Daily Tech Digest - January 21, 2023

Is Your Innovation Project Condemned To Succeed?

The challenge in most organizations is that leaders are looking to make big bets on a few projects. These bets are typically based on asking innovation teams to create a business case before they receive investment. A business case showing good returns will receive investment with the expectation that it will succeed. The team is given no room for failure. ... This problem is exacerbated if your team has received a large investment to work on the project. Most innovation teams lose the discipline to test their ideas if they have large budgets to spend. In most cases they burn through the money while executing on their original idea. By the time they learn that the idea may not work, they have already spent millions of dollars. At this point, admitting failure is career suicide. ... Imagine being the CEO’s pet project, having a large investment and then being publicly celebrated as a lighthouse project before you have made any money for the company. This public celebration of a single innovation project puts a lot of pressure on innovation teams to succeed. 


Which cloud workloads are right for repatriation?

Look at the monthly costs and values of each platform. This is the primary reason we either stay put on the cloud or move back to the enterprise data center. Typically the workload has already been on the cloud for some time, so we have a good understanding of the costs, talent needed, and other less-quantifiable benefits of cloud, such as agility and scalability. You would think that these are relatively easy calculations to make, but it becomes complex quickly. Some benefits are often overlooked and architects make mistakes that cost the business millions. All costs and benefits of being on premises should be considered, including the cost of the humans needed to maintain the platforms (actual hardware and software), data center space (own or rent), depreciation, insurance, power, physical security, compliance, backup and recovery, water, and dozens of other items that may be specific to your enterprise. Also consider the true value of agility and scalability that will likely be lost or reduced if the workloads return to your own data center.


Network automation: What architects need to know

It's great to strive for an automation-first culture and find innovative ways to use technology as a competitive advantage, but I recommend first targeting low-risk, high-reward tasks. Try to create reusable building blocks to operate more efficiently. One example is automating the collection and parsing of operational data from the network, such as routing protocol sessions state, VPN service status, or other relevant metrics to produce actionable or consumable outputs. Gathering this information is a read-only activity, so the risk is low. The reward is high because this task is a time-consuming, repetitive process. Also, you can use this data for various purposes, such as creating reports, running audits, filling in trouble tickets, performing pre-and post-checks during maintenance windows, and so on. You don't need to wait until you get everything right to start. Improve on your automation solution iteratively. Small initial steps can make a big difference in your network. For example, for the data collection example above, you don't need the full list of key performance indicators (KPIs) on day 1; your users will let you know what you're missing over time.


Finding Adequate Metrics for Outer, Inner, and Process Quality in Software Development

Quite an obvious criteria for outer quality is the question of if the users like the product. If your product has customer support, you could simply count the number of complaints or contacts. Additionally, you can categorize these to gain more information. While this is in fact a lot of effort and far from trivial, it is a very direct measure and might yield a lot of valuable information on top. One problem here is selection bias. We are only counting those who are getting in contact, ignoring those who are not annoyed enough to bother (yet). Another similar problem is survivorship bias. We ignore those users who simply quit due to an error and never bother to get in contact. Both biases may lead us to over-focus on issues of a complaining minority, while we should rather further improve things users actually like about the product. Besides these issues, the complaint rate can also be gamed: simply make it really hard to contact customer support by hiding contact information or increase waiting time in the queue.


Platform Engineering Won’t Kill the DevOps Star

“The movement to ‘shift left’ has forced developers to have an end-to-end understanding of an ever-increasing amount of complex tools and workflows. Oftentimes, these tools are infrastructure-centric, meaning that developers have to be concerned with the platform and tooling their workloads run on,” Humanitec’s Luca Galante writes in his platform engineering trends in 2023, which demands more infrastructure abstraction. Indeed, platform engineering could be another name for cloud engineering, since so much of developers’ success relies on someone obscuring the complexity out of the cloud — and so many challenges are found in that often seven layers thick stack. Therefore you could say platform engineering takes the spirit of agile and DevOps and extends it within the context of a cloud native world. She pointed to platform engineering’s origins in Team Topologies, where “the platform is designed to enable the other teams. The key thing about it is kind of this self-service model where app teams get what they want from the platform to deliver business value,” Kennedy said.


The Concept of Knowledge Graph, Present Uses and Potential Future Applications

A knowledge graph is a database that uses a graph structure to represent and store knowledge. It is a way to express and organize data that is easy for computers to understand and reason about and which can be used to perform tasks such as answering questions or making recommendations. The graph structure consists of nodes, which represent entities or concepts, and edges, which represent relationships between the nodes. For example, a node representing the concept "Apple" might have advantages over nodes representing the concepts "Fruit," "Cupertino, California," and "Tim Cook," which represent relationships such as "is a type of," "is located in," and "has a CEO of," respectively. In a knowledge graph, the relationships between nodes are often explicitly defined and stored, which allows computers to reason about the data and make inferences based on it. This is in contrast to traditional databases, which store data in tables and do not have direct relationships between the data points.


4 tips to broaden and diversify your tech talent pool

Apprenticeships are extremely valuable for both employers and candidates. For employers, apprenticeships are a cost-effective way to groom talent, providing real-world training and a skilled employee at the end of the program. Apprenticeship programs also reduce the ever-present risk of hiring a full-time entry-level employee, who may prove to not be up to the required standard or decide for themselves that the organization or industry is not a fit. For workers, an apprenticeship is essentially a crash course providing the opportunity to earn while they learn. With the average college graduate taking on $30,000 in debt (and many taking on much more), a degree has increasingly become out of financial reach for many Americans. Apprenticeships are an excellent way for people to gain tangible work experience and applicable skills while also providing a trial run to determine whether a career in cybersecurity is right for them. For me, apprenticeship programs are a true win-win. During National Apprenticeship Week this year, we joined the Department of Labor’s event at the White House to celebrate the culmination of the 120-day Cybersecurity Apprenticeship Sprint. 


