirs RAT malware with new list of IOCs

malware-skull.jpg
ReversingLabs collected data samples from Kwampirs attacks to write a reliable malware configuration parser that extracts network configurations from the samples. Each of the Kwampirs samples collected by ReversingLabs came with a set of 200 control server URLs. Malicious operations are usually carried out in campaigns that share the same control server infrastructure. ReversingLabs was particularly looking for command-and-control (C2) URLs. These URLs are interesting because of how the malware finds active C2 servers. Every sample comes with a hardcoded list of 200 URLs that Kwampirs tries to access in sequential order. The C2 locations are either in the form of domain names or IP addresses. The malware uses the first active URL it finds as the C2 server. Because the malware configuration is hidden in the installer that drops the DLL onto the system, an unpacker needs to be created to use with the parser. This unpacker decomposes the installation component and extracts the DLL, allowing the parser to collect the necessary C2 information. Using these two methods, ReversingLabs identified 1,586 URLs. Analyzing these URLs revealed that some of the droppers used the same payload, even though their hashes were different.


Digital Transformation Efforts Hindered by Lack of Upskilling


According to the Upskilling 2020: Enterprise DevOps Skills Report from the DevOps Institute, based on 1,300 respondents, more than 50% of enterprises find challenges with all aspects associated with managing the people, processes and technologies that make DevOps possible. The report found 58% of enterprises have a tough time actually finding those with the right DevOps skills and 48% said it’s difficult to retain skilled DevOps professionals. With that in mind, it’s no surprise the report found DevOps salaries on the rise. According to the Robert Half Technology 2020 Salary Guide, salaries for experienced DevOps engineers can reach beyond $179,250. Survey respondents said that the skillsets necessary for DevOps practitioners skillsets should be multifaceted, including process skills and knowledge (69% of respondents), automation skills (67%) and interpersonal skills (61%). The 2019 survey found automation skills to be the top skill, followed by process skills and knowledge.


Improving Cyber-Risk Management with ISO 27001 and the 10 Steps to Cybersecurity


According to the 2020 Global Risk Report developed by the World Economic Forum, cyber-attacks and data breaches now feature in the top 10 most likely risks to businesses, while also featuring prominently in relation to potential impact. As the frequency and disruptive potential of cyber-attacks increases each year, so does the cost. According to the 2019 Cost of Cybercrime study carried out by Accenture, the total cost of cybercrime in 2018 increased by 12% over the prior year and 72% over the previous five years. Recognizing the threat posed by cyber-attacks, the National Cyber Security Centre (NCSC) – the information assurance arm of the UK Government – released ‘10 steps to cybersecurity.’ These guiding principles offer business leaders advice on how to improve cybersecurity and how to protect their information assets. They can be applied to almost all organizations regardless of their size, location or sector. The central message of the guidance is the need for businesses to establish an effective information risk management regime or culture, supported by top management.


Fintech taskforce established to help SMEs cope with COVID-19 pandemic

Fintech taskforce established to help SMEs cope with COVID-19 pandemic image
The taskforce, which includes Trade Ledger, Wiserfunding, Nimbla and NorthRow, is working to provide a new turn-key loan origination and underwriting platform to allow banks and lenders to provide funds to businesses. This platform would include risk assessment, ‘know your customer’ (KYC), and insurance capabilities, and could be used by individual lenders or as part of a consortium. The funds that are made available would be deployed virtually and digitally, and would aim to lessen the impact of the COVID-19 outbreak on SMEs. Options would include loans of over £500,000, deployed within days rather than weeks. Martin McCann, CEO at Trade Ledger, said: “With the COVID-19 outbreak putting immense financial pressure on global supply chains, now more than ever, SMEs need reliable cash flow if they are to stay in business. “On average, it takes around 90 days for lenders in this sector to onboard new customers and establish new credit lines.


How much do you know about the Russian Dark Web?

We're seeing unique information come out of there because they're technically way more advanced than other users of the Dark Web around the world. Russians are far advanced and ahead of the game. So for example, earlier this year before the BlueKeep vulnerability was disclosed, there were Russian threat actors on cybercrime forums talking about this vulnerability, creating exploits for it and testing it before anybody else had been talking about it. So they're ahead of the rest of the world. And I think there's many environmental factors that contribute to that culture of criminality in the Russian Dark Web. And one is that the government just turns a blind eye to most of it. If it's not specifically negatively affecting the Russian government or Russian entities, they turn a blind eye to the crime. It's almost like they're giving permission to criminals to use this Dark Web forum for crime and business. Basically, in Russia, it's free game. The Russian government has no accountability. They don't hold these people accountable for their actions.



Quote for the day:


"Let him who would be moved to convince others, be first moved to convince himself." -- Thomas Carlyle