Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - December 14, 2020

SDM and the DevOps Delusion of Connected Organizations

Looking across the enterprise, DevOps cultures fray further. A perfect DevOps practice envisions teams in different departments, business units and geographies all in sync, delivering value via software on a reliable cadence. In reality, enterprise DevOps is difficult to pull off because most organizations haven’t implemented shared languages, comment processes and best practices across all of their teams with management buy-in. ... Adopting an SDM strategy on top of an existing DevOps culture can help an organization in a number of ways. Having disconnected tools, disconnected data and a lack of common language make it difficult for one side of the organization to know what the other wants. Even in mature DevOps implementations, software delivery ends up being a patchwork of different processes for different teams. It’s also difficult to determine if our teams are delivering the right end product if there’s no shared visibility and insight. SDM helps by establishing common data and common processes, giving visibility and insights across teams of different maturities, different tools and different technologies so you get all functions to collaborate. That way you can be sure you’re not just deploying more—you’re actually delivering continuous value.

Legal Framework Around Blockchain Technology Applications

Firstly, blockchain transactions have no borders and hence, jurisdiction is a vexed issue. Where and how a dispute can be raised remains an unanswered question. Blockchain technology depends upon public and private keys allotted to users and their interface with the hash function. Transactions conducted through blockchains have a sense of permanence. Though verification and authentication is the fulcrum of this technology, there is no means of enforcing a transaction in a court of law. Mistakes cannot be corrected and hence, the jurisprudence under the Indian Contract Act, 1847 relating to mistake of fact or law is wholly alien to these transactions. How is one to be held to a promise made in an entry in a ledger? When does the promisor and the promisee relation get established? These are all questions for which answers would have to be found. What happens if a private key is misused or tampered with? Are there any legal remedies? One doesn't know. There is no central authority which monitors BT, however, recent adaptations of BT are being used by governmental authorities for verifying and authenticating ownership of moveable/immovable assets. What are the responsibilities of such an authority?

The year ahead in DevOps and agile: still some missing pieces to plug in

A big obstacle preventing the success of DevOps is quality control, Jainendra points out. "Teams are now able to move more quickly. However, error rates are not decreasing. For now, this can be more easily managed since so many of the changes are smaller and easier to revert. But as DevOps scales throughout the enterprise, this will add a layer of complexity to the process. Many organizations are still seeing quality issues in both their program and infrastructure code; maintaining low error rates is key for creating a successful DevOps practice by helping streamline larger releases." There has been more progress with agile, Jainendra believes. "There's been an increased interest in scaling agile methods by implementing broader agile management such as Scaled Agile Framework," he says. "Additionally, teams have benefited greatly from agile methodology and are seeing productivity boosts as a result of its ability to create a culture of efficiency. Even as everyone began to work remotely, we are still experiencing the same team collaboration benefits as we were before Covid-19." What lies ahead, he states, is a need for greater customization of agile efforts. "Organizations often fail to tailor their agile initiatives to their organizations. ..."

The Importance of Technology in the Strategic Design of Workplaces in the COVID-19 Era

One of the principal problems of the shift to working virtually is the feeling of personal disconnect. Working from home can lead to isolation. For companies, this means that successfully transmitting their mission and values can be a difficult task. The problem is exacerbated when you consider that corporate culture currently drives office design. Co-creation platforms allow us to carry out interactive activities with employees and receive feedback in real-time. We use gamification techniques to increase engagement and ensure employees take ownership of the office design project. These platforms and activities give us an understanding of the company culture; the unwritten rules that define the behavior of people in a group. This critical information helps companies build a more flexible culture that encourages continuous learning and lets interior design strategists design an office that transmits and reinforces its values. ... Designing, and above all, explaining online projects can be complex. We often find that it’s difficult for customers to understand detailed plans and schematics from behind a screen. With the integration of the BIM (Building Information Modeling) methodology and virtual reality technologies, designers can offer companies virtual tours of their future workspaces.

Are you ready for multicloud? A checklist

IT leaders know the complexities of setting up secure and robust cloud infrastructures. Naturally, these complexities multiply when you combine multiple clouds. You should strive to avoid dealing with them all at once. Operating across multiple clouds is complex because of the required governance, technical expertise, and integrations. As Sarbjeet Johal, an independent technology strategist, puts it, “Nobody gets up in the morning and says we are going to do multicloud today. They just fall into it, mainly due to organizational silos. Multicloud is as easy as 1-2-3... said no one ever!” Joanne Friedman, Ph.D. and CEO of Connektedminds, suggests that IT teams leverage their primary cloud provider wherever possible, rather than hunt for new or better capabilities in a second provider. ... Other IT leaders share pragmatic viewpoints on how multiclouds evolve and how to navigate initial complexities. Travis Campbell, a big data consultant, offers this insight into where the multicloud journey begins: Companies doing ‘multicloud’ but really treating it as a single cloud by each line of business are a special case here. For example, finance may have applications on cloud X, while engineering is deploying to cloud Y, and there’s no cross-pollination of work and data. It’s multicloud without hard problems.

Why JSON Isn't a Good Configuration Language

Compared to many other configuration languages, JSON is pretty noisy. There is a lot of punctuation that doesn't aid human readability, although it does make it easier to write implementations for machines. In particular, for configuration files, the keys in objects are almost always identifiers, so the quotation marks around the keys are redundant. Also, JSON requires curly braces around the entire document, which is part of what makes it an (almost) subset of JavaScript and helps delimit different objects when multiple objects are sent over a stream. But, for a configuration file, the outermost braces are just useless clutter. The commas between key-value pairs are also mostly unnecessary in config files. Generally, you will have a single key-value pair per line, so it would make sense to accept a newline as a delimiter. Speaking of commas, JSON doesn't accept trailing commas. If you need commas after each pair, it should at least accept trailing commas, since trailing commas make adding new entries to the end easier and lead to cleaner commit diffs. Another problem with JSON as a configuration format is it doesn't have any support for multi-line strings.