Debugging Threads and Asynchronous Code

Let’s discuss deadlocks. Here we have two threads each is waiting on a monitor held by the other thread. This is a trivial deadlock but debugging is trivial even for more complex cases. Notice the bottom two threads have a MONITOR status. This means they’re waiting on a lock and can’t continue until it’s released. Typically, you’d see this in Java as a thread is waiting on a synchronized block. You can expand these threads and see what’s going on and which monitor is held by each thread. If you’re able to reproduce a deadlock or a race in the debugger, they are both simple to fix. Stack traces are amazing in synchronous code, but what do we do when we have asynchronous callbacks? Here we have a standard async example from JetBrains that uses a list of tasks and just sends them to the executor to perform on a separate thread. Each task sleeps and prints a random number. Nothing to write home about. As far as demos go this is pretty trivial. Here’s where things get interesting. As you can see, there’s a line that separates the async stack from the current stack on the top. 


3 requirements for developing an effective cloud governance strategy

Governance is not a one-size-fits-all proposition, and each organization may prefer a different approach to governance depending on its objectives. Digital transformation is no longer a novel concept. But continuous innovation is required to improve and remain competitive, making automation critical for operational efficiency. According to IDC's Worldwide Artificial Intelligence and Automation 2023 Predictions, AI-driven features are expected to be embedded across business technology categories by 2026, with 60% of organizations actively utilizing such features to drive better outcomes. Automation is critical for increasing efficiency in cloud management operations, such as billing and cost transparency, right-sizing computer resources, and monitoring cost anomalies. The use of automated tools can improve security, lower administrative overhead, decrease rework, and lower operational costs. Definable metrics and key performance indicators (KPIs) can be used to assess outcomes with the right cost transparency tool. ... Automation can also aid in resolving personnel issues, which can cause migration projects to stall.


Styles of machine learning: Intro to neural networks

What makes the neural network powerful is its capacity to learn based on input. This happens by using a training data set with known results, comparing the predictions against it, then using that comparison to adjust the weights and biases in the neurons. ... A common approach is gradient descent, wherein each weight in the network is isolated via partial derivation. For example, according to a given weight, the equation is expanded via the chain rule and fine-tunings are made to each weight to move overall network loss lower. Each neuron and its weights are considered as a portion of the equation, stepping from the last neuron(s) backwards. You can think of gradient descent this way: the error function is the graph of the network's output, which we are trying to adjust so its overall shape (slope) lands as well as possible according to the data points. In doing gradient backpropagation, you stand at each neuron’s function and modify it slightly to move the whole graph a bit closer to the ideal solution. The idea here is that you consider the entire neural network and its loss function as a multivariate equation depending on the weights and biases.



Quote for the day:

"The secret of leadership is simple: Do what you believe in. Paint a picture of the future. Go there. People will follow." -- Seth Godin

Daily Tech Digest - January 20, 2023

Generative AI isn’t about what you think it is

ChatGPT and other generative artificial intelligence (AI) programs like DALL-E are often thought of as a way to get rid of workers, but that isn’t their real strength. What they really do well is improve on the work people turn out. There’s often a conflict between doing something fast and doing it well — a conflict generative AI could end by helping people become better and faster creators. And clearly, if these tools were presented more as assistants rather than as a replacement for people, the blowback we’ve seen (most recently in court) could be tamped down. ... We usually measure productivity as the amount of work done in a given time — without taking into account the quality of that work. Typically, the faster you do something, the lower the quality. Quality in and of itself is an interesting subject. I remember reading the book “Zen and the Art of Motorcycle Maintenance,” which uses storytelling to explain how quality is fluid and depends on the perception of the person observing it. For instance, what’s considered high quality in a sweat shop would be completely unacceptable in a Bentley factory.


Enterprises remain vulnerable through compromised API secrets

While many security teams assign specific entitlements to API keys, tokens, and certificates, the survey discovered that more than 42% do not. That means they’re granting all-or-nothing access to any users bearing these credentials, which although is the path of least resistance in access management, also increases the security risk. Corsha’s researchers also found that 50% of respondents have little-to-no visibility into the machines, devices, or services (i.e., clients) that leverage the API tokens, keys, or certificates that their organizations are provisioning. Limited visibility can lead to secrets that are forgotten, neglected, or left behind, making them prime targets for bad actors to exploit undetected by traditional security tools and best practices. Another red flag: although 54% of respondents rotate their secrets at least once a month, 25% admit that they can take as long as a year to rotate secrets. The long-lived, static nature of these bearer secrets make them prime targets for adversaries, much like the static nature of passwords to online accounts.


The essential check list for effective data democratization

In many cases, only IT has access to data and data intelligence tools in organizations that don’t practice data democratization. So in order to make data accessible to all, new tools and technologies are required. Of course, cost is a big consideration, says Orlandini, as well as deciding where to host the data, and having it available in a fiscally responsible way. An organization might also question if the data should be maintained on-premises due to security concerns in the public cloud. But Kevin Young, senior data and analytics consultant at consulting firm SPR, says organizations can first share data by creating a data lake like Amazon S3 or Google Cloud Storage. ... Most organizations don’t end up with data lakes, says Orlandini. “They have data swamps,” he says. But data lakes aren’t the only option for creating a centralized data repository. Another is through a data fabric, an architecture and set of data services that provide a unified view of an organization’s data, and enable integration from various sources on-premises, in the cloud and on edge devices. A data fabric allows datasets to be combined, without the need to make copies, and can make silos less likely.


