Daily Tech Digest - February 08, 2023

The Value of Human Involvement Over Automation

Proponents of this type of automation will say that it saves time in the long run, providing answers and solutions quickly. Automated customer support also allows people to receive help 24/7, eliminating the issue of having to wait until standard business hours to get an issue resolved. Automatic billing, chatbots, and AI-assisted customer service have increasingly become the standard, particularly for e-commerce vendors. When a business owner has an issue — especially if it involves money, fees, or overcharges — dealing with an endless series of automated responses can get frustrating. If those automated responses do not lead them to the help they ultimately need, that frustration can (and likely will) compound further. Even the most intuitive automated solutions can’t replace a human’s personality, emotional response, and instinctual capabilities to adapt to any situation. ... Consumers and entrepreneurs alike are craving human connection in today’s increasingly automated world, so much so that many brands are making the personal relationships they foster with customers an angle of their sales strategy.


CISO Role Undergoes Evolution as Jobs Grow More Complex

“CISOs should also work closely with legal and compliance teams to ensure that the organization is meeting its regulatory requirements,” he says. “Additionally, a CISO should also develop strong relationships with other security leaders in the organization, as well as with external partners such as vendors and industry groups.” He points out other security leadership roles are also changing and include the chief security officer, and the chief privacy officer, with new roles emerging, including the chief data officer and the chief digital officer. MacLeod says as the threat landscape evolves in 2023, the complexity and sophistication of threats will require CISOs to be more proactive in identifying and mitigating risks. ... Eisenberg adds increased scrutiny of organizations’ spending for essential services will require the CISO to business rationalize strategic investments in cybersecurity to counter the ever-increasing complexity and velocity of cyber threats to business resilience.


OpenAI makes a ChatGPT-like tool called Codex that can write software.

If an AI service can now write code for developers, it raises the question of how it will impact students studying computer science, and if highly paid software-engineering jobs will vanish. Still, software-engineering skills will continue to be in high demand, and AI services like Codex are just a natural step as programming becomes progressively easier over generations, according to academics and experts in computer-science education. Codex has been available to developers since 2021 in the form of GitHub Copilot. And OpenAI, which has raised more than $10 billion from Microsoft and other backers, has been investing more in Codex of late, hiring more than 1,000 contractors to write code and associated descriptions that will help Codex learn to become a better programmer, Semafor reported. Codex and ChatGPT are a "huge productivity enhancer," and many programmers are already using Codex in their day-to-day workflows, Christopher Manning, a professor of computer science and linguistics at Stanford University, said. 


Centralizing governance: An increasingly pertinent consideration

Historically it was common for large multinationals to have lawyers around the world. Different jurisdictions have different laws, and it is beneficial to have local specialists that are close to the business. Things are changing, however. There are more opportunities, to outsource specific legal support– to alternative legal service providers or to create an internal shared services operation through the use of innovative legal technology, such as centralized contract and knowledge management and cloud-based workflow tools. This makes the centralization of certain legal activities such as entity management more feasible and more efficient. The downside of a decentralized legal structure in today’s world is becoming increasingly clear. From a management perspective, it is not always easy to align business operations in a decentralized management structure. Decentralized structures have their own authority and bring with them tension between a local and global perspective.


8 steps to turning around a toxic IT culture

An IT leader can’t simply create a positive culture with the wave of a hand. Culture is a function of leadership execution. “Leading by example is the way to start a turnaround,” says Fredrik Hagstroem, CTO of Emergn, a digital business services firm. A clear vision guides team direction. It’s like a compass that reliably points everyone in the correct direction. Even when things are complex or changing, having a goal helps everyone become aligned, Hagstroem says. “Good leadership that drives collaboration and trust will be evident in frequent use of collective and inclusive pronouns, such as ‘we,’ ‘us,’ and ‘ours’ — meaning everyone in the company.” Strong leadership ensures that vision, strategy, and goals aren’t just clearly understood, but attractive and motivating. “Leaders must demonstrate that collaboration and contributions to common goals are more important than individual performance,” Hagstroem says. He advises changing professional relationships from urging team members to reach personal objectives and responsibilities to achieving team goals. 