A tech reboot of retail

Looking at the global figures, Michael O’Grady, principal forecast analyst at Forrester, says: “Retail categories like grocery and essential consumables are performing well, while other categories like fashion, beauty and cosmetics are seeing a marked decline in consumer spend.”Predictably, the coronavirus lockdowns have benefited e-commerce. ... “It’s really important to understand what people are wearing,” says Capgemini’s Peplow. Image analysis on social media may be among the approaches fashion retailers will need to use to remain relevant to high street shoppers. Clearly, operating seamlessly across multiple channels will become a key line of defence for bricks-and-mortar retailers to compete with internet retailers. But while online shopping is convenient and may well offer an item at the cheapest price, in-store shopping is more than just transactional. There is strong evidence that high street retailing needs to become more experiential, such as the way Natuzzi is using mixed reality in its showroom. And while the idea of stores “3D printing” products may seem far-fetched, Decathlon’s use of the technology shows there are niches where it works extremely well.

Startups Should Do Things That Don't Scale, but Security Isn't One of Them

Startups are especially attractive targets to hackers due to a combination of limited resources and the proliferation of business models that revolve around collecting customer data. In fact, research shows over 67% of companies with under 1,000 workers have experienced a cyberattack, and 59% were successfully breached. Investing in scalable security is a startup's best hope at defending against an attack that statistics say it should expect. Lack of scalability in security detracts from efficiency and opens gaps in a startup's networks. It forces IT to preoccupy itself with the endless application of security to new resources and users rather than with optimizing or monitoring. In these cases, companies are often too busy working in the trenches to notice they've been hacked until it's far too late. It's not all bad news, however. Security is no longer a zero-sum game. It has been commoditized into various products in recent years, allowing young companies to balance its risks and rewards by scaling in pieces that won't become obsolete or demand too much attention from IT. Security processes like encryption, firewalls, and authorized access once required hardware and lots of work to operate at scale.

Hacked: US Commerce and Treasury Departments

Reuters first reported the incidents, with The Washington Post suggesting that a Russian hacking group known as Cozy Bear, aka APT29, is the source. The Post reported last week that the same group was behind an attack against cybersecurity firm FireEye. In an update late Sunday, FireEye warned that starting around March and continuing through May, software updates for SolarWinds' Orion product had been subverted with backdoors, which it has dubbed "Sunburst." The malicious software updates were signed using valid digital signatures, and could steal files, profile systems and disable system services, it says. FireEye warns that "the actors behind this campaign gained access to numerous public and private organizations around the world." "We can confirm there has been a breach in one of our bureaus," the Commerce Department says in a statement. "We have asked CISA and the FBI to investigate, and we cannot comment further at this time." The U.S. Cybersecurity and Infrastructure Agency, or CISA, on Sunday issued an emergency directive "in response to a known or reasonably suspected information security threat," noting that the affected Orion products are versions are 2019.4 through 2020.2.1 HF1.

Moving from Agile Teams towards an Agile Organization

It is not unusual to see different levels across the organization of a large program talking in different terms. This is normal and expected. The level of detail that senior management has to deal with cannot be the same as that of the engineers modifying the cloud infrastructure of the deployment pipeline. However, when talking about progress, if we have some talking about epics, others about features, implementation teams discussing stories, and others working on tasks, it shouldn’t be surprising that nobody really knows what the actual progress is. In the same way that it is important to agree on the moment in which progress is measured (e.g. when deploying in production, or when there is a certain change in some indicator), it is also important to agree on the unit of measurement to be used. Then we have a common unit of progress that is atomic. And by making this progress clearly visible, we raise the overall awareness. This results in a velocity increase that can be potentiated by other elements of the context. From a systemic point of view, everything matters. Not only are all elements important, but the relationships between them are especially meaningful. It is like those images we used to draw when we were kids, connecting the dots to see the figure hidden in between.

Quote for the day:

"You can discover what your enemy fears most by observing the means they use to frighten you." -- Eric Hoffer

Daily Tech Digest - December 13, 2020

Different Normalization Layers in Deep Learning

Deep learning certainly involves training carefully designed deep neural networks and various design decisions impact the training regime of these deep networks. Some of these design decisions include Type of network layer to use such as convolution layer, linear layer, recurrent layer, etc. in the network, and how many layers deep should our network be? What kind of normalization layer we should use if at all? What should be the correct loss function to optimize for? Majorly these design decisions depend upon the underlying task we are trying to solve and require a deeper understanding of the different options we have at hand. In this post, I will focus on the second point “different Normalization Layers in Deep Learning”. Broadly I would cover the following methods. ... One important thing to note is, in practice the normalization layers are used in between the Linear/Conv/RNN layer and the ReLU non-linearity(or hyperbolic tangent etc) so that when the activations reach the Non-linear activation function, the activations are equally centered around zero. This would potentially avoid the dead neurons which never get activated due to wrong random initialization and hence can improve training.

Financial Fraud Through the Lens of Cybersecurity

Certain web sites require the user to enter a security question and an answer for it. The list of questions is standard, and one of them usually is – “What is your mother’s maiden name?”. This form of knowledge-based authentication is one of the most important aspects of conducting successful transactions online for high-value products, as most banks ask this as a security question for making any changes to the account. ... Credit card dumps are used by fraudsters to capture valuable card data such as the card number and expiration date. These can be obtained in a number of ways. The most popular method nowadays is the “skimming”, a process in which an illegal card reader is used to copy the data from a Credit Card. Other methods include hacking into a retailer’s network or when unknown to the retailer, a malware-infected point-of-sale device sends information to cybercriminals.... Bank Identification Number is the first six numbers that appear on a Credit Card, and it uniquely identifies the institution issuing the card. The BIN is key in the process of matching transactions to the issuer of the charge card. This numbering system also applies to charge cards, gift cards, prepaid cards and even electronic benefit cards.

New ransomware campaign exploits weak MySQL credentials to lock thousands of databases

Interestingly, the operators do not appear to be utilizing any actual ransomware payload in their attacks. It begins by brute forcing weak password protocols for MySQL databases, followed by collection of data on existing tables and users before installing a hidden backdoor on the way out to facilitate future break-ins. “By the end of execution, the victim’s data is gone – it’s archived in a zipped file which is sent to the attackers’ servers and then deleted from the database,” write authors Ophir Harpaz and Omri Marom. Guardicore Labs also spotted two distinct versions of this campaign. The first, between January and November 2020, composed roughly two-thirds of observed attacks and involved leaving a ransom note with a Bitcoin wallet address, a ransom demand, an email address for technical support and a 10-day deadline for payment. However, in leaving those breadcrumbs, the operators made it possible for researchers to poke around their Bitcoin wallet and examine how much money had been transferred to it. Ultimately, they traced nearly $25,000 in payments from four separate IP addresses.