Creating Great Psychologically Safe Teams

Conflict avoidance can be corrosive, even deadly, causing teams to miss opportunities and needlessly exposing them to risk. Members might recognize hazards but decline to bring them up, perhaps for fear of being seen as throwing a colleague under the bus… No matter how sensitive the issue or how serious the criticism, members must feel free to voice their thoughts openly—though always constructively—and respond to critical input with curiosity, recognizing that it is a crucial step toward a better solution. Mamoli pointed out that "there is a lot of misunderstanding around psychological safety," saying that "it doesn’t mean we’re super nice to each other and feel comfortable all the time." She explained that the resulting behaviour should be that teams "hold each other accountable" and can safely provide direct feedback saying "this is what I need from you. Or you are not doing this." She said that "this is what we need to remember psychological safety really means."


Big Tech Behind Bars? The UK's Online Safety Bill Explained

One major criticism of the Online Safety Bill is that it poses a threat to freedom of expression due to its potential for censoring legal content. Rights organizations strongly opposed the requirement for tech companies to crack down on content that was harmful but not illegal. An amendment in November 2022 removed mention of "lawful but harmful" content from the text, instead obliging tech companies to introduce more sophisticated filter systems to protect people from exposure to content that could be deemed harmful. Ofcom will ensure platforms are upholding their terms of service. Child safety groups opposed this amendment, claiming that it watered down the bill. But as the most vocal proponents of the bill, their priority remains ensuring that the legislation passes into law. Meanwhile, concerns over censorship continue. An amendment to the bill introduced this week would make sharing videos that showed migrants crossing the channel between France and the UK in "a positive light" illegal. Tech companies would be required to proactively prevent users from seeing this content.


Quantum Computing Owes Security Risk: Its Implications are Unfavorable

The foundation of quantum computing is quantum mechanics, which is fundamentally different from classical computing. Bits are used in traditional computing to process information, and they can only be in one of two states: 0 or 1. Quantum bits, or qubits, which can be in multiple states at once, are used in quantum computing to process data. This enables quantum computers to carry out some computations much more quickly than traditional computers. The potential for quantum computing to defeat many of the encryption algorithms currently in use to safeguard sensitive data is one of its most important implications. Although encryption algorithms are made to be hard to crack, they still depend on mathematical puzzles that can be solved by conventional computers fairly quickly. Due to the speed at which quantum computing can solve these issues, encryption can be broken much more quickly. The security of sensitive data, including financial information, personal information, and secrets of national security, is seriously impacted by this. 


Combatting the ongoing issue of cyberattacks to the education sector

The growing threat of cyberattacks has underscored that organisations can no longer depend on conventional perimeter-based defences to protect critical systems and data. New regulations and industry standards are aimed at shifting the cybersecurity paradigm – away from the old mantra of ‘trust but verify’ and instead towards a Zero Trust approach, whereby access to applications and data is denied by default. Threat prevention is achieved by only granting access to networks and workloads utilising policy informed by continuous, contextual, risk-based verification across users and their associated devices. There are many starting points on the path to Zero Trust. However, one driving principle to determine your priority of implementation should be the knowledge that the easiest way for cyberattackers to gain access to sensitive data is by compromising a user’s identity. ... Furthermore, post-mortem analysis has repeatedly found that compromised credentials are subsequently used to establish a beachhead on an end-user endpoint, which typically serve as the main point of access to an enterprise network. 


How A Company’s Philosophy To ‘Shift Left’ Is Making Headway In The Data Privacy World

Whether privacy sits within legal, security, or both it is less important than ensuring your privacy team is well-resourced and able to collaborate with the organization as a whole. Key to this collaboration is making sure you have the necessary legal and engineering staff to conduct privacy reviews and navigate a rapidly evolving regulatory landscape. Separately, you need to overcome the perception that privacy is an obstacle to productivity and get your product and growth teams to see privacy as a competitive advantage that allows them to build quickly and win consumer trust. Otherwise, pushback, low adoption, and apathy will prevent you from making any real progress. To unify product development with privacy standards, you have to make it impossibly easy for product teams to comply with privacy standards. That means bringing the privacy program directly into their process, right where they are already working, as well as giving them easy-to-understand guardrails that let them build quickly, without having to engage in a painful back and forth with the privacy lawyers and engineers conducting privacy reviews.


Managing Expectations in Low-Code/No-Code Strategies

To guarantee a LC/NC strategy is successful, organizations must ensure there is a bulletproof infrastructure, data governance and security system in place, as well as full visibility into their data and applications. “As a first step, enterprises must gain an understanding of their data -- what it is, where it is and what it’s worth,” Mohan says. “From there, IT leaders can understand where security and compliance vulnerabilities lay and then work to eliminate these threats while ensuring sufficient oversight for potential legal and contractual issues.” While the responsibility of developing a LC/NC strategy falls, initially, on an enterprise’s CTO or CIO, Mohan advises tech leadership should loop in experts in data security, data protection and governance to address cyber and compliance threats and ensure employees are following proper company and legal protocols. ... “Every level of leadership can decide to use a low-code/no-code strategy, ranging from an engineering team manager who is tasked with building products for the company, to a CTO setting the strategic direction of the organization's engineering efforts,” he explains.


