Daily Tech Digest - May 08, 2020

Autonomous cars: The cybersecurity issues facing the industry

Most companies know that they alone can’t create the ethical decisions behind the software, which has to balance the safety of the passengers against the safety of people outside of the vehicle. The big challenge, then, lies in creating regulations that formalise the limits of reasonable decision-making so that companies can program the vehicles to act within these parameters. Another area to consider is the security of the firmware and software; not only does it face the typical threat of cyber attacks, but for self-driving vehicles, security means safety. Automakers must be able to ensure that their software and firmware is secure which is made more complex with the connectivity of an IoT system where one vulnerability could open up the system to further threats. At the same time, the software must be reliable to ensure that the cars can run continuously and not break down because of a glitchy update. Companies such as Tesla have a very security-conscious approach to development, with security testing and research part of the normal product development research and process. This is not always the case for the traditional automakers who, in contrast, don’t have as mature an approach to security.

The new cyber risk reality of COVID-19 operating mode

One of the things we are seeing right now is the importance of viewing cybersecurity in a business context. Job one is to sustain the activities and enable the organization to achieve its mission. That is not new, but many companies are getting a new perspective on the importance of cybersecurity as an enabler for the business. Security and risk leaders need to have the power to frame both cyber risk and cybersecurity controls in a business context. This allows for sound justification for spending and other priorities. It also means focusing on new risk priorities stemming from our current operating mode, making sure we are optimizing our controls to address those risks, and achieving real-time risk visibility as the times require. Marking a departure for many organizations that traditionally have relied on periodic assessments that quickly go stale, security and risk leaders can now leverage software and methodology to dynamically evaluate the new cyber risk reality of this operating mode and build the needed capabilities to control it. Some may think that we will never be able to do enough.

When two chains combine

In an increasingly digitised world, emerging technologies, such as blockchain, afford organisations the opportunity to drive business value throughout their supply networks. According to Eric Piscini, Principal and Global Blockchain Leader at Deloitte Consulting LLP in the US, supply chains across industries and countries will be reimagined, improved and disrupted by blockchain technologies. We now have safer and more efficient ways to connect with business partners as well as to track and exchange any type of asset. The ability to deploy blockchain technologies to create the next generation of digital supply chain networks and platforms will be a key element in business success. Building supply chain capabilities with digital technologies can result in greater levels of performance. Blockchain is an enabling technology, which is most effective when coupled with other next generation technologies such as Internet of Things (IoT), robotic cognitive automation or smart devices. In this paper, Deloitte’s blockchain and supply chain professionals share insights on how blockchain-enabled technology can mitigate four crossindustry supply chain issues — traceability, compliance, flexibility and stakeholder management. The paper draws on use cases from the pharmaceutical industry (product tracking), automotive industry (purchasing platform) and food industry (know your supplier).

Chinese Military Cyber Spies Just Caught Crossing A ‘Very Dangerous’ New Line

The military espionage group’s tactics, described by Check Point as “very dangerous,” involved hijacking diplomatic communication channels to target specific computers in particular ministries. The malware-laced communications might be sent from an overseas embassy to ministries in its home country, or to government entities in its host country. “The group has introduced a new cyber weapon crafted to gather intelligence on a wide scale, but also to follow intelligence officers directives to look for a specific filename on a specific machine.” Meet Naikon, a cyber reconnaissance unit with links to the People’s Liberation Army, outed in a ThreatConnect and Defense Group Inc. report in 2015. Back then, the group’s operations were described as “regional computer network operations, signals intelligence, and political analysis of the Southeast Asian border nations, particularly those claiming disputed areas of the energy-rich South China Sea.” And while Naikon has been seemingly quiet since then, nothing has changed. Check Point told me that it has actually been “penetrating diplomats’ PCs and taking over ministerial servers—making the group very successful in gathering intelligence from high-profile personnel and able to control critical assets.”

Data scientist vs. machine learning engineer careers

Data scientists often start out as business analysts and boost their math and analytics skills with additional courses or on-the-job training. Some also start out right in data science, with academic backgrounds in statistics or artificial intelligence. In addition to math and business domain knowledge, data scientists typically need programming skills to be able to develop prototypes of their models. R and Python are the most common programming languages for the job, but Scala, Julia, JavaScript, Swift, Matlab and Go can also be useful. Data scientists should also be familiar with data visualization tools like Power BI, Tableau and Qlik. Andrew Stevenson, CTO at Lenses.io, a company that offers data platform monitoring technology, once worked on a project with data scientists from an energy trading desk. "They were able to build the models, test and run locally," Stevenson said. And then they hit the limit of their expertise, he said. "The models were not production-grade. They had no monitoring, they weren't version controlled, they were not easily developed in a repeatable way.

Successful Digital Transformation Requires Data Transformation

In this context, data transformation doesn’t just encompass the traditional “extract, transform, load” processes of collecting, cleaning, reformatting, and storing data. It also includes the subsequent analysis and leverage of collected (or real-time) data to inform a company’s decision making, its operations, and its high-level digital transformation strategies. Everyone agrees that the massive amounts of digital data generated by business and consumer activity represents an incredibly valuable resource – at least theoretically. In practice, however, the ever-expanding data resource is underutilized today. In a survey of 190 U.S. executives, Accenture found that only 32% can realize tangible and measurable value from data. Even fewer – 27% – said data and analytics projects produce insights and recommendations that are highly actionable. Without data-driven insights, digital transformation initiatives are flying blind. By contrast, organizations that make good use of data can achieve a range of benefits.