Using OPA for multicloud policy and process portability

Multicloud also presents a second alluring possibility, an extension of that original cloud-native logic: the ability to abstract cloud computing architectures so they can port automatically and seamlessly (if not just quickly) between cloud providers to maximize performance, availability, and cost savings—or at least maintain uptime if one cloud vendor happens to goes down. Cloud-agnostic platforms like Kubernetes, which run the same in any environment—whether that’s AWS, GCP, Azure, private cloud, or wherever—offer a tantalizing glimpse of how companies could achieve this kind of multicloud portability. But while elegant in theory, multicloud portability is complicated in practice. Dependencies like vendor-specific features, APIs, and difficult-to-port data lakes make true application and workload portability a complicated journey. In practice, multicloud portability only really works—and works well—when organizations achieve consistency across cloud environments. For that, businesses need a level of policy abstraction that works across said vendors, clouds, APIs, and so on—enabling them to easily port skills, people, and processes across the cloud-native business. While individual applications may not always port seamlessly between clouds, the organization’s overall approach should.

How COVID-19 impacted the relationship between the enterprise and its employees

Most organizations understood the innate value of employee well-being, which is defined in the report by a five-point system of indicators, all of these at work: Feeling calm, feeling energized, rarely feeling overwhelmed by responsibilities, feeling positive about yourself, and having trusting relationships Employee well-being remains critical as organizations continue to recover from this time of disruption, said Lauren Rice, XM scientist, Qualtrics, also in the report. "Whether it's providing flexibility to employees as they juggle work and personal responsibilities, supporting employees as they attend to any family health concerns, or just taking the time to listen to employees' concerns, it's a necessity at this time for organizations to care and support employees' well-being. When organizations care for their employees, the employees will in turn show care and dedication to their work and the organization." ... There's a great disparity between employers and their staff, according to the report, regarding acting on feedback: 92% of employees believe it's important the company listen to feedback, but admit that only 7% of employees say their company does so.

Big data is just a crutch for unimaginative marketers to lean on

The first problem seems to be the quality and the processes used in data storage. We like to celebrate how much we have, but data normally comes from separate systems, measured in different ways, stored in different places. Most CTOs will embarrassingly admit they have too much data these days, not too little. They find the data dirty, contradictory and in systems that won’t mesh. If companies know that much about everything, why are we sent credit card offers for credit cards we already have? Why is my bank offering me cheap loans and pitching me funds to invest in at the same time? ... Big data has the temptation of making the complex seem simple. It may think I like certain movies, when in fact I like certain movies at certain times or in certain situations. The crap I watch after a beer on a plane ruins any algorithm’s chances, let alone an Airbnb guest using my TV. We endlessly refer to “data-driven” insights when I’ve only ever seen facts, not insights, from data. Insights are found by observation and, where needed, supported by data. No spreadsheet ever revealed anything as beautiful and transformational as an insight.

Remote working is starting to show tears. But going back to office isn’t only solution

The remote work experiment seemed to offer an initial boost in productivity. But sustaining such productivity has been difficult, in part because the home wasn’t designed for work and the consequences of “Zoom” fatigue are real. Indeed, emerging evidence suggests burnout is plaguing remote workers across the board. Yet managing employee burnout is particularly difficult during a pandemic, when people are asked to mostly isolate at home, away from colleagues whose mere presence can often ease work-related stress. ... What’s worse, corporate policies meant to monitor and control employee behavior – whether while they work remotely or as means to make the office safer – risk eroding worker trust and undermining cultural norms. And the impact of these policies will likely endure long after the crisis subsides ... A third major cost of this sustained remote period of work is the lack of collaboration and its disruptive impact on innovation. Sure, some collaborations and idea generation can take place via Zoom meetings, but innovation still largely happens in physical spaces: at lab benches, alongside a 3D printer or in unintended office interactions that spark interdisciplinary collaborations.

Effective Use of Blockchain in the Legal Sector – A near future or a distant possibility?

Times changed and so did the use of technology in the legal sector. Although, there is no doubt that technology in the legal sector has improved efficiency, reduced errors and has further demystified the operations of the court system, but the growth has been slow. Perhaps, because the traditional legal system is a relic of the past, which while adjusting itself to the modern world technology is still, metaphysically, attached to its ancient and archaic roots. The present-day legal system, which has been slow in keeping up with the changes in technology, has for the very first time attempted to digitise itself overnight during these unprecedented pandemic times. Virtual court hearings and paperless filings, even with certain limitations, has been welcomed by the legal sector. The credit for the digitisation of courts should be given to the Supreme Court’s e-committee headed by Hon’ble Justice DY Chandrachud. The e-committee by swiftly implementing a contingency plan has enabled our courts to continue operating even during this pandemic thus helping thousands to get justice. However, the growth should not stop here and this opportunity should also be fully utilised to explore other technological innovations which can be imbibed and integrated into the prevalent legal tech.

Researchers warn of security vulnerabilities in these widely used point-of-sale terminals

Attackers could gain access to the devices to manipulate them in one of two ways. Either they're able to physically gain access to the PoS terminal, or they're able to remotely gain access via the internet and then execute arbitrary code, buffer overflows and other common techniques which can provide attackers with an escalation of privileges and the ability to control the device – and see and steal the data that goes through it. Remote access is possible if an attacker to gains access to the network via phishing or another attack and then move freely around the network to the PoS terminal. Ultimately, the PoS machine is a computer and if it's connected to the network and the internet, then attackers can attempt to gain access to and manipulate it like any other insecure machine. The way the PoS terminal communicates with the rest of the network means attackers could access unencrypted data card data including Track2 and PIN information, providing all the necessary information required to steal and clone payment cards. In order to protect against attacks exploiting PoS vulnerabilities, it's recommended that retailers using the devices ensure they're patched and up to date and they should avoid using default passwords where possible.