Attackers Crafted Custom Malware for Fortinet Zero-Day

The BoldMove backdoor, written in C, comes in two flavors: a Windows version and a Linux version that the threat actor appears to have customized for FortiOS, Mandiant said. When executed, the Linux version of the malware first attempts to connect to a hardcoded command-and-control (C2) server. If successful, BoldMove collects information about the system on which it has landed and relays it to the C2. The C2 server then relays instructions to the malware that ends with the threat actor gaining full remote control of the affected FortiOS device. Ben Read, director of cyber-espionage analysis at Mandiant, says some of the core functions of the malware, such as its ability to download additional files or open a reverse shell, are fairly typical of this type of malware. But the customized Linux version of BoldMove also includes capabilities to manipulate specific features of FortOS. "The implementation of these features shows an in-depth knowledge of the functioning of Fortinet devices," Read says. "Also notable is that some of the Linux variants features appear to have been rewritten to run on lower-powered devices."



Quote for the day:

"It is the responsibility of leadership to provide opportunity, and the responsibility of individuals to contribute." -- William Pollard

Daily Tech Digest - January 19, 2023

Security risks of ChatGPT and other AI text generators

Yet ChatGPT is likely just the beginning of AI-powered cybercrime. Over the next five years, future iterations of AI will indeed change the game for cybersecurity attackers and defenders, argues a research paper entitled "The security threat of AI-powered cyberattacks" released in mid-December 2022 by Traficom, the Finnish government's transportation and communications agency. "Current rapid progress in AI research, coupled with the numerous new applications it enables, leads us to believe that AI techniques will soon be used to support more of the steps typically used during cyberattacks," says Traficom. "We predict that AI-enabled attacks will become more widespread among less skilled attackers in the next five years. As conventional cyberattacks will become obsolete, AI technologies, skills and tools will become more available and affordable, incentivizing attackers to make use of AI-enabled cyberattacks." The paper says while AI cannot help with all aspects of a cyberattack, it will boost attackers' "speed, scale, coverage and sophistication" by automating repetitive tasks.


Why Innovation Depends on Intellectual Honesty

Anxious teams score high on intellectual honesty and moderate to low on psychological safety. Team members are encouraged to be brutally honest because it’s better to be right, and win, than it is to be nice. To return to Steve Jobs: He famously described his approach as being designed to keep “the B players, the bozos, from larding the organization. Only the A players survive.”5 Just as famously, he cared little for creating social cohesion. Apple’s former chief design officer, Jony Ive, has described a conversation during which Jobs berated him for wanting to be liked by his team at the expense of being completely honest about the quality of their work. This example illustrates two types of conflict that emerge from intellectual honesty: task conflict and relationship conflict. Task conflict — disagreement about the work — can be highly productive for innovation and team performance. But relationship conflict, which arises when the way someone says or does something makes people feel rejected, is detrimental. Here’s why. On teams that have an anxious culture, people are willing to push one another to learn through disagreement. 


8 ‘future of work’ mistakes IT leaders must avoid

Virtual reality is one technology that could have an impact on the future of work, and some IT leaders are considering the benefits. Oculus headsets from Meta, for example, are being rolled out on a trial basis at the University of Phoenix, which has made the decision to go fully remote. This was a big mindset change for Smith, who felt pre-pandemic that “face-to-face collaboration was better and high fidelity for creativity purposes,’’ he says. “Then, when everything shifted to full-time remote, it went against my core beliefs, so personally, I had to lean in.” Smith has come to realize that staying remote has not affected IT’s ability to collaborate and teams have been able to remain productive and launch “complex new products into the marketplace.” He says that working remotely has increased his ability to access tech talent outside of the Phoenix area. But when people were working in a hybrid model early on, there would be multiple conversations going on, and “people on the remote end were getting the short end of the stick” because they “couldn’t get a word in edgewise,’’ Smith recalls.


Top intelligent automation trends to watch in 2023

Automation technology will be key in automating previously inflexible processes whilst providing intelligent data led nudges that help agents work efficiently in a complex operating environment. This means that companies can offer an unprecedented level of flexibility and support to their staff, while making significant improvements to engagement and wellbeing. By improving engagement between employees and employers – and fostering a culture of support and encouragement – everyone benefits. ... Since machine learning (ML) rose to significance a decade or so ago, it has rapidly transformed nearly every industry. Businesses would be wise to sharpen their skills and learn what ML has to offer. Whilst technologies in the past only processed static, historical data, ML provides a real-time capability that transforms the gap. It can help organisations become better at predicting flows and responding to them proactively rather than reactively. The potential improvement to areas such as customer service is enormous. Solutions can leverage “productionising” ML models – by which a model is transformed to a scalable, observable, mission critical, production-ready software solution – at their core.


What kind of future will AI bring enterprise IT?

The incremental approach turns out to be the smartest way to build with AI/ML. As AWS Serverless Hero Ben Kehoe argues, “When people imagine integrating AI … into software development (or any other process), they tend to be overly optimistic.” A key failing, he stresses, is belief in AI/ML’s potential to think without a commensurate ability to fully trust its results: “A lot of the AI takes I see assert that AI will be able to assume the entire responsibility for a given task for a person, and implicitly assume that the person’s accountability for the task will just sort of … evaporate?” In the real world, developers (or others) have to take responsibility for outcomes. If you’re using GitHub Copilot, for example, you’re still responsible for the code, no matter how it was written. If the code ends up buggy, it won’t work to blame the AI. The person with the paystub will bear the blame, and if they can’t verify how they arrived at a result, well, they’re likely to scrap the AI model before they’ll give up their job. This is not to say that AI and ML don’t have a place in software development or other areas of the enterprise.