The United States quietly concedes defeat on Huawei's 5G

The timing of this move given the circumstances is extremely odd. However, the conceding that Huawei will have a role in the setting of global 5G standards is an indication that the White House is now aware of the realities that are at play. The United States has effectively lost the 5G war against Huawei. Failing to get it blacklisted throughout the world, Washington is now resigned to the fact that the company will now dominate the standards of the next generate internet and therefore, it is now forced to ultimately work with it in doing so, than against it. The outcome marks a major strategic defeat for the United States on this issue. First of all, despite everything we are hearing from the U.S. right now, policy and rhetoric are different. As I have set out previously, many American politics are showcasing anti-China stances in the pursuit of electoral races and this does not always translate into practical policy outcomes. Trump sees opportunity in bashing China right now over the COVID-19 pandemic, however what he says and suggests does not tell us everything he will do in practice and thus it is important to read deep between the lines during this given period.

Protecting corporate data in popular cloud-based collaborative apps

Unfortunately, companies are not able to monitor all of the documents or data being shared across these apps. For example, Slack has private channels and direct messaging capabilities where admins cannot view what information is being shared unless they are a part of the conversation. As we have witnessed with previous data breaches, there is a risk that sensitive data will not always be shielded from anyone outside your organization. Slack previously experienced a data breach back in 2015 as a result of unauthorized users gaining access to the infrastructure where usernames and passwords were stored. Salesforce has also had security issues in the past exposing users stored data to third parties due to an API error. These are just a few instances that should serve as a stark warning to enterprises that they can’t rely solely on app providers to ensure the security of their data – they must implement their own proper security solutions and processes in tandem. While these cloud-based services have native security capabilities in place to protect the infrastructure against intrusions, the onus is on the enterprises using these tools to ensure files that are being stored and accessed in the cloud are secure.

Governance, Risk, Compliance and Security: Together or Apart?

"Even within IT, you have project risks, you have development risks, you have risks that are associated with audit and compliance, but they're not dealt with in a very comprehensive way," said Christine Coz, principal research advisor at Info-Tech Research Group. "The key thing is sponsorship at the right levels of people in those conversations and that there is a goal to sort of act as a subset of the board of directors to ensure from an oversight perspective that there's a management of controls in place, that risk acceptance is in line with corporate tolerances and that you have a consistent level of risk tolerance and acceptance across the enterprise." The digitization of everything necessitates the need for ERM, not only because digital businesses operate much faster than their analog counterparts, but because risk management is a brand issue. "When you have a lot of competition in an industry, which is where I think we are now, every product and service [is] replaceable, our car insurance, your mortgage, our telecom carrier, your food app, you name it," said Forrester's Valente.

Dell EMC, Pure Storage upgrade storage offerings

In consolidating the best of breed, Dell claims PowerStore is up to seven times faster and three times more responsive than previous Dell EMC midrange storage arrays and is designed for six-nines (99.9999%) of availability. It can house up to 96 SSDs in a 2U chassis and uses both NVMe flash storage and Intel Optane SSDs. Dell promises a 4:1 compression and deduplication ratio. “Customers tell us a main obstacle keeping them from achieving their digital transformation initiatives is the constant tug-of-war between supporting the ever-increasing number of workloads – from traditional IT applications to data analytics – and the reality of cost constraints, limitations and complexity of their existing IT infrastructure,” says Dan Inbar, president and general manager, storage, Dell Technologies in a statement. “Dell EMC PowerStore blends automation, next generation technology, and a novel software architecture to deliver infrastructure that helps organizations address these needs.” PowerStore uses machine learning and intelligent automation for faster delivery of applications and services, claiming up to 99% less staff time by automating many features, like load and volume balancing or migrations.

---

Quote for the day:

“Great leaders don't need to act tough. Their confidence and humility serve to underscore their toughness” -- Simon Sinek

---

Daily Tech Digest - May 07, 2020

Is Passwordless Authentication the Future?

Implementing passwordless authentication platforms tend to be more complex in comparison to their credential-based counterparts, but the end user experience on a large-scale deployment is much simpler and more likely to be immediately adopted, Kothanath claims. "These devices and the data they collect and store, are becoming part of your digital identity. Your smartphone holds a number of attributes (phone number, IMEI number, carrier information, digital certificates, GPS location, manufacturer information, CPU unique ID, etc.) which can be used to uniquely authenticate you, negating the need for a password." It is extremely difficult to compromise these devices, he says, and technology is available today to enhance the security and reliability of device-based authentication. "As the value of the target asset increases, there can be other trusted devices, such as a Yubi Key and other hardware-based tokens, which can be governed under much tighter controls. All of this is trending towards a cutting-edge, identity-based authentication system and privilege management approach to eliminating passwords from the security equation," Kothanath notes.

Credit card skimmer caught hiding behind website favicon

Upon investigation, though, Malwarebytes discovered that the domain name of myicons.net was registered just a few days prior and hosted on a server previously identified as malicious. Further, myicons.net appropriated all its content from another site named iconarchive.com simply by pointing to that site within an HTML iframe. Digging further, Malwarebytes found that several e-commerce sites were loading an Adobe Magento favicon from the myicons.net domain. Though the security firm suspected that this favicon was malicious, it was unable to find any extra code inside it. However, it did uncover malicious activity on the e-commerce sites that were loading the Magento favicon from myicons.net. Instead of serving up an image file, the myicons.net server was actually loading code consisting of a credit card payment form. This form is loaded dynamically and overrides the PayPal checkout option with its own menu for MasterCard, Visa, Discover, and American Express cards. In the end, any credit card information entered through this form is then sent back to the criminals.