Implementing an Emerging Risk Analysis Process

While looking for emerging risks, we search for information about our targeted subjects and sweep the events that are happening. The reliability of the information collected has strategic importance in this study. This activity is generally called horizon sensing or horizon scanning. The effort is about looking into the future as widely as possible while trying to see the relevant indicators from the news, trends, cultural tendencies, political events, and natural events. One can easily get lost in this phase or drown in a vast amount of information from the search, since the source of information is not filtered or tested. Unless the information is collected from an official, reliable and reputable source, we need to take it with some healthy skepticism. Otherwise, our results may misinform the strategy level and lead to more significant failures. The information collection has two parts: one is to see what is happening in the world relevant to the business, and the second is the internal view. We look inside the organization and discuss the identified events or changes that may contribute to define emerging risks with relevant stakeholders. 


How data governance and security is transforming shop floor operations in manufacturing

Manufacturers often incur substantial operational costs and invest in in-house software. Also, there are expensive maintenance and other infrastructure costs that manufacturers must keep in mind. As a result, cloud solutions seem better options than traditional on-premises systems. The cloud computing solution can be easily customised as per manufacturer needs with monthly or annual subscription models, thus making a move cost-effective and time-efficient for the manufacturers. Flexibility – With cloud technology, manufacturers can now embrace Agile manufacturing methods that leverage flexibility, rapid iteration, innovation, and augmentation to adapt to technological changes. With the growth of data availability and expanded analytics capabilities, manufacturers can act on real-time data and identify and solve problems promptly to keep up with market demands and maintain a competitive edge. Accelerated Deployment – Shop floor transformations are often associated with expensive and complex legacy MES solutions. 


How to Find the Right Data Governance Model and Derive Principles from Corporate Governance

It is critical to distinguish the term “governance” from “management” in the context of data governance. It should be noted that the principal difference is that governance refers to the decisions that must be made and who must make them. This is to ensure effective resource allocation and management of data operations. On the other hand, data management involves implementing the decisions that arise from assessing and monitoring either existing controls or the environment, including advancements in technology and the market. The activities required for data governance can be distinguished from those needed for data management because management is influenced by governance. Data governance is oversight of data management activities to ensure that policy and ownership of data are enforced in the organization. The emphasis is on formalizing the data management function along with the associated data ownership roles and responsibilities. 


NIST Selects ‘Lightweight Cryptography’ Algorithms to Protect Small Devices

“The world is moving toward using small devices for lots of tasks ranging from sensing to identification to machine control, and because these small devices have limited resources, they need security that has a compact implementation,” she said. “These algorithms should cover most devices that have these sorts of resource constraints.” To determine the strongest and most efficient lightweight algorithms, NIST held a development program that took several years, first communicating with industry and other organizations to understand their needs and then requesting potential solutions from the world’s cryptography community in 2018. After receiving 57 submissions, McKay and mathematician Meltem Sönmez Turan managed a multi-round public review process in which cryptographers examined and attempted to find weaknesses in the candidates, eventually whittling them down to 10 finalists before selecting the winner. “We considered a number of criteria to be important,” McKay said. 


Doing More With Less: How to Survive an IT Budget Cut

Each leader addresses budget cuts in their own way, since there are many drivers, objectives, and desired outcomes that power the need to reduce spending, says Scott Schlesinger, US data and analytics lead at management consulting firm PA Consulting. “Regardless of the reason for the cuts, how the organization executes the strategy, and how effectively the cuts are done, can ultimately be a major factor in the very survival of some organizations.”  Budget cuts can also open the opportunity to reevaluate existing projects. “Are in-flight projects delivering the intended business and technology outcomes?” asks Tim Potter, a principal at business advisory firm Deloitte Consulting. “A thorough assessment of all IT projects is important to validate the achievable ROI and relative importance of each program.” He notes that a budget reevaluation can also help IT leaders to avoid the sunk-cost fallacy -- the tendency to continue investing in projects that aren't yielding the desired benefits simply because a significant amount has already been invested in the project.