The Right Data Governance for Your Organization’s Culture

The first step is to observe. Places to look for indications of core culture are in the mission statement, in vision documents, and posters put up by the Human Resources department. Since culture is driven at the leadership level, observe what leadership values and rewards. In a more formal process, surveys of staff and leadership, past and present, can provide knowledge useful for determining the company culture. Recognize that culture clash is a possibility with mergers and acquisitions. In those situations, “Make sure that you have those conversations at your executive level because you can’t really drive that through your Data Governance programs,” Levins said. ... Although most companies have a predominant core culture, and there are often subcultures within that culture, Levins said, but for the purpose of the presentation, they would be focusing on the core culture for the organization as a whole. Each culture has strengths and pitfalls. Elder noted, “The things that we love about our partner also drive us crazy sometimes.” ... Cultivative culture is focused on people and possibility, said Elder. “How can we make the future better? How can we make people better?”

Quote for the day:

"Added pressure and responsibility should not change one's leadership style, it should merely expose that which already exists." -- Mark W. Boyer

Daily Tech Digest - December 12, 2020

E-commerce innovation in 2021 will look like what was projected for 2025

According to McKinsey, over 75% of U.S. consumers have changed shopping behavior and changed to new brands during the COVID-19 pandemic. The top three reasons for shopping for a new brand were value, availability and convenience. The most important filter for discretionary spend is safety. The ability to offer e-commerce, contact-less payments, order online curbside pickup, and home delivery are all requirements in order to compete in the next normal. Salesforce research shows that U.S. retailers offering creative pickup options experienced 29% growth in sales compared to 22% in retailers who had a simple fulfillment option. ... Over the past 5 years we have seen growing investment in social channels as advertising vehicles. In 2021, we will see brands take a step further, adopting commerce capabilities provided by these social platforms. We also anticipate expanding relationships with brands and social influencers as a accelerant to grow sales. This shift will also challenge brands to re-think the traditional definitions of "omni-channel", expanding the definition to include the ability to identify customers, at any location, and the ability to deliver and service their need, independent of time or location, based on the customer's method of delivery.

Create a DevOps culture with open source principles

We can split remote work into fully remote and hybrid working models. A fully remote working model means a DevOps team is geographically dispersed. The members have no desk lying empty back at the office with their name on it. However, COVID-19 restrictions have made every team a fully remote team, at least for the time being. A fully remote team’s benefits include increased agility and playing time zones to the advantage of your delivery cycle. The challenges of a new remote DevOps team run the gamut right now, depending on the level of support their organization had for remote workers pre-COVID. In contrast, a hybrid DevOps team still maintains a presence in a corporate office. Core team members may have permanent seats inside a corporate office. Other team members may work from home or a satellite office full-time or part-time. COVID-19 restrictions add a new factor to hybrid teams because some companies may stagger returns to offices. A hybrid DevOps team’s benefits include having the best of both worlds. Team leadership can still maintain a face in the office. Their developers get the option to work where they’re the most productive. The challenges of a hybrid DevOps team can range from communications to system access issues.

Understand the IoT Cybersecurity Improvement Act, now law

"Ultimately, the government wants to put together a strategy on how to address IoT devices and what those specific security baseline requirements should be," said Donald Schleede, information security officer at Digi International. To start, the law requires NIST to develop minimum security standards for connected devices that the federal government purchases or uses. It also has the agency develop standards and guidelines for the use and management of all IoT devices that the government owns or uses. It further requires NIST to address secure development, identity management, patching and configuration management as part of its security standards. It prohibits federal entities from buying or using any IoT device determined to be noncompliant with the NIST standards. The legislation requires the Department of Homeland Security to review such measures every five years to determine any necessary revisions. This ensures the federal requirements for connected devices remain current as technology, standards and attack scenarios evolve. The federal law provides more-specific IoT security standards for connected devices than past industry-led attempts and legislative measures have, Schleede said.

New ways Google Workspace works with tools you already use

Creating and collaborating on content is at the heart of getting work done. When working with content received from customers, partners, or teammates, employees shouldn’t lose time converting files or working in unfamiliar tools. With Google Drive, you can store and share over 100 different file types and formats, including Microsoft Word, Excel, and PowerPoint files, as well as PDFs, images, and videos. And by using intelligent features like Priority and Quick Access in Drive, you can find files nearly 50% faster. With Office editing, users can also easily edit Microsoft Office files in Google Docs, Sheets, and Slides without converting them, with the added benefit of layering on Google Workspace’s enhanced collaborative and assistive features. From assigning action items via comment, to writing faster with Smart Compose, to accelerating data entry with Sheets Smart Fill, Office editing brings Google Workspace functionality to your Office files. And we recently extended Office editing to the Docs, Sheets, and Slides mobile apps as well, so you can easily work on Office files on the go. Starting today, you can also open Office files for editing directly from a Gmail attachment, further simplifying your workflows.

‘Smellicopter’ uses a live moth antenna to hunt for scents

“From a robotics perspective, this is genius,” says coauthor and co-advisor Sawyer Fuller, assistant professor of mechanical engineering. “The classic approach in robotics is to add more sensors, and maybe build a fancy algorithm or use machine learning to estimate wind direction. It turns out, all you need is to add a fin.” Smellicopter doesn’t need any help from the researchers to search for odors. The team created a “cast and surge” protocol for the drone that mimics how moths search for smells. Smellicopter begins its search by moving to the left for a specific distance. If nothing passes a specific smell threshold, Smellicopter then moves to the right for the same distance. Once it detects an odor, it changes its flying pattern to surge toward it. Smellicopter can also avoid obstacles with the help of four infrared sensors that let it measure what’s around it 10 times each second. When something comes within about eight inches (20 centimeters) of the drone, it changes direction by going to the next stage of its cast-and-surge protocol. “So if Smellicopter was casting left and now there’s an obstacle on the left, it’ll switch to casting right,” Anderson says.