The chief digital officer and COVID-19

CDOs should be considering how to build in work flexibility to account for employees taking care of kids at home by, for example, shifting schedules; ensure access to resources such as tools and information-sharing intranets; educate less digitally fluent colleagues so they don’t feel overmatched by new demands with, for example, brief training sessions; and have frequent touchpoints such as digital town halls and pulse surveys, to gauge people’s mental and physical well-being. This goes beyond the typical work check-ins and is absolutely necessary to help employees deal with the unprecedented stress of this current environment. People are a company’s most precious resource, and how successful a CDO is in making sure that his or her employees are as healthy and supported as possible will be a testament to his or her true leadership skills. ... CDOs should emphasize design-thinking principles, which are predicated on building empathy with customers, to understand their motivations. We know of CDOs who are reaching out to customers for one-on-one conversations, leading customer interviews, and compiling surveys to better understand the challenges that customers face.

Open source database ScyllaDB 4.0 promises Apache Cassandra, Amazon DynamoDB drop-in replacement

ScyllaDB also brings some noteworthy features from a DevOps perspective. Change Data Capture (CDC) allows users to track changes in their data, recording both the original data values and the new values to records. Changes are streamed to a standard CQL table that can be indexed or filtered to find critical changes to data. Scylla Operator is a Kubernetes extension for Scylla cluster management. It currently supports deploying multi-zone clusters, scaling up or adding new racks, scaling down and monitoring Scylla clusters with Prometheus and Grafana. Both CDC and Scylla Operator are currently in Beta, expected to be fully rolled out soon, as per ScyllaDB's development model. Indeed, having watched ScyllaDB grow from relatively early in its lifecycle, we will have to ascertain the fact that it's catching up and adding new features at a rather fast pace. Laor mentioned they have a slew of more features in the works. When discussing what it is that enables ScyllaDB to make such rapid progress, Laor said that the company now employs about 100 people, and business has been growing well, too.

Remote access needs strategic planning right now

Over the next two to four years, enterprises have the opportunity to strategically plan for a converged architecture that addresses both networking and security: the secure access service edge or SASE (pronounced “sassy”). SASE combines WAN capabilities with security, and delivers them via services based on identity, time, context, compliance with enterprise policies and risk assessment, according to Gartner, which created the term. Technology suppliers are moving rapidly to extending their network and security solutions from the data center and branch office to the remote office, and this could fit the SASE model. Employees working out of their houses need access to any application, from any device, from any location and on any available network. They use critical applications such as VoIP, video and SaaS that require fast, low-latency connections. And because this access is deployed widely, the solution must be easy to install, simple to operate, flexible and cost effective. Work-at-home users must have direct internet access to cloud-based applications to overcome performance and latency issues with traditional remote access VPNs that route traffic from the user to the data center to the cloud, back to the data center and finally back to the user.

COVID-19, Cyber Security and the “New Normal”

First, from a technology perspective, the large scale remote working experiment we are having to endure is simply working: Platforms have scaled, and networks have not collapsed. We may or may not like it, but we are starting to adjust to new ways of interacting. More generally, the digital economy has successfully scaled up at pace and the COVID-19 crisis has dramatically accelerated the digital transformation of many sectors. It is impossible to say what the long-term impact will be (e.g. to what extend will we continue to work from home), but this is bound to bring a positive outlook for the tech industry at large. Second, over the last six weeks and in the face of countless scams and fraud attempts, we have had in front of us the largest real-life cyber security awareness campaign anyone could ever have imagined, and this is bound to have a significant cultural impact on people, in particular if the lockdown continues or comes back. Cyber security has had to be on the agenda, as a necessary dimension of lives and business activities now entirely dependent on digital services. Nobody can risk a cyber-attack right now, and good cyber security measures have become key to keeping the lights on. One cannot imagine cyber security moving down the priority list with senior executives post-COVID.

How Tesla uses open source to generate resilience in modern electric grids

"(The) majority of our microservices run in Kubernetes, and the pairing of Akka and Kubernetes is really fantastic," Breck said. "Kubernetes can handle coarse-grained failures in scaling, so that would be things like scaling pods up or down, running liveness probes, or restarting a failed pod with an exponential back off. Then we use Akka for handling fine-grained failures like circuit breaking or retrying an individual request and modeling the state of individual entities like the fact that a battery is charging or discharging." For modeling each site in software, this so-called digital twin, they represent each site with an actor. The actor manages state, like the latest reported telemetry from a battery and executes a state machine, changing its behavior if the site is offline and telemetry is delayed. It also provides a convenient model for distribution, concurrency, computation, and failover management. The programmer worries about modeling an individual site in an actor, and then the Akka runtime handles scaling this to thousands or millions of sites. It's a very powerful abstraction for IoT in particular, essentially removing the worry about threads, or locks, or concurrency bugs.

What does the new NHSX contact tracing app for coronavirus mean for data protection?

Although elementary, automated contact tracing has significant practical limitations. Bluetooth is an imprecise tool, and it risks false positives such as proximity through a wall. Necessarily it is ‘blind’ to disease transmission in spaces vacated by infected individuals moments before, where no Bluetooth handshake between handsets would take place. Crucially, automated contact tracing relies on uptake. In the UK, 60% of the population would need to download the app for it to make a positive difference, and with 20% of Britain’s population estimated not to own a smartphone and many older devices with limited app capability, many people would be excluded. A further difficulty arises from the multiplicity of contact tracing apps currently under development – how will they work together? Moreover, once international travel resumes, will national contact tracing apps be interoperable? Finally, there is a risk that automated contact tracing will be seen as a panacea by ‘fanboys’ for utopian technological solutions, whereas in reality, it can only be part of the answer, along with adequate infection testing and traditional confirmatory contact tracing, which are essential components of any useful roll-out.