How CISOs can manage the cybersecurity of high-level executives

The risk faced by executives has grown rapidly as the pandemic-driven rise of hybrid work increased the blurring of professional and personal digital lives. Complex geopolitical tensions, opportunities for digital activism against corporates—particularly in industries with higher risk profiles—and the prospect of financial gain from targeting wealthy leaders have all raised the stakes on the personal digital lives of executives. A large organization, especially if it's a publicly listed company with a C-suite leadership team that has a presence in the media and on social media can be a lightning rod for the attention of bad actors, says Gergana Winzer, partner of cyber services with KPMG Australia. “Some of these small-time criminals have awakened to the reality of being able to make monetary returns by utilizing easy-to-buy malware or ransomware online and just deploying it across those types of high-net-worth individuals,” Winzer says. This class of personal risks can take many different forms, according to Pierson, who says one of the biggest risks is to intellectual property—the loss of corporate documents from executives’ personal devices or personal accounts where there are fewer or no controls.


Taking the Reins on IT Interoperability

Interoperability can be elusive because many organizations embark on tactical changes or fail to see the complete picture, Barnett says. “In many cases, they focus only on a part of the organization without fully understanding the impact on technology investments, process reengineering, and human capital assets,” he explains. The intersection of operational technology (OT) and information technology (IT) can prove particularly nettlesome. Historically, these two entities have operated separately, with attempts to connect systems and data an afterthought. “This often leads to the creation of data silos … that hinder agility, reduce productivity, impede customer experience improvements, and hamper scalability,” Barnett says. Business and IT leaders who ignore these problems do so at their own peril. Accenture found that 66% of organizations struggle with the sheer number of applications. This results in technical debt and a loss of agility, McKillips says. In addition, 60% are unable to align their application strategy with overall business goals and 44% struggle to identity the right business case or ROI. Remarkably, 34% believe interoperability is simply too expensive.


ICS Confronted by Attackers Armed With New Motives, Tactics, and Malware

The report identified top trends in the ICS threat landscape based on a compilation of information from various sources including open source media, CISA ICS-CERT advisories, and Nozomi Networks telemetry, as well as on exclusive IoT honeypots that Nozomi researchers employ for "a deeper insight into how adversaries are targeting OT and IoT, furthering the understanding of malicious botnets that attempt to access these systems," Gordon says. What researchers observed over the last six months was a significant uptick in attacks that caused disruption to a number of industries, with transportation and healthcare being among the top new sectors finding themselves in the crosshairs of adversaries among more traditional targets. Attackers are using various methods of initial entry to ICS networks, although some common weak security links that have historically plagued not just ICS but the entire enterprise IT sector — weak/cleartext passwords and weak encryption — continue to be the top access threats. Still, “Root” and “admin” credentials are most often used as a way for threat actors to gain initial access and escalate privileges once in the network, the findings show.


Cybersecurity CTO: A day in the life

Given the scope of the job, a CTO is rarely going to have a consistent daily schedule. Instead, goals and cadences are established weekly. That being said, I do go into the office every day. My typical workday begins at 9:30 a.m., and I take an electric scooter to get into the office. Our headquarters are located in Tel Aviv, so the weather is almost always perfect for the scooter. On a weekly basis, I hold one-on-one meetings with specific managers to understand team needs, review KPIs to ensure they’re being met, and review our proof-of-concept (POC) projects to ensure our customers and potential customers are advancing. These POC reviews are where we often catch technical issues, allowing us to fix them before they cause problems for our customers. While I’m responsible for several employees within our R&D department, I do my best to distance myself and empower our VP of R&D to manage the team. The goal is quality – not getting bogged down in how or when people work. I usually wrap up my time in the office around 6:30 or 7:00 p.m. 


Proven Solutions to Five Test Automation Issues

When you run your automated tests, you need the dependent systems to support your test scenarios. That includes setting up the API and service responses to match what is needed for your test cases. Setting up test data in backends might be problematic, as they might not be within your team’s control. Relying on another team to set up the test data for you means you may end up with incorrect or missing test data and, therefore, cannot continue working on or running your automated tests. Another issue is that even if you have the test data, running your automated tests frequently in the build pipeline might use it all up (test data burning). Then you need a test data refresh, which might take even longer than the partial test data setup, and you are blocked again. Even if you have all the test data you need, when you (or some other team) run their automated or manual tests against the same services, the test data might change (for example, the balance on account or list of purchased items by a user). The tests break again because of test data issues rather than actual issues with the product.



Quote for the day:

"People don't resist change. They resist being changed." -- Peter M. Senge

Daily Tech Digest - January 18, 2023

How Will Cloud Computing Make Drone-Based Solutions Smarter

Due to its multi-sector application, cloud-processed data becomes a valuable resource. For governments and enterprises, it can become a viable source of revenue. As new urban and rural projects are commissioned, these high-resolution datasets are crucial for the planning process. It is useful in satisfying several government schemes such as PM Gram Sadak Yojna, PM Awas Yojna, Bharat FiberNet, and many more. For instance, SVAMITVA data along with DEM layers can help officials chart out the most optimum route of power lines for rural electrification. Similarly, digital terrain maps can help ascertain the natural slopes and assist engineers in designing efficient gravity-aided sewage networks. Cloud computing creates a centralised repository of GIS data which has the potential to drive innovation. Prior to cloud processing, data sharing of this kind had software and hardware limitations. However, the cloud brings forth unified data standards across the country making it hassle-free to access high-quality data. 