Tiny four-bit computers are now all you need to train AI

So what does 4-bit training mean? Well, to start, we have a 4-bit computer, and thus 4 bits of complexity. One way to think about this: every single number we use during the training process has to be one of 16 whole numbers between -8 and 7, because these are the only numbers our computer can represent. That goes for the data points we feed into the neural network, the numbers we use to represent the neural network, and the intermediate numbers we need to store during training. So how do we do this? Let’s first think about the training data. Imagine it’s a whole bunch of black-and-white images. Step one: we need to convert those images into numbers, so the computer can understand them. We do this by representing each pixel in terms of its grayscale value—0 for black, 1 for white, and the decimals between for the shades of gray. Our image is now a list of numbers ranging from 0 to 1. But in 4-bit land, we need it to range from -8 to 7. The trick here is to linearly scale our list of numbers, so 0 becomes -8 and 1 becomes 7, and the decimals map to the integers in the middle.

How can the cloud industry adapt to a post-COVID world?

Technology will play a major part in instigating the changes needed in future, with a key role to play for many of the firms that have enjoyed success during the pandemic. While demand for software such as video conferencing platforms may not be as sky-high as it was at the beginning of the pandemic, Wrenn argues the next big step is how cloud companies can eat further into the market share enjoyed by the traditional telephone industry. “More and more businesses are using Microsoft Teams or Zoom to interact,” he explains, “when previously they would have used conference lines or even called a person directly due to it being more convenient. Cloud providers need to think about how they can make the most of this opportunity as the way in which people interact changes.” To some extent, we should all consider ourselves lucky the global pandemic happened when it did, given that cloud computing has only in recent recently become as advanced as it is now. Thus, rather than ‘profiting from the pandemic’, this period has been the making of the industry. After all, “cloud storage, processing, and compute facilities are already set up, and ready to expand easily and automatically, as and when enterprises need,” according to Royston, who claims this wouldn’t have been the case ten to 15 years go.

Feds: K-12 Cyberattacks Dramatically on the Rise

“Unfortunately, K-12 education institutions are continuously bombarded with ransomware attacks, as cybercriminals are aware they are easy targets because of limited funding and resources,” said James McQuiggan, security awareness advocate at KnowBe4, via email. “The U.S. government is aware of the growing need to protect the schools and has put forth efforts to provide the proper tools for education institutions. A bill has been introduced called the K-12 Cybersecurity Act of 2019, which unfortunately has not been passed yet. This type of action by the government will start the process of protecting school districts from ransomware attacks.” Meanwhile, other malware types are being used in attacks on schools – with ZeuS and Shlayer the most prevalent. ZeuS is a banking trojan targeting Microsoft Windows that’s been around since 2007, while Shlayer is a trojan downloader and dropper for MacOS malware. These are primarily distributed through malicious websites, hijacked domains and malicious advertising posing as a fake Adobe Flash updater, the agencies warned. Social engineering in general is on the rise in the edtech sector, they added, against students, parents, faculty, IT personnel or other individuals involved in distance learning.

What Is A Security Operations Center? Why Is It Important?

The Security Operations Center is an integrated unit dealing with high-quality IT security operations. The primary of a Security Operations Center are to monitor, prevent, detect, investigate, and respond to various cyber threats. SOC teams monitor and protect an organization’s assets like intellectual property, personnel data, business systems, and brand integrity. The SOC team plays an important role in organizations by defending them against incidents and intrusions — regardless of source, time, or the type of attack — through their 24/7 monitoring. ... An increase in the usage of cloud-based solutions across SMEs is the crucial factor driving demand in the global SOC-as-a-Service. The adoption of systems like machine learning, artificial intelligence, and blockchain technologies for cyber defense has further opened new growth avenues in this market. There is an increased demand for Security Operations Center analysts across North America, Europe, the Middle East, Africa, Asia Pacific, and Latin America. Out of these, North America holds a dominant share in this market.

Australian intelligence community seeking to build a top-secret cloud

The project does not involve agencies collecting any new data. Nor does it expand their remit. All existing regulatory arrangements still apply. Rather, the NIC hopes that a community cloud will improve its ability to analyse data and detect threats, as well as improve collaboration and data sharing. "Top Secret" is the highest level in Australia's Protective Security Policy Framework. It represents material which, if released, would have "catastrophic business impact" or cause "exceptionally grave damage to the national interest, organisations or individuals". Until very recently the only major cloud vendor to handle top secret data, at least to the equivalent standards of the US government, was Amazon Web Services (AWS). AWS in 2017 went live with an AWS Secret Region targeted towards the US intelligence community, including the CIA, and other government agencies working with secret-level datasets. In Australia, AWS was certified to the protected level, two classification levels down from top secret. The "protected" certification came via the ASD's Certified Cloud Services List (CCSL), which was in June shuttered, leaving certifications gained through the CCSL process void.

Quote for the day:

"Leadership is liberating people to do what is required of them in the most effective and humane way possible." -- Max DePree

Daily Tech Digest - December 11, 2020

5 signs your agile development process must change

Agile teams figure out fairly quickly that polluting a backlog with every idea, request, or technical issue makes it difficult for the product owner, scrum master, and team to work efficiently. If teams maintain a large backlog in their agile tools, they should use labels or tags to filter the near-term versus longer-term priorities. An even greater challenge is when teams adopt just-in-time planning and prioritize, write, review, and estimate user stories during the leading days to sprint start. It’s far more difficult to develop a shared understanding of the requirements under time pressure. Teams are less likely to consider architecture, operations, technical standards, and other best practices when there isn’t sufficient time dedicated to planning. What’s worse is that it’s hard to accommodate downstream business processes, such as training and change management if business stakeholders don’t know the target deliverables or medium-term roadmap. There are several best practices to plan backlogs, including continuous agile planning, Program Implement planning, and other quarterly planning practices. These practices help multiple agile teams brainstorm epics, break down features, confirm dependencies, and prioritize user story writing.