Industry 4.0 requires whole-of-business approach to be successful

Even though the IoT revolution actually started in industrial settings in the 1960s and '70s, operators today still limit measurements to what is easy to measure. They also tend to apply the analytics and data created by those measurements too narrowly. As operational technologies (OT) and IT continue to blend (with operational analytics, for example, taking place on cloud platforms and the output being subsequently shared with ERP and supply chain management systems) using all operational data and analytics to uncover if technology-led process improvements are actually achieving the objectives for which they were deployed is more important than ever. "What we saw in our test bed activities is all these parties need to be brought onto the same page in order to declare success," said said Jacques Durand, co-chair of IIC's Digital Transformation working group and lead author of the report. "Saying that you just want to reduce a product error rate … is one thing but you have to be precise: What product? When do you measure? There are many aspects of measuring the condition of what you are measuring." Because of the tight integration taking place between OT, IT, and business workflows, today's process improvement goals go well beyond the factory floor.

Data Gateways in the Cloud Native Era

Microservices influence the data layer in two dimensions. First, it demands an independent database per microservice. From a practical implementation point of view, this can be from an independent database instance to independent schemas and logical groupings of tables. The main rule here is, only one microservice owns and touches a dataset. And all data is accessed through the APIs or Events of the owning microservice. The second way a microservices architecture influenced the data layer is through datastore proliferation. Similarly, enabling microservices to be written in different languages, this architecture allows the freedom for every microservices-based system to have a polyglot persistence layer. With this freedom, one microservice can use a relational database, another one can use a document database, and the third microservice one uses an in-memory key-value store. While microservices allow you all that freedom, again it comes at a cost. It turns out operating a large number of datastore comes at a cost that existing tooling and practices were not prepared for.

---

Quote for the day:

"Make heroes out of the employees who personify what you want to see in the organization." -- Anita Roddick

---

Daily Tech Digest - May 06, 2020

4 Ways to Avoid Cost-Cutting Amid Economic Uncertainty

Traditional approaches to budget management simply won’t cut it in this stark new landscape. Indeed, they never did. Imprecise, tactical budget-cutting is little more than a panic-driven, high-risk response to crisis. And as you start thinking about what -- and how and when-- you need to cut, you can’t afford to think strictly in terms of reducing expenses. Dollars matter, of course: Just don’t be myopic. Focus instead on business value, on the things you retain that drive that value, and on what the business will require as you eventually shift into recovery mode. ... CIOs must now identify and focus on initiatives that help the CEO and the business ensure the organization survives and thrives during this crisis. Partnership across the board is key for IT as the department must work in lockstep with the rest of the organization to identify big-ticket items that should be kept if they result in long-term savings. This may even include cost increases as the organization doubles down on the things that matter most. But if they drive long-term value and all partners are on the same page, it’s infinitely smarter than blunt-force cutting.

Tech-Driven Next-Gen Corporate Banking

Indeed, the biggest challenge may be persuading top executives to put the priority on a comprehensive and inclusive approach to fostering organizational excellence across corporate banking operations. In many instances, it is difficult for all of the business units and support units to embrace a wholesale paradigm shift. Attachment to internal organizational silos, new team dynamics, and modifying control functions mean that making the necessary change is never easy. At the same time, by taking the lead in the shift to digital, cutting-edge corporate banking operations can establish a superior position versus other challengers and new entrants. Some pioneering banks have already carved out comparatively large customer bases and are steadily accruing expertise related to data gathering, remittance processing, conflict resolution, and payment making. Notably, some banks are already making pioneering efforts in data analysis and AI. 

Why metadata is crucial in implementing a solid data strategy

Aside from the critical compliance issue, businesses can find great advantages in good metadata management. A host of misguided decisions are ordinarily made based on wrong or inaccurate information – usually due to non-consistent record labelling, duplicates, or non-explicit naming practices, which means that the latest and most accurate data might easily be lost or missed among the old or wrong ones. This is why it’s crucial to ensure all data is combined in a single source of truth which can yield accurate insights for businesses to make well-informed decisions on. Ensuring that the file metadata is kept organised and up to date –what is commonly referred to as data lineage– is important for quality control. It allows for better visibility, and so helps organisations to keep track of all data iterations and movements. Accurate metadata records play a key role in managing the rest of the data as well, helping maintain, integrate, edit, secure it and audit it as benefits the business. Correctly governed, metadata can be a vital factor in enabling innovation, future-forward initiatives and what will eventually become the new normal. One such example is AI.

Business Service vs. Product Thinking

If by product you just mean software as a trade good, services are more attractive. If by service you mean something low level and technical, products are more attractive. The legacy of definitional disagreement between ITSM vs. SOA plays into this issue”. Hinchcliffe said, “I’d say that you can’t have a product without a service. But you can’t have a good service without it being treated as a product”. With respect to question, Hinchcliffe said, “yes, project portfolio and service management still have value, but they are becoming much more operational and productized”. CIO David Seidl agrees with Dion when he says, “massive scaling of how we do online instruction, handling growth in conferencing, softphones, and collaboration technology. Remote support issues for people who have never worked at home. Even things like re-engineering solutions for remote work. We need to plan and run these darn things. We need to support them and their integrations. We need to understand their lifecycle, and where that intersects with all of the other things we have running. If you don’t keep a broad view…you fail”.