Quote for the day:

"No matter what accomplishments you make, somebody helps you." -- Althea Gibson

Daily Tech Digest - February 07, 2023

The On-Premises Empire Strikes Back At AWS

Anybody who can read a financial report knows they are paying too much for compute, storage, networking, and software at Amazon Web Services. It is as obvious as the sun at noon. And it is also obvious – and increasingly so – that the retailing and media businesses at Amazon are as addicted to the AWS profits and the free compute capacity it gives to the corporate Amazon parent as IBM has ever been addicted to the high price of its vaunted mainframe platforms.And so Amazon and therefore AWS is stuck between a rock – increasing competition from Microsoft Azure and Google Cloud, and to a lesser extent Alibaba, Tencent, IBM Cloud, and a bunch of niche cloud builders – and a hard place – the desire to move back to on-premises IT operations, usually in a co-location facility to try to save money compared to buying cloud capacity and software. ... The bad news for Amazon is that this pinch is coming as the parent company is spending vast sums building its media empire and further automating and expanding its electronic retailing and grocery operations. 


Deduplication and Data Stewardship Process in MDM

Match merge is a process that can help identify duplicate data in master data. It takes data from different systems and looks for duplicates or exact matches (and merges them if necessary) to make a "golden copy" of the record. ... The matching process includes match columns and match rules that help recognize similar records in the database, determine customer records for automatic compliance, and determine documents that a data steward should review before consolidation. The matching process consists of two basic techniques (fuzzy match and exact match) that help identify duplicates. In fuzzy matching, base object matches are found through the slowest method. In it, records are matched based on misspellings, transpositions, word combinations, splits, omissions, and phonetic variances. Exact matches make it quicker to compare records whose match columns are identical. Consolidation is the next step after the matching phase. It is rich with queued match records and sent for the merging process. The merged data after compliance is known as the "golden record."


Machine Learning Is as Easy as an API, Says Hugging Face

AI right now seems like the domain of elite experts, but startup Hugging Face plans to “democratize good machine learning” by making it as easy as deploying a REST API. This isn’t theoretical — it’s possible now, with use cases in frontend and web applications, explained Jeff Boudier, head of product and growth at the startup. Hugging Face offers opens source machine learning (ML) models for free on its community site, while charging a fee for infrastructure and service support. ... Boudier estimated customers have deployed about 20,000 projects using AI technologies on their platform. “Frontend, backend, mobile — it all works because we abstract away all of the machine learning and the infrastructure around the machine learning, so at the end of the day, it’s a REST API that you can send requests to — whether it’s from your frontend JavaScript or it’s your backend, or from a mobile client,” Boudier said. “We have a ton of developers and AI startups that are using our models and the inference endpoints … to power user-facing experiences.”


How Quantum Computing Could Affect the Automotive Landscape

Although QC affects all modern digital systems, vehicles are more susceptible to the dangers of QC for several reasons:Vehicles have a relatively long life cycle. New vehicles entering the market today will stay on the road for approximately 15 years, with the current average age of a passenger car in the US being around 12 years and rising. Electric cars are expected to have even longer life spans. ECUs are typically harder to update than personal computers and mobile devices. This is especially true for their cryptographic capabilities, which are often implemented in a dedicated hardware component, called a Hardware Security Module (HSM) or Secure Hardware Extension (SHE), making it impossible to change the cryptographic schemes without a change of hardware. Some ECUs can be updated seamlessly over the air, but many can only be updated in registered service stations using dedicated tools. Vehicles are composed of dozens of ECUs (sometimes more than 100), with the number of ECUs constantly rising in recent years. 


Embracing The Human Element Of Security Automation

Security incident response is historically people-focused: The security team identifies risk and then addresses it. Automation is a compelling solution to the overwhelming amount of security tasks. Still, many organizations are trying to take what is currently a fully manual process and transcribe it almost one-for-one into an automated process. In many cases, this doesn’t work because it fails to account for the institutional knowledge of the security team. Hesitant business leaders should feel confident in investing in automation knowing that the human element is vital to successful implementation. Think of automation as an extension of the security team, not a replacement. Security teams are still your biggest asset, especially in crisis moments when their deep institutional knowledge can give important context and insight that may not be a part of a standard checklist. Many organizations are increasingly seeing the benefit of security automation and the fact that it allows strapped security teams to focus on higher-priority tasks by removing the mundane, repetitive tasks from their plates, rather than taking jobs away.