How to Align DevOps with Your PaaS Strategy

Some organizations are adopting a multi-PaaS strategy which typically takes the form of developing an application on one PaaS and deploying it to multiple public clouds. However, not all PaaS provide that capability. One reason to deploy to multiple clouds is increase application reliability. Despite SLAs, outages may occur from time to time. Alternatively, different applications may require the use of different PaaS because the PaaS services vary from vendor to vendor. However, more vendors mean more complexity to manage. "Tomorrow, your business transaction is going to be going over SaaS services provided by multiple vendors so I might have to orchestrate across multiple clouds, multiple vendors to complete my business transaction," said Chennapragada. "Tying myself [to] a vendor is going to constrain me from orchestrating, so our clients are thinking of a more cloud-agnostic, vendor-agnostic solution." One of the general concerns some organizations have is whether they have the expertise to manage everything themselves, which has led to a huge proliferation of managed service providers. That way, DevOps teams have more time to focus on product development and delivery. PaaS expertise can be difficult to find because PaaS skills are niche skills.

Low Code: CIOs Talk Challenges and Potential

CIO viewpoints honestly differed. For example, CIO Milos Topic suggests “it is still early in experimentation in our environment, but it is mostly useful in automating and provisioning repetitive processes and modules. But it is essential to stress that low code doesn't mean hands off.” Meanwhile, CIO David Seidl says “the adoption is big because of the ability to make more responsive changes. The trade-off is interesting. The open question is: can you remove one of the cost layers (maintaining code) and trade it for business logic and platform maintenance? And how do you minimize platform maintenance and could cloud services help. The big question is: do we consider business logic code? It can be just as complex to build and debug complex business logic in a drag and drop as traditional code. So, you win on the UI/layout/integration components, but core code remains an open question.” However, CIO Deb Gildersleeve suggests that low code gives business users without technical coding expertise the tools to solve their problems. It takes the burden outside of IT but can be provided with guardrails for security governance.”

Security Think Tank: Integration between SIEM/SOAR is critical

Security operations teams will have a playbook which details the decisions and actions to be taken from detection to containment. This may suggest actions to be taken on detection of a suspicious event through escalation and possible responses. SOAR can automate this, taking autonomous decisions that support the investigation, drawing in threat intelligence and presenting the results to the analyst with recommendations for further action. The analyst can then select the appropriate action, which would be carried out automatically, or the whole process can be automated. For example, the detection of a possible command and control transmission could be followed up in accordance with the playbook to gather relevant threat intelligence and information on which hosts are involved and other related transmissions. The analyst would then be notified and given the option to block the transmissions and isolate the hosts involved. Once selected, the actions would be carried out automatically. Throughout the process, ticketing and collaboration tools would keep the team and relevant stakeholders informed and generate reports as required.

Low-Code To Become Commonplace in 2021

The citizen developer concept has been gathering marketing steam, but it might not be just hype. Now, data suggests low-code tools are actually opening doors for such non-developers. Seventy percent of companies said non-developers in their company already build tools for internal business use, and nearly 80% predict to see more of this trend in 2021. It should be noted that low-code and no-code do not seek to replace all engineering talent; instead, to free them up to engage in more complex tasks. “With low-code, you free up your engineers to work on harder problems, instead of having them work on basic things,” said Arisa Amano, CEO of Internal. She believes this could translate into more innovation companywide. Surprisingly, bringing non-traditional engineers into the development fold is not being met with ambivalence—69.2% of respondents foresee that citizen developers positively affect engineering teams, with the rest primarily exhibiting a neutral reaction. The costs of internal security threats are high. Breaches could decrease customer trust, harm brand reputation and lead to escalating legal fees. With cyberattacks a prevalent concern, cybersecurity must come back in style.

People want data privacy but don’t always know what they’re getting

In practice, differential privacy isn’t perfect. The randomization process must be calibrated carefully. Too much randomness will make the summary statistics inaccurate. Too little will leave people vulnerable to being identified. Also, if the randomization takes place after everyone’s unaltered data has been collected, as is common in some versions of differential privacy, hackers may still be able to get at the original data. When differential privacy was developed in 2006, it was mostly regarded as a theoretically interesting tool. In 2014, Google became the first company to start publicly using differential privacy for data collection. Since then, new systems using differential privacy have been deployed by Microsoft, Google and the U.S. Census Bureau. Apple uses it to power machine learning algorithms without needing to see your data, and Uber turned to it to make sure their internal data analysts can’t abuse their power. Differential privacy is often hailed as the solution to the online advertising industry’s privacy issues by allowing advertisers to learn how people respond to their ads without tracking individuals. But it’s not clear that people who are weighing whether to share their data have clear expectations about, or understand, differential privacy.

Widespread malware campaign seeks to silently inject ads into search results

The malware makes changes to certain browser extensions. On Google Chrome, the malware typically modifies “Chrome Media Router”, one of the browser’s default extensions, but we have seen it use different extensions. Each extension on Chromium-based browsers has a unique 32-character ID that users can use to locate the extension on machines or on the Chrome Web store. On Microsoft Edge and Yandex Browser, it uses IDs of legitimate extensions, such as “Radioplayer” to masquerade as legitimate. As it is rare for most of these extensions to be already installed on devices, it creates a new folder with this extension ID and stores malicious components in this folder. On Firefox, it appends a folder with a Globally Unique Identifier (GUID) to the browser extension. ... Despite targeting different extensions on each browser, the malware adds the same malicious scripts to these extensions. In some cases, the malware modifies the default extension by adding seven JavaScript files and one manifest.json file to the target extension’s file path. In other cases, it creates a new folder with the same malicious components. These malicious scripts connect to the attacker’s server to fetch additional scripts, which are responsible for injecting advertisements into search results.

Penetration Testing: A Road Map for Improving Outcomes

Traditional penetration testing is a core element of many organizations' cybersecurity efforts because it provides a reliable measurement of the organization's security and defense measures. However, because a client can classify assets as out of scope, the pen test may not give an accurate read on the organization's full security posture. Because the pen-testing approach, authorization process, and testing ranges are defined in advance, these assessments may not measure an organization's true ability to identify and act on suspicious activities and traffic. Ultimately, placing restrictions on a test's scope or duration can harm the tested organization. In the real world, neither time nor scope are of any consideration to attackers, meaning the results of such a test are not entirely reliable. Incorporating objective-oriented penetration testing can improve typical pen-testing systems and, in turn, enhance an organization's security posture and incident response, as well as limit their risk of exposure. The first step is to agree on attackers' likely objectives and a reasonable time frame. For example, consider ways attackers could access and compromise customer data or gain access to a high-security network or physical location.