Sonatype Nexus vs. JFrog: Pick an open source security scanner

Both Sonatype and JFrog frame their open source security scanning strategies in the broader context of an SDLC rapid development framework. Sonatype prioritizes automation, while JFrog centers on swift code delivery. The products have similar security scanning processes. Each tool analyzes defined policies and checks code against a set of online repositories of problems. The scanning process is recursive; a vulnerable low-level element will reflect on any higher-level packages that include it, up to the application and project levels. Users see the issues the tools find, and the hierarchies those issues affect, in the GUI. Both JFrog and Sonatype also can generate alerts for violations, which in turn can trigger specific actions. Sonatype's Nexus platform enables teams to universally manage artifact libraries. Nexus harmonizes project management and code management, to accelerate development.

Forces of nature

Most nascent enterprises die in the early stage, because passion is not sufficient to guarantee commercial success. Those startups that survive develop a logic for their value creation process and assemble their value chain, moving into a stage of Reason. Former innovators evolve into managers. They are still free to act, but now they know what to do and their task is clear: to scale the enterprise as rapidly as possible. As companies move into the Reason part of the cycle, their priorities become raising financial resources, managing growth, recruiting people, and preserving the startup culture. But these priorities become increasingly challenging as scale and geographic dispersion grow. According to anthropologist Robin Dunbar, head of the Social and Evolutionary Neuroscience Research Group at Oxford University, the maximum number of personal relationships that human beings can comfortably maintain is about 150. So once an organization grows beyond that size, more formality is required. Managers must turn to the panoply of mainstream management methods. They do so for the very best of reasons: to embed and preserve the enterprise’s recipe for success.

Cisco spotlights new IT roles you've never heard of

Business translator: The business translator works to better turn the needs of business into service-level, security and compliance requirements that can be applied and monitored across the network. The translator also works to use network and network data for business value and innovation, and their knowledge of networking and application APIs will help them glue the business to the IT landscape. Network guardian: A network guardian works to bridge network and security architectures. They build the distributed intelligence of the network into security architecture and the SecOps process. This is where networking and security meet, and the guardian is at the center of it all, pulling in and pushing out vast amounts of data, distilling it and then taking action to identify faults or adapt to shutdown attackers. Network commander: Intent-based networking builds on controller-based automation and orchestration processes. The network commander takes charge of these processes and practices that ensure the health and continuous operation of the network controller and underlying network.

Critical Metrics to Keep Delivering Software Effectively in the "New Normal" World

For organisations delivering software in an Agile way, a sensible place to start is a set of metrics that tie back to core Agile principles – so that everyone is focused on the ultimate Agile goal of increasing customer satisfaction through “the early and continuous delivery of valuable software” – despite the challenges thrown up by the ‘new normal’ world. As Reuben Sutton, Plandek’s VP Engineering notes, “We have had to move to a fully remote working environment overnight, during one of the most intense software delivery periods our company has ever known. The Agile delivery metrics that our teams track and understand have been our ‘North star’. We know that we are still going in the right direction, as we can see it objectively in the metrics.” If Agile principles are the ‘north star’ around which you set your goals in the ‘new normal’ world, then you will need an effective framework for adopting them. In our experience, this framework needs to provide a simple hierarchy of metrics, so that they are understood and adopted by everyone.

Should you let a cloud maturity model judge you?

The issue that I have now with the many cloud computing maturity models out there—and there are many—is that people often rely on them too much. They can dilute the larger picture of the right way to do cloud adoption and how an organization should set the appropriate priorities. For instance, it never should be about using a specific cloud-based technology, such as serverless, containers, Kubernetes, or machine learning. It’s about leveraging the cloud for the right purposes that are consistent with serving the business. These maturity models do offer a beneficial measure of culture and internal processes, which are actually more important than adopting trendy cloud technology. Indeed, unless technology is employed specifically to serve the needs of the business, technology (including cloud technology) can take you back a few steps. You’re ultimately not aligning business requirements with the correct and pragmatic use of cloud and noncloud technology. Don’t get me wrong, there are some helpful and some not so helpful maturity models out there. As I practice enterprise cloud migrations, including assessment and planning, I use some of these models as foundational benchmarks at times.

Example of Writing Functional Requirements for Enterprise Systems

It is worth mentioning that while system requirements described all object types without exception, we didn't need to write use cases for all of them. Many of the object types represented lists of something (countries, months, time zones, etc.) and were used similarly. This allowed us to save our analysts’ time. An interesting question is which stakeholders and project team members use which requirement level. Future end users can read general scenarios, but use cases are too complicated for them. Because of this, our analysts just discussed them with end users and didn’t ask them to read or review use cases. Programmers usually need algorithms, checks and system requirements. You definitely can respect a programmer who reads use cases. Test engineers need all levels of requirements, since they test the system at all levels. In comparison with, for example, MS Word documents that are still widely used, Wiki allowed our requirements to be changed by several team members at the same time.

---

Quote for the day:

"Humility is a great quality of leadership which derives respect and not just fear or hatred." -- Yousef Munayyer

---

Daily Tech Digest - May 05, 2020

How to teach AI to reason about videos

Visual reasoning is an active area of research in artificial intelligence. Researchers have developed several datasets that evaluate AI systems’ ability to reason over video segments. Whether deep learning alone can solve the problem is an open question. Some AI scientists believe that given enough data and compute power, deep learning models will eventually be able to overcome some of these challenges. But so far, progress in fields that require commonsense and reasoning has been little and incremental. ... The controlled environment has enabled the developers of CLEVRER to provide richly annotated examples to evaluate the performance of AI models. It allows AI researchers to focus their model development on complex reasoning tasks while removing other hurdles such as image recognition and language understanding. But what it also implies is that if an AI model scores high on CLEVRER, it doesn’t necessarily mean that it will be able to handle the messiness of the real world where anything can happen. The model might work on other limited environments, however.