Why Cybersecurity Learning and Development is a Lifeline During Economic Downturn

More than a third of Europe’s largest tech companies are currently based in London and the UK remains a beacon of technological innovation. Yet, our research suggests that tech companies across the UK lack the technological skills they need to thrive and remain safe in the challenging months ahead. With DCMS’ UK Data Skills Gap report highlighting that the supply of university graduates with specialist technological skills is limited, companies must accept they have a larger role to play to increase digital skills internally rather than simply looking outside for ready-made talent. Business leaders must put adequate investment and support behind the upskilling of current employees to bolster cybersecurity talent and drive innovation. At the same time, employees should prioritize cybersecurity-related L&D to make themselves an invaluable asset to their organization – proactively identifying training opportunities with a quality L&D partner, one that aligns with their unique learning style and objectives. While there is no cookie-cutter approach to upskilling, employees should be granted access to a range of learning opportunities as part of a defined path of individual development


Artificial intelligence is here, but the technology faces major challenges in 2023

Whether AI will replace human jobs is less important than more vital ethical questions that need to be addressed in 2023, Bhargava says. The more pressing concern is "who's making these things and what questions are they asking about what biases are baked into it." When tools like ChatGPT are designed by teams with limited perspectives and diversity, the result is a tool lacking in perspective. "These systems that get built … are mirrors for our culture and our practices," says Bhargava. "Which way do they point and who's looking in them? No, they don't embed bias; they reflect it." There are some measures being taken to address the ethical questions around AI bias. Dakuo Wang, associate professor of art and design and computer science, says ChatGPT's real innovation is how it uses human data labelers during the process of training the AI to limit bias and increase accuracy. But even then, the technology is only as good as the data it's been trained on. Without the right data, the inaccuracies and limitations become much more obvious––and potentially dangerous.


Ransomware Looms Large on Third-Party Risk Landscape

First, it is important to have a clear understanding of the enterprise’s IT-related supply chain. This includes identifying all of the suppliers, subcontractors and other partners that process, transmit or store data used in the creation of the enterprise’s products and services. It is also important to understand the relationships between these different entities, as well as the specific products and services that each one provides, which results in a mapping. Once the supply chain has been mapped out, the next step is to identify the potential risks associated with each component of the chain. This includes both external and internal risks. External risks might include things like natural disasters, political instability or economic downturns. Internal risks might include things like employee turnover, equipment failure or data breaches. To identify these risks, enterprises should consider conducting a risk assessment. This will involve gathering and analyzing data from a variety of sources, including supplier contracts, insurance policies and regulatory compliance reports. 


DevOps and platform engineering

Despite many new teams and job titles springing up around DevOps, the platform engineering team is, perhaps, the most aligned to the mindset and objectives of DevOps. Platform teams work with development teams to create one or more golden pathways representing a supported set of technology choices. These pathways don't prevent teams from using something else. Pathways encourage alignment without enforcing centralized decisions on development teams. Rather than pick up tickets, such as "create a test environment", platform teams create easy-to-use self-service tools for the development teams' use. A critical part of platform engineering is treating developers as customers, solving their problems and reducing friction while advocating the adoption of aligned technology choices. ... Platform engineering alone doesn't provide a complete organizational view of performance. The DevOps structural equation model shows us capabilities for leadership, management, culture, and product that are outside a platform team's scope.


The Internet of Things: What security risks should you look out for?

With more businesses adopting the IoT and with smart homes becoming increasingly popular, focusing on cybersecurity alone is not nearly enough. It is also important to ensure the physical security of these devices. Most of these devices are generally quite small and easily accessible and could be tampered with or stolen. Once stolen, these devices may be taken to another location where they can be disassembled and probed for any data. These stolen devices might also be used to breach the IoT systems to which they are connected. Moreover, a hacker could plant a bug in a device without even having to move it. These issues highlight how important physical security is and why companies need to take steps to ensure the physical safety of their device network. There are several standards for cybersecurity today, and in a lot of cases, companies are even required by law to comply with some of these standards. Unfortunately, no such international standards exist for the IoT. All we have are best practices and recommendations. While steps are being taken to strengthen IoT security, we have yet to see a framework of recognized, international standards for IoT security


A Platform Team Product Manager Determines DevOps Success

As you build platforms out across the organization, Kersten said, it’s important to ensure that the feedback loops expand accordingly. “If you first build self-service for your own team it tends to be a simpler problem,” he said. “You’ve got the feedback loops already. You should, within a team, be talking to each other. Thinking about what you do as self-service and trying to build those abstractions for yourself, then you’re hopefully freeing up time.” As the platform embraces other teams, “You can’t do platform engineering if you don’t have some way of talking to the people who are actually going to be using the services you build, and working out what their actual problems are, because their problems will be different from yours.” The “State of DevOps” report’s findings underscore the need for a product manager with these “soft skills” to make platform engineering a success at scale. Sixty-one percent of respondents said strong communication skills were the most important product management skills for a platform team’s success.