Facial recognition's fate could be decided in 2021

Several lawsuits filed in 2020 that could see resolution next year may also have an impact on facial recognition. Clearview AI is facing multiple lawsuits about its data collection. The company collected billions of public images from social networks including YouTube, Facebook and Twitter. All of those companies have sent a cease-and-desist letter to Clearview AI, but the company maintains that it has a First Amendment right to take these images. That argument is being challenged by Vermont's attorney general, the American Civil Liberties Union and two lawsuits in Illinois. Clearview AI didn't respond to requests for comment. The Clearview decision could play a role in facial recognition's future. The industry relies on hordes of images of people, which it gets in many ways. An NBC News report in 2019 called it a "dirty little secret" that millions of photos online have been getting collected without people's permission to train facial recognition algorithms. "We're likely to also see growing amounts of litigation against schools, businesses and other public accommodations under a new wave of biometric privacy laws, including New York City's forthcoming ban on commercial biometric surveillance," said the Surveillance Technology Oversight Project's Cahn.

Hacking Group Dropping Malware Via Facebook, Cloud Services

While the newly discovered DropBook backdoor uses fake Facebook accounts for its command-and-control operations, the report notes that both SharpStage and DropBook utilize Dropbox to exfiltrate the data stolen from their targets, as well as for storing espionage tools, according to the report. Once a device is compromised, the SharpStage backdoor can capture screenshots, check for Arabic language presence in the victims' device for precision targeting and download and execute additional components. DropBook, on the other hand, is used for reconnaissance and to deploy shell commands, the report notes. The attackers use MoleNet to collect system information from the compromised devices, communicate with the command-and-control servers and maintain persistence, according to the report. Besides the new backdoor components, researchers note the hackers deployed an open-source remote access Trojan called Quasar, which was previously linked to a Molerats campaign in 2017. Cybereason researchers note that once the DropBook malware is in the victims' devices, it begins its operation by fetching a token from a post on a fake Facebook account.

Quote for the day:

"Example has more followers than reason. We unconsciously imitate what pleases us, and approximate to the characters we most admire." -- Christian Nestell Bovee

Daily Tech Digest - December 10, 2020

Hackers hide web skimmer inside a website's CSS files

Places where web skimmers have been found in the past include inside images such as those used for site logos, favicons, and social media networks; appended to popular JavaScript libraries like jQuery, Modernizr, and Google Tag Manager; or hidden inside site widgets like live chat windows. The latest of these odd places is, believe it or not, CSS files. Standing for cascading style sheets, CSS files are used inside browsers to load rules for stylizing a web page's elements with the help of the CSS language. These files usually contain code describing the colors of various page elements, the size of the text, padding between various elements, font settings, and more. However, CSS is not what it was in the early 2000s. Over the past decade, the CSS language has grown into an incredibly powerful utility that web developers are now using to create powerful animations with little to no JavaScript. One of the recent additions to the CSS language was a feature that would allow it to load and run JavaScript code from within a CSS rule. Willem de Groot, the founder of Dutch security firm Sanguine Security (SanSec), told ZDNet today that this CSS feature is now being abused by web skimmer gangs.

The Line Between Physical Security & Cybersecurity Blurs as World Gets More Digital

For manufacturers, the importance of forcing users to change default credentials before first use has never been higher. The Mirai botnet, one of the most well-known and successful pieces of malware in history, infected millions of connected devices across the globe by exploiting common default username/password combinations. While manufacturers have been aware of the importance of changing default passwords, we are now seeing mechanisms being put in place to ensure a device doesn't function until the password is changed. Going even further, some states, including California, have reinforced that knowledge with legislation mandating their use. Similarly, integrators must be able to keep devices protected during and after the installation process, avoiding the sort of misconfigurations that cyberattackers are known to exploit. IT departments and users themselves also bear a degree of responsibility when it comes to securing their devices by installing product updates and patches in a timely manner. Organizations must ensure that their employees understand the importance of protecting every device on the network, while also effectively vetting the security knowledge and capabilities of both their manufacturer and integrator partners.

5 big and powerful Python web frameworks

At its core, CubicWeb provides basic scaffolding used by every web app: a “repository” for data connections and storage; a “web engine” for basic HTTP request/response and CRUD actions; and a schema for modeling data. All of this is described in Python class definitions. To set up and manage instances of CubicWeb, you work with a command-line tool similar to the one used for Django. A built-in templating system lets you programmatically generate HTML output. You can also use a cube that provides tools for web UIs, such as that for the Bootstrap HTML framework. Although CubicWeb supports Python 3 (since version 3.23), it does not appear to use Python 3’s native async functionality. ... Django has sane and safe defaults that help shield your web application from attack. When you place a variable in a page template, such as a string with HTML or JavaScript, the contents are not rendered literally unless you explicitly designate the instance of the variable as safe. This by itself eliminates many common cross-site scripting issues. If you want to perform form validation, you can use everything from simple CSRF protection to full-blown field-by-field validation mechanisms that return detailed error feedback.

Myth vs. reality: a practical perspective on quantum computing

Developers and researchers want to ensure they invest in languages and tools that will adapt to the capabilities of more powerful quantum systems in the future. Microsoft’s open-source Quantum Intermediate Representation (QIR) and the Q# programming language provide developers with a flexible foundation that protects their development investments. QIR is a new Microsoft-developed intermediate representation for quantum programs that is hardware and language agnostic, so it can be a common interface between many languages and target quantum computation platforms. Based on the popular open-source LLVM intermediate language, QIR is designed to enable the development of a broad and flexible ecosystem of software tools for quantum development. As quantum computing capabilities evolve, we expect large-scale quantum applications will take full advantage of both classical and quantum computing resources working together. QIR provides full capabilities for describing rich classical computation fully integrated with quantum computation. It’s a key layer in achieving a scaled quantum system that can be programmed and controlled for general algorithms.