CISA reiterates DNS resolution requirements

The Cybersecurity and Infrastructure Security Agency is reminding agencies to use Domain Name System resolution services provided by CISA. The global DNS system translates website URLs into their corresponding IP addresses. However, an attacker can interfere with that translation to reroute internet traffic away from its intended destination, instead sending users to fake or spoofed websites where they can be eavesdropped on or tricked into downloading malware or revealing personal information. In a memo dated Apr. 21, CISA Director Chris Krebs reiterated that civilian agencies are legally required to use sinkholing capabilities through EINSTEIN 3 Accelerated as their primary upstream DNS resolving service. According to a Privacy Impact Assessment drafted in 2016, EINSTEIN 3 Accelerated's sinkholing capability “prevent[s] malware installed on .gov networks from communicating with known or suspected malicious Internet domains by redirecting the network connection away from the malicious domain to 'safe servers ... thus preventing further malicious activity by the installed malware."

Neuro-symbolic AI seen as evolution of artificial intelligence

"Neuro-symbolic modeling is one of the most exciting areas in AI right now," said Brenden Lake, assistant professor of psychology and data science at New York University. His team has been exploring different ways to bridge the gap between the two AI approaches. Companies like IBM are also pursuing how to extend these concepts to solve business problems, said David Cox, IBM Director of MIT-IBM Watson AI Lab. "I would argue that symbolic AI is still waiting, not for data or compute, but deep learning," Cox said. His team is working with researchers from MIT CSAIL, Harvard University and Google DeepMind, to develop a new, large-scale video reasoning data set called, "CLEVRER: CoLlision Events for Video REpresentation and Reasoning." This allows AI to recognize objects and reason about their behaviors in physical events from videos with only a fraction of the data required for traditional deep learning systems. Deep learning is incredibly adept at large-scale pattern recognition and at capturing complex correlations in massive data sets, NYU's Lake said.

Xen Orchestra latest victim of Salt cryptojackers

“In short, we were caught in a storm affecting a lot of people. We all have something in common: we underestimated the risk of having the Salt master accessible from outside,” said Lambert. “Luckily, the initial attack payload was really dumb and not dangerous. We are aware it might have been far more dangerous and we take it seriously as a big warning. The malware world is evolving really fast: having an auto update for our management software wasn’t enough. “If you are running SaltStack in your own infrastructure, please be very careful. Newer payloads could be far more dangerous,” he said. More technical details of Xen Orchestra’s experience can be read on its website. Alex Peay, senior vice-president of product and marketing at SaltStack, said it had taken immediate action to remediate the vulnerability, develop and issue patches, and communicate widely to customers about the affected versions. “Although there was no initial evidence that the CVE had been exploited, we have confirmed that some vulnerable, unpatched systems have been accessed by unauthorised users since the release of the patches,” he said.

How remote working has forced us to look beyond the traditional PC

A minor but interesting consequence seems to be an increased interest in PC alternatives -- whether because of lack of supply or simply because businesses and consumers have had to respond to changing circumstances with limited budgets. For example, the Raspberry Pi Foundation has noted that sales have rocketed during the coronavirus crisis, which it puts down to people buying the tiny computers to end battles over the single home PC during lockdown. The lastest Raspberry Pi might be diminutive, but it's powerful enough to take on the role of budget computer if need be. Chromebooks, which are slightly easier to work with if you don't have the technical skills to play with a Pi, have also been selling well. And it's not only harassed parents looking for extra PCs that have been getting creative. Here at ZDNet we've also written about how councils have been digging old laptops out of storage, putting Linux on them or otherwise lightening the operating system load, and sending them out to allow staff to work from home. An old or lower-spec device is good enough for many employees, especially if your teams only need to access cloud-based tools and/or virtual desktop services. It's been pointed out that without the option of using a wide range of cloud-computing services businesses would be in even more trouble.

Microsoft Announces the General Availability of Windows Server Containers

Besides the support for Windows Containers in AKS, Microsoft also announced support for private clusters and managed identities – which are intended to provide developers with greater security capabilities and to easier meet compliance requirements. Private clusters allow the use of managed Kubernetes within a closed network - without connection to the internet. And, with private clusters, the security measures of highly regulated industries such as finance or healthcare can be met. Next to the support for private clusters, AKS supports managed identities, which enables secure interaction with other Azure services such as Azure Monitor for Containers or Azure Policy. Furthermore, developers do not have to manage their service principals or rotate credentials often. Lastly, Burns wrote in his blog post about the continuous development of more integrations between AKS and Azure Advisor and bringing industry best practices right into the AKS experience. Moreover, Microsoft is committed to bringing customer learning into the VS Code extension for Kubernetes to provide developers with advice and integrate security advice into the Azure Security Center.

What is smishing? How phishing via text message works

Smishing is, essentially, phishing via text messages. The word is a portmanteau of "phishing" and "SMS," the latter being the protocol used by most phone text messaging services. Because of this etymology, you'll sometime see the word written as "SMiShing," though that's increasingly rare; people also include scam attempts via non-SMS text services, like WeChat or Apple's iMessage, under the smishing umbrella. The term has been around since at least the late '00s, though the omnipresence of smartphones in the modern era has made it a more tempting attack vector for hackers. "Vishing" is a similar type of attack that uses voice calls instead of emails or texts; the word is a portmanteau of "voice" and "phishing." ... Bank smishing is often successful for a couple of reasons. One is that many banks really do have services that text you about suspicious activity on your account. An important thing to keep in mind is that legitimate messages should contain information proving that the bank already knows who you are: they might include the last few digits of your credit card or bank account number, for instance.