Why Applying Constant Pressure on Yourself Can Significantly Improve Your Productivity and Success

As with so many things, working through pressure gets easier with practice. It's like a muscle or a skill — you have to train it to strengthen it. No one is walking into the weight room for the first time and squatting with 400 pounds, nor would it be recommended. Without training, you're only going to hurt yourself. There's a reason Lionel Messi is consistently chosen to take penalty kicks; he's taken so many before and has found a way to be comfortable and successful through what's arguably the most pressure-inducing moment of the game. He's been put in the situation before and risen to the challenge repeatedly in a way other players haven't mastered yet. ... Different people have different strategies, but something I've found crucial is recognizing the adrenaline that comes with the feeling of pressure. On a physical level, the fear you might feel during those moments is not all that different from the feeling you get when you're excited, like climbing the highest point of a rollercoaster. The trick is channeling that adrenaline towards the latter and using it to fuel excitement rather than fear. 


AI and Human Creativity - Could it Lead to General Cognitive Decline?

AI might be able to generate new and novel ideas by remixing what is fed into it, but that doesn't necessarily help the humans who create the input improve their access to their own creative powers. It's not just about the quality of what is generated, it is also about improving our thinking skills. Creativity might be innate but we can always get better at inviting its presence. In my experience, that's a mental skill that improves with practice. And highlighting the importance of the human element in creativity is all well and good but creators in a hurry could be ever more inclined to just press a button to get the output to meet a deadline instead of going inside, reflecting, and finding that creative state necessary to doing it on their own. And, of course, yes, AI is a tool and it is about how you use it. I think it is also about how you frame its purpose and how that relates to our values as a society. Consider the relative importance of the intrinsic value of creativity versus a context that gives more weight to the speed of delivery and amount of output.


Enterprise Architecture Must Evolve for Digital Transformation

Current enterprise architectures (EAs) were being developed in the 1980s, and while there have been iterations of them since, widely adopted EAs are still utilizing the same architectural foundations as when they were established. Take for example The Open Group Architecture Framework (TOGAF), which had its first version published in 1995. The foundation still consists of the same four architectural domains: business, application, data, and technical. That foundation was laid before the internet existed. And this is part of the problem. Today it is not uncommon to equate technology with the worldwide connection that is so ingrained in our everyday lives. While TOGAF has managed to support businesses up to now by versioning, including integrating the internet and new capabilities into its architecture, it wasn’t purpose-built for today’s possibilities—digital business. Our understanding of what’s possible drives the need for modernizing enterprise architecture.



Quote for the day:

"No man can stand on top because he is put there." -- H. H. Vreeland

Daily Tech Digest - January 17, 2023

The 7 new rules of IT leadership

There’s no question that stable, strong IT infrastructure is more essential now than ever, yet CIOs can’t succeed by making a steady state the-end-all-be-all. Instead, they must be change agents who are not only OK with constant change but also advocate for it while ensuring infrastructure can scale and support that change. “Success is managing change versus moving from one fixed stone to another,” Cameron says. “So for CIOs to be really successful in this new environment, they need to be able to make change continuous, and they have to find ways as leaders to help their people understand how to do that.” He adds: “That means making structural changes.” There is mindset shift here but equally important — if not more so — is the need to change how work actually happens. One of the most prominent adjustments for IT is the move from approaching technology delivery as projects — something that’s planned, executed, and completed — to a product mindset that embraces incremental improvements delivered throughout a digital tool’s lifecycle.


Essential skills for becoming a CTO

The easiest way into a management and leadership role is to become an engineering manager before you become a CTO. Assuming you have that engineering manager role in your company, there are a whole bunch of great books on engineering management, such as The Pragmatic Programmer by David Thomas and Andrew Hunt. Another good one is Accelerate, which show you how to measure software delivery performance. A good general technical management book is The Manager’s Path by Camille Fournier, while The Five Dysfunctions of a Team by Patrick Lencioni is very good talking about psychological safety and intra relations within a team. ... Possibly soft skills have been neglected in the past. Nobody should be trying to take on a management or leadership position without any understanding of what it means to deal with people and motivate them. Empathy, communication and creating an environment of psychological safety so that people can really push the boundaries of what they work on without fear of reprisal, are really important in a management role. 


AI Lawyer: It's Starting as a Stunt, but There's a Real Need

advocates say AI's ability to sort information, spot patterns and quickly pull up data means that in a short time, it could become a "copilot" for our daily lives. Already, coders on Microsoft-owned GitHub are using AI to help them create apps and solve technical problems. Social media managers are relying on AI to help determine the best time to post a new item. Even we here at CNET are experimenting with whether AI can help write explainer-type stories about the ever-changing world of finance. So, it can seem like only a matter of time before AI finds its way into research-heavy industries like the law as well. And considering that 80% of low-income Americans don't have access to legal help, while 40% to 60% of the middle class still struggle to get such assistance, there's clearly demand. AI could help meet that need, but lawyers shouldn't feel like new technology is going to take business away from them, says Andrew Perlman, dean of the law school at Suffolk University. It's simply a matter of scale. "There is no way that the legal profession is going to be able to deliver all of the legal services that people need," Perlman said.


The EU wants to regulate your favorite AI tools

Lawmakers in Europe are working on rules for image- and text-producing generative AI models that have created such excitement recently, such as Stable Diffusion, LaMDA, and ChatGPT. They could spell the end of the era of companies releasing their AI models into the wild with little to no safeguards or accountability. These models increasingly form the backbone of many AI applications, yet the companies that make them are fiercely secretive about how they are built and trained. We don’t know much about how they work, and that makes it difficult to understand how the models generate harmful content or biased outcomes, or how to mitigate those problems. The European Union is planning to update its upcoming sweeping AI regulation, called the AI Act, with rules that force these companies to shed some light on the inner workings of their AI models. It will likely be passed in the second half of the year, and after that, companies will have to comply if they want to sell or use AI products in the EU or face fines of up to 6% of their total worldwide annual turnover.