A newly-described 'blockchain denial of service' attack could convince miners to stop minin

The attack works by targeting the system’s reward system in a way that discourages miner participation. Specifically, the attacker publishes a proof to the blockchain that signals to other miners that the attacker holds a mining advantage. The researchers found that what they define as “rational” miners will stop mining if they detect that they are at a disadvantage. “If the profitability decrease is significant enough so that all miners stop mining, the attacker can stop mining too,” they write. “The blockchain thus grinds to a complete halt.” The study authors add: “We find that Bitcoin’s vulnerability to BDoS increases rapidly as the mining industry matures and profitability drops.” According to Ittay Eyal, a senior lecturer at Technion who co-authored the study, BDoS attacks are different from a type of attack called selfish mining, in which the attacker manipulates the system to get more than their fair share of rewards. In a BDoS attack, the attacker’s aim is to take down a proof-of-work cryptocurrency rather than reap rewards. Eyal said the findings of the study pertain specifically to Bitcoin, but that’ it’s likely there are similar attacks against Ethereum. The researchers have not gathered any concrete results on this yet, he said.

Zscaler CEO: Network Security Is Dead. Long Live SASE

The security vendor started as a secure web gateway provider before adding firewall and zero-trust network access. It then it added out-of-band cloud access security broker (CASB) capabilities to its platform, all of which positioned it perfectly to dive into SASE when Garter coined the term last year. Earlier this year, Zscaler also acquired Edgewise Networks to add that company’s zero-trust networking and application microsegmentation technologies to its platform, which also give it a SASE boost. SASE, according to Gartner, consolidates networking and security capabilities into an edge cloud-delivered service. While Zscaler arguably provides a best-of-breed SASE security stack, it doesn’t own a networking piece. Instead, Zscaler partners with all of the SD-WAN vendors including VMware, and, in fact, VMware CEO Pat Gelsinger joined Chaudhry for a video appearance during the virtual keynote to tout the two companies’ SASE partnership. When asked if Zscaler plans to continue partnering with SD-WAN vendors to provide a full SASE architecture or acquire SD-WAN to provide its own networking capabilities, Chaudhry said there’s no reason for Zscaler to provide SD-WAN. “We believe that the notion that SASE means networking and security coming together is a misinterpretation of it,” the exec said.

Soft PLCs: The industrial innovator’s dilemma

Industrial control has come a long way from being bulky, maintenance heavy relay-based systems in the 1960s to today’s high-speed processor-based programmable logic controllers (PLCs). What began as a basic attempt to replace relay control quickly transformed as the foundation of modern industrial control and automation. The introduction of Windows in 1985 spawned the first wave of soft PLCs which manifested themselves in PC-based control systems. The engineering community quickly saw the benefits of combining PLC control and HMI in one box – the PC. Several Windows-based control systems emerged in the 1990’s (e.g. ASAP, Think and Do, Steeplechase Software and Wonderware), but none managed to gain sustained traction in the marketplace. “Blue screens of death” raised questions about the reliability of these systems, and the lack of virtualization / containerization technologies made it difficult to efficiently run multiple workloads (e.g. HMI and control) on a single box. Fast forward to 2020, and the value proposition of PC-based control is much stronger than it was in the 90’s as the maturation of Linux operating systems, virtualization technologies and low-cost edge computing hardware have addressed many of the early issues that plagued the first wave of PC-based control systems.

As Ransomware Booms, Are Cyber Insurers Getting Cold Feet?

Constant innovation is one factor, as ransomware operations have continued to refine their business strategies, including exfiltrating and leaking stolen data, using affiliate programs to boost their reach, and even hiring call centers to run boiler-room operations to pressure victims to pay. In Q3, the average ransom payment - when a victim paid - was $233,817, which was an increase of 31% from the previous quarter, reports ransomware incident response firm Coveware. Gangs' successes carry an obvious cost for victims who pay; their criminal profits put a drain on someone else's budget. When victims do pay a ransom, some will remit it entirely from their own coffers. But many organizations now carry cyber insurance with ransomware or extortion protection. As ransomware payouts have risen, however, insurance providers' profits have been taking a dive. Accordingly, some insurers now appear to be "attempting to shelter themselves from these losses, either by excluding extortion events from standard cyber insurance coverage or by introducing onerous new conditions on policyholders," the Seriously Risky Business newsletter reported last week. Experts across the security and insurance industries say that, with ransomware racking up record profits, there's little chance of it abating anytime soon.

Agile is changing software development. Here's how one company made the switch

At Capital One, Soule has helped the bank move away from legacy ways of working and towards an investment in software engineering capability and Agile methodologies. It's a long-term rebalancing act that has seen the company adopt close-knit development teams with clear and concise deliverables. "Changing little and often is now a reality for this organisation," he says. "That change is the mark of the difference between large, monolithic Waterfall delivery of implementations to open-source software, delivered incrementally in feature form on existing products. We've converted most of our IT spending on assets into people. That's been a stellar story." Back in 2014, there were 30 engineers – most of them infrastructure engineers – working for Capital One Europe. Today, there's as many as 300 engineers in the UK business alone. The vast majority are software engineers, compared to just a few six years ago. Soule says this transformation to Agile working has had a "game-changing" impact on the delivery of applications to customers. In the old Waterfall-based way of working, systems and services would take years of effort and millions of pounds to create. These big projects, says Soule, consumed resources and meant other interesting innovations fell by the wayside: "Often other things didn't get done because all the focus of the development engine was on that one big thing."

Why DSLs? A Collection of Anecdotes

Domain-specific languages rely on a different approach. They allow the domain expert to specify the behavior of the software directly. The transformation from unstructured thought to executable specification happens in their brains. The executable specifications - or models - created this way are then automatically transformed into "real" source code by machinery developed by software engineers. Does this really work? It does under certain conditions. In particular, the language must be suitable for use by non-programmers. The primitives in the language should not be generic to "computation" - such as variables, conditions, loops, functions, monads or classes - but instead be specific to the domain, and therefore meaningful to the user: decision table, treatment step, tax rule or satellite telemetry message definition. The syntax should build on existing notations and conventions used in the domain - tables, symbols, diagrams and text - and not just consist of magenta-colored keywords and curly braces. DSLs are also usually less flexible in the sense that users can only compose new abstractions in very limited ways; while this would be a problem for general-purpose languages, it is a plus for DSLs because it ensures that programs are less complicated and easier for tools to analyze and provide IDE support for.

Quote for the day:

"Successful leadership requires positive self-regard fused with optimism about a desired outcome." -- Warren Bennis