Microsoft officially acknowledges Windows 10X is coming first to single-screen devices

Microsoft's official reason for targeting single-screen devices is the impact of the COVID-19 coronavirus pandemic on users' buying habits. And that may, in fact, be true, as users are likely more interested right now in tried-and-true form factors, like laptops and 2-in-1 devices than in brand-new, unproven ones. That's why Microsoft has suspended delivery of its own dual-screen Neo device, which was due this holiday season. While Windows 10X is important, it's not the only thing that matters. Windows 10, as it currently exists, is still important and more relevant than ever, Panay emphasized. He said Microsoft will be making Windows-specific developer content a big part of its Build 2020 developers conference coming up later this month. Panay's post includes some new data from Microsoft about how the current health situation has impacted Windows' usage. Windows 10 is being used 75 percent more, in terms of minutes of usage, than this same period a year ago, Panay said. This makes sense, given users are working and learning remotely and are likely less on the move/more tethered to their desks.

Changing realities of digital transformation in the public sector

Given the increase in online interactions, digital transformation in government is no longer about simply innovating, but managing scale, operational efficiency and ensuring taxpayer value for money, while user expectations, technologies and suppliers’ services are rapidly shifting. "The ability of government to continue to deliver high-quality services in times of change depends on its ability to dynamically respond to changing circumstances, legislation, policy and risk,” says Halliday. “The breadth, scale and nature of the technology that underpins public service delivery provides both enormous opportunities and significant challenges,” he adds. In the context of the coronavirus crisis, cloud-based software as a service (SaaS) becomes crucial in ensuring demands for scalability and reduced cost, as well as simpler integration of digital services, automation, efficiency and improved interactions.  Between late 2019 and early 2020, government departments seemed more willing to adopt cloud SaaS offerings, according to Halliday.

How Remote Working Is Reshaping A Future New World Of Work

Corporate heads are speaking out more about their concerns for employee mental health as it relates to stress and anxiety, which is a shift for many business leaders. Joe Lallouz, CEO and Co-founder of technology platform Bison Trails, points out that people aren’t just choosing to work from home. They have to work remotely because of the global health crisis. And if you’re going to reduce people’s stress and anxiety about a shift in the way they work, it’s important to try to make them feel more comfortable, and a little empathy goes a long way: “The most important thing that CEOs and their leadership teams need to do is recognize that this can be very difficult for their teams. Exercising extra patience and empathy is probably the most important thing that anyone in a leadership position can do in an organization. Remember to give people the actual time it takes to adjust to these work style shifts . . . Arm your team the way you can by providing them with the information and resources they need, not just for their physical well-being, but also for their psychological and mental well-being.”

---

Quote for the day:

“Solitude matters, and for some people, it's the air they breathe” -- Susan Cain

---

Daily Tech Digest - May 04, 2020

7 Tips for Security Pros Patching in a Pandemic

Patch management has historically been a challenge for IT and security teams, which are under pressure to create strong programs and deploy fixes as they're released. Now their challenges are intensified as a global shift to remote work forces companies to rethink patching strategies. "It's a massive challenge all of a sudden," says Stephen Boyer, co-founder and CTO at BitSight. Businesses accustomed to protecting 2,000 employees across three to four offices now have to secure the same workers in 2,000 home offices. People are working on personal devices, with home routers they don't properly configure, on networks the corporation cannot manage. Data shows home networks pose a higher security risk than enterprise networks, he continues. BitSight research shows 45% of remote office networks have observed malware, compared with 13% of corporate networks. And more industries are enforcing work-from-home policies: 84% of traffic in the US education sector shifted off-network during the fourth week of March, data shows, along with 63% of government/policies sector traffic and 35% of finance sector traffic.

Why the Banking Industry Must Prove Its Worth During the COVID-19 Crisis

Moving forward, banks should continue their dedication towards their customers and British business in general through swift action and financial support that proves ongoing, selfless commitment to the economy and its people. This concerted effort requires adaptation from the financial services industry. The increased dependency on loans and support will inevitably have an overwhelming impact on the skeleton crew of bankers, who are themselves having to deal with the transition to remote working and unprecedented economic climate brought upon us by COVID-19. Fortunately, there is an abundance of automation and regulatory technology (regtech) at the banking sectors’ disposal. Recommendations from the Financial Action Task Force (FATF) and updated legislation from the Fifth Money Laundering Directive (5MLD), for example, has increasingly pushed banks towards using automation in recent years. 

How distributed cloud will affect data center infrastructures in 2020 and beyond

Due to the exponential increase of data-driven technologies--think artificial intelligence, the Internet of Things, and 5G--apps and data, along with their supporting infrastructure, are increasingly spread across edge sites and multiple clouds. These distributed workloads introduce several serious operational and security challenges for organizations. Specifically, IT teams are struggling to securely, reliably, and cost-effectively manage these workloads. What's more, these challenges will only continue to grow. By 2025, up to 90% of enterprise-generated data will be produced and processed outside traditional data centers or a single centralized cloud. The distributed cloud is an emerging approach that will enable organizations to manage disparate components of its enterprise IT infrastructure as one unified, logical cloud. As organizations can deploy apps with a common set of policies and overarching visibility across all locations and heterogeneous infrastructure, using a cloud-native model, the distributed cloud mitigates the aforementioned operational challenges. This is why Gartner named distributed cloud one of its "Top 10 Strategic Technology Trends for 2020."