CFOs zero in on digital transformation

Evaluating the results of one’s digital transformation efforts is a constant challenge for financial leaders, who must also deal with finding and retaining digital talent as well as aggregating all of the information one needs across their organization in order to build a technology roadmap, Horvat said. CFOs currently are focusing in on the finance function when it comes to their digital transformation efforts, therefore. “What they’re prioritizing is really maturing that FP&A function, getting FP&A-specific tools to platform their planning and budgeting,” Horvat said. Ninety percent of CFOs surveyed pointed to evaluating their finance strategy, scope and design as their top priority for 2023, according to the survey, while 83% pointed to planning finance transformation efforts. It is also important to note that CFOs are personally involved in their organizations’ digital transformation efforts both broadly and within the finance function, Horvat said. “I think a lot of it has to do with owning that strategy piece of it, to make sure that that it’s advancing in a way that serves the interests of the organization,” he said.


How to succeed in cyber crisis management and avoid a Tower of Babel

Organizations need to develop a working assumption of the main threat factors, targets, and practical ramifications of a cyberattack. The organization should also identify the main scenarios they may need to deal with, including a situation that results in shutting down the main business activities and a situation in which sensitive information is leaked or stolen. These should be made based on the nature of the organization, the sector in which it operates, its geographic location and history of cyber events. These scenarios should be updated constantly as the business and the threats change and grow. Publicly listed companies should also be aware of the risks to image and finances that could come with attacks as regulations increasingly require reporting of cyber incidents. In addition, each organization needs to determine its guiding principles, by answering key questions like whether it would negotiate with attackers and whether they would ever consider paying a ransom. It also needs to decide who will mitigate an attack – an internal team or an hired third party. 


How AI chatbot ChatGPT changes the phishing game

If attackers ask ChatGPT directly for ChatGPT to suggest some idea for a phishing email, they'll get a warning message that this topic is "not appropriate or ethical." But if they ask for suggestions for a marketing email, or an email to tell people about a new human resources webpage, or to ask someone to review a document prior to a meeting—that, ChatGPT will be very happy to do. ... ChatGPT is not limited to English. It says it knows about 20 languages, including Russian, Standard Chinese, Korean, but people have tested it with nearly 100. That means you can explain what you need in a language other than English, then ask ChatGPT to output the email in English. ChatGPT is blocked in Russia, but there's plenty of discussion in Russian explaining how to get to it via proxies and VPN services and how to get access to a foreign phone number to confirm your location. ... "ChatGPT and large language models in general will be used for benign content much more than for malicious content," says Andy Patel, researcher at WithSecure, who recently released a research report about hackers and GPT-3, an earlier version of ChatGPT.


Greener supply chains call for IoT innovation

With businesses and CEOs facing demands for environmental change and enhanced revenue growth simultaneously, supply chains need to be revolutionised. This can be achieved by strategically integrating the right systems and sensors to unlock opportunities, especially those that reduce energy consumption and waste throughout product lifecycles. The Gartner study that unearths the CEO findings is entitled 2022 CEO Survey: Sustainability and ESG Become Enduring Change. It says CEOs are also becoming increasingly aware that new technologies have a crucial role to play in supporting sustainability improvements. Artificial Intelligence (AI) was identified by 18% of respondents, putting it at the top of the list of sustainability supporting technologies, with digitalisation ranking second with 11%. While these findings indicate a growing awareness of technology’s potential to support sustainability, only 4% of CEOs identified IoT-related technologies as a primary example, when in fact it is set to be a major driver.


7 tell-tale signs of fake DevOps

An organization that hyper-focuses on a tool- and technology-centric DevOps culture, rather than on people and processes, is 180 degrees out of sync. “It’s crucial to assess current business practices and needs,” says Mohan Kumar, senior architect at TEKsystems, an IT service management firm. Kumar recommends prioritizing teams. “Instill DevOps culture into communication, collaboration, feedback collection, and analysis,” he suggests. “An experiment-friendly environment that allows developers to fail fast, recover fast, and learn faster builds a blame-free culture within the organization.” Kumar also suggests nurturing a stream of creative ideas by tapping into teams’ collective intelligence. DevOps adoption is an iterative process, so the CIO should begin by evaluating the development team’s current state and then gradually building a strategy of continuous improvement involving people, processes, and tools that can evolve along with future needs and developments. “Ultimately, creativity is a muscle that must be exercised continuously to grow,” Kumar observes.


Digital transformation: 4 tips to keep it human-centered

Rather than diving head-first into digital transformation, it is important to take a step back, consider these factors, and act accordingly. By taking a human-centered approach to digital transformation initiatives, organizations can use technology to transform the lives of the people they serve. We recently saw one of our customers create significant positive change when they considered the people involved in a necessary technology upgrade. ... Human-centered digital transformation requires companies to recognize that people lay the foundation for digital transformation and, therefore, must take the necessary steps to create a seamless experience throughout the process. The shift to a digital-first business environment can be challenging to all stakeholders as they are expected to adapt to rapid changes at an organizational level. Keeping pace with the changing needs of employees and customers will alleviate this burden and foster a strong company culture.v



Quote for the day:

"Practice isn't the thing you do once you're good. It's the thing you do that makes you good." -- Malcolm Gladwell