Best Practices for Promoting Information Security Awareness

The preferred approach to delivering education on information security concepts are not simply a switch to smaller, bite-sized courses, but training that is targeted to meet the role of the learner. While everyone can benefit from knowledge about the basics of information security and how to protect their online footprint, certain positions and academic disciplines require less exposure to the technical components. Rather than disseminate a broad view of topics, it is recommended that content be segmented and factor in ample time for discussion and absorption of the material. Advanced concepts like penetration testing and audits should be reserved for those in technical positions or seeking a similar academic discipline. Keeping curricula generic makes the content you deliver suitable for a broader target audience. Imposing restrictions, such as 45-minute lectures with a maximum of 20 slides, offer the best pacing and depth of material. Including real-world examples, such as a scenario in which an individual receives a phishing email and must decide how to respond, helps put the information into context for the learner.


The profound danger of conversational AI

Whatever we call them, these systems have terrifying vectors for misuse and abuse. I’m not talking about the obvious danger that unsuspecting consumers may trust the output of chatbots that were trained on data riddled with errors and biases. No, I’m talking about something far more nefarious — the deliberate manipulation of individuals through the targeted deployment of agenda-driven conversational AI systems that persuade users through convincing interactive dialog. Instead of firing buckshot into broad populations, these new AI methods will function more like “heat-seeking missiles” that mark users as individual targets and adapt their conversational tactics in real time, adjusting to each individual personally as they work to maximize their persuasive impact. At the core of these tactics is the relatively new technology of LLMs, which can produce interactive human dialog in real time while also keeping track of the conversational flow and context.


Bolstering cybersecurity readiness in the cloud

Firstly, the introduction of Business Risk Observability comes in response with a growing trend of security and observability gradually converging, with organisations now able to leverage a business risk scoring solution via Cisco Secure Application, in Cisco AppDynamics. This first-of-its kind solution is planned to enhance Cisco’s Full-Stack Observability application security solution, combining Kenna Risk Meter score distribution and Business Transactions from Cisco AppDynamics, as well as integrating with Panoptica for API security and Talos for threat intelligence. ... While authentication often proves effective when it comes to preventing unauthorised access, there is always a danger of user fatigue developing as a result of too many constant requests. To help mitigate this, Cisco has launched Duo Risk-Based Authentication, which utilises remembered devices and a Wi-Fi fingerprint to determine legitimate users based on commonly used Wi-Fi networks, while preserving privacy by not storing location data.


Artificial Intelligence and ChatGPT in The Aspirational India

There is a serious threat looming over another AI: Aspirational India, as well as an opportunity. These are the final 12-14 months before general elections in some key states in 2024. We have already seen that India stands out as a bright spot in an otherwise bleak global economic outlook. Aspirational India, which has risen since the 1991 liberalisation under PV Narasimha Rao and has seen growth in the mid-2000s, faced a global recession from 2009 to 2011, recovered from the double whammy of Covid and the much-needed GST regime consolidation. As we begin to recover, we may see politics eclipsing the economic gains made. In the near future, we may also see security issues that call India’s story into question. The neighbours have their own internal issues, but they are not afraid of conflict. As we have seen in recent attacks on the incumbent party by a biassed piece of journalism that challenges Indian institutions and some targeted financial houses to again tarnish financial systems suggesting crony capitalism, India’s story may be challenged and tarnished in the international arena.


Top 6 SaaS Security Threats for 2023

SaaS-to-SaaS app integrations are designed for easy self-service installations, boosting efficiency and functionality. However, these features pose a security nightmare. The challenge is centered on the increasing volume of apps connected to the company’s SaaS environment. On average, thousands of apps are connected without the approval or knowledge of the security team. Employees connect these apps, often to boost productivity, enable remote work, and better build and scale a company’s work processes. However, when connecting apps to their workspaces, employees are prompted to grant permissions for the app to access. These permissions include the ability to read, create, update and delete corporate or personal data, not to mention that the app itself could be malicious. By clicking “accept,” the permissions they grant can enable threat actors to gain access to valuable company data. Users are often unaware of the significance of the permissions they’ve granted to these third-party apps.