Australia's COVIDSafe contact tracing story is full of holes and we should worry

The Brookings researchers detail flaws such as false positives leading people to ignore repeated alerts, when people are close but safely separated by walls, or using personal protective equipment (PPE). "Because most exposures flagged by the apps will not lead to infection, many users will be instructed to self-quarantine even when they have not been infected," they write. "A person may put up with this once or twice, but after a few false alarms and the ensuing inconvenience of protracted self-isolation, we expect many will start to disregard the warnings." False negatives are equally problematic. People might leave their phones in their car, or the app might just fail. And it's not like the 1.5 metres for 15 minutes rule is magic. Even the most fleeting encounter can be unlucky. As has also been pointed out, people might trust the magic of technology more than their own judgement, a phenomenon called automation bias. "Contact tracing apps therefore cannot offer assurance that going out is safe, just because no disease has been reported in the vicinity," the Bookings team writes.

Cisco Debunks Cybersecurity Myths

Cisco compared the types of attacks that SMBs and large enterprises reported experiencing in the past year, and how much downtime these attacks caused. Ransomware was most likely to cause more than 24 hours of downtime for SMBs, as well as for businesses with 1,000 or more employees. Malware, on the other hand, was at the bottom of the list for SMBs. “But yet, if you talk to a lot of the people in these companies, malware is the first thing they think about,” Goerlich said. “One thing is to look at the security efforts, both in terms of time and spend, and make sure they are aligned with the actual threats the business is facing to better allocate the budget and the efforts to provide better defense.” And while complex security environments and vendor fatigue is an area that plagues the entire industry, it appears that SMBs feel this pain more acutely than their larger counterparts. Cisco found the more vendors that SMB survey respondents used, the longer their reported downtime from their most sever breach. This ranged from an average of four hours of lost businesses time for SMBs using one vendor to an average of more than 17 hours downtime for those using more than 50 vendors.

NCSC tackles unconscious bias in security terminology

It is not uncommon within the security sector to use the terms black and white to describe undesirable and desirable things, such as allowed applications, passwords, IP addresses and so on. However, as the organisation’s head of advice and guidance pointed out, the terminology only makes sense if one equates white with good and black with bad. “There are some obvious problems with this. So, in the name of helping to stamp out racism in cyber security, we will avoid this casually pejorative wording on our website in the future,” they said. The NCSC said it took the decision after being contacted by a customer to ask if would consider making the change – which, while small, is highly significant, even though it may not appear to be. “You may not see why this matters. If you’re not adversely affected by racial stereotyping yourself, then please count yourself lucky. For some of your colleagues (and potential future colleagues), this really is a change worth making,” the organisation said.

Business During A Pandemic: Mitigating The Other (Cyber) Risks

Employees downloading tools to help them get around bottlenecks, work more efficiently or deal with applications they’re familiar with has long been a security problem in organizations. Shadow IT — software, apps and systems being used without the knowledge of an organization’s leaders or the information technology department — can take up a big chunk of a company’s IT spending and become the target of a lot of cyber exploits. And with COVID-19 forcing more remote work for enterprises and third-party vendors alike, companies must consider the impact shadow IT can have inside or on the periphery of their organization. To address the vulnerabilities created by shadow IT, visibility is the first step in combatting the problem. After identifying all of the systems and software in use, you can then determine which pose you risk and should be assessed. Third-party vendors well prepared to guard against this risk will have a clear governance plan and policy, along with a system for educating users about the risks of shadow IT. Companies can also collaborate with key third-party IT teams and establish an approved IT vendor list.

A Singleton Application with Interprocess Communication in C#

Sometimes you might have an application where it doesn't make sense to launch the main application twice, but you may want to run the app again passing additional command line parameters. This way you can run the app, it will open your program, and then you can run the app again, and pass additional command line information to the already running app. This is useful for example, when you want to get the existing app to open a new file from the command line. ... First, the app needs to detect if it's already running, and it will do different things depending on whether it is already running. Second, we need a way for two processes to communicate. In this case, the primary app will wait on command line data coming from subsequence launches. The first aspect is pretty easy. We use a named mutex in order to prevent the main app code from launching twice. Named mutexes can be seen by all running processes for this user. The second aspect is a little more difficult, but not by much, thankfully.

What Does AI and Test Automation Have in Common?

With the obvious rise in popularity and availability, grew the popular misconception that test automation can replace the human manual tester. That is, of course, total nonsense, there is still a high demand for test engineers and there will always be. However, the end of the software tester job is a frequently discussed topic that tends to draw a lot of readers. Another popular misconception is that test automation saves you time. Well, it was the initial goal, but what many companies fail to realize is that in most cases, before you can benefit from test automation you have to put in a huge amount of effort in implementation and eventually maintenance. ... Whether we like it or not AI is already here and it’s embedded in our lives more than you can even imagine. If you ever interacted with “Alexa” or “Siri”, received a recommendation for the next “Netflix” movie to watch, chances are you encountered AI in this form or another. Did you recently search anything via the world's most popular search engine? Then you must know that you will receive different results for the word “Java'' depending on whether you are a programmer or coffee-maker.

A Look at the Downsides of Artificial Intelligence

AI can be fantastic at triaging or automating processes up to 80-85% of “grunt-work” that would normally take 10x longer for humans to do, but that still leaves 15-20% of the work that requires subjective human oversight. This approach will avoid biased outcomes. “The disadvantages can be overcome if businesses approach AI as a technology that can be leveraged to help employees and not replace their functions, and [AI] needs to adapt to changes in the business workflows in an ongoing manner,” she said. ... All the problems with AI are not technology-based. There are also management issues too, according to Brett Gould CMO of Saint Louis, Miss.-based Intelligence Factory. Companies, he said, are putting themselves through digital transformations as a matter of survival and AI is proving to be pivotal in the success of many of these companies. Those who ignore it set themselves up to be disrupted by smaller, leaner, and more nimble players who have built their business model around AI/ML.

---

Quote for the day:

"Leaders live by choice, not by accident." -- Mark Gorman

---