Quote for the day:

"It is, after all, the responsibility of the expert to operate the familiar and that of the leader to transcend it." -- Henry A. Kissinger

Daily Tech Digest - February 06, 2023

Preparing for Compliance With AI, Data Privacy Laws

Even though enforcement of data privacy laws in California and New York laws have been slightly delayed, and California regulations implementing the new AI law are not yet fully baked, businesses should be employing expert consultants now to be ready when enforcement begins. Platz notes that in the working world -- and especially in an environment that is often largely remote with employees around the country and the world -- these new privacy laws will affect employees beyond the states that enacted the laws if they live and work in different locations. “With flexibility to work from virtually anywhere, this legislation will have wide reaching impact across states and sectors and will only highlight the need for employers to look closely at their path to compliance across a significant amount of data,” Platz says. ... “As almost always happens, many other jurisdictions will follow suit, as New York City already has,” he says. “So, businesses should be preparing to deal not just with these two new laws but, ultimately, with similar ones in most or all states and perhaps other cities.”


While governments pass privacy laws, companies struggle to change

No single approach can ward off all dangers—it takes a potent combination of technologies, policies, and practices, all with boardroom support. Remember, employees often represent the weakest link in the data security chain since a simple phishing email can bypass the most sophisticated defenses. Strong protection starts with practical training and enforcement. Management can also help ensure every strategy builds on a solid foundation. Many enterprises are now engaged in major digital transformation and cloud migration initiatives. However, some still need help answering basic questions: Do we know where every piece of data in the house resides? Do we know how much of it contains PII, and who has access to it? How is the data managed in the cloud? What kind of encryption has been applied? Where are the encryption keys stored, and who has access to those? ... This way, there are no shared network resources, and the enhanced security is matched with greater flexibility to ensure a company-specific deployment—a dedicated cloud tenant and custom software to address specific needs.


Is the Answer to Your Data Science Needs Inside Your IT Team?

Allowing data scientists and developers to work together in real time provides multiple benefits. First, it allows for more expeditious and agile development of intelligent apps. Second, it allows developers and data scientists to learn about each other’s needs and processes. When each group is so closely connected and understands each other, it improves the chances of project success. Agile application development requires everyone to work in sync. When Red Hat began exploring ways to bridge the gap that has traditionally existed between developers and data scientists, we expanded on the idea of creating a common platform for real-time collaboration between them. Within this common platform, development and data science teams would have access to all the tools they need to perform their tasks, and could quickly build and share production pipelines. ... Open Data Hub was so effective at solving our internal data science and development challenges that we ultimately evolved it into a commercial offering called Red Hat OpenShift Data Science. 


20 Ways to Achieve Street Smart Wisdom for Leaders and Entrepreneurs

The necessity of cultivating an open mindset and being able to adjust to changing circumstances and obstacles swiftly is highlighted by adaptive thinking. To succeed, leaders need to be able to think quickly on their feet and modify their plans as necessary. Adaptive thinking focuses on maintaining persistence and focus in the face of difficulty. The need to think outside the paradigm and come up with unique solutions to challenging problems is emphasized under creative problem-solving. To create novel solutions, leaders need to be able to spot trends and think creatively. It underlines how important it is to be abreast of recent trends and advancements. Lastly, strategic planning emphasizes the need for a well-thought-out strategy and the capacity to picture the desired outcome. Leaders must be able to foresee possible difficulties and be ready to modify their plans as necessary. This highlights the need to maintain organization and concentrate on long-term objectives.


The Case for a Strong Data Governance Program in 2023

Effective data governance is also critical for complying with data-focused regulations, especially data privacy laws. Following in the steps of the EU’s General Data Protection Regulation, several U.S. states have introduced privacy laws, with more states poised to do the same. Existing regulations include California’s Privacy Rights Act and Consumer Privacy Act, along with similar regulations in Colorado, Connecticut, Utah, and Virginia. In addition, because many organizations today anticipate incorporating artificial intelligence into decision making, they must make efforts to comply with emerging AI regulations. The standard-bearer is the EU’s AI Act, which aims to prevent potential data misuse and privacy violations. Acts like these depend on organizations adopting strong data governance practices. Clearly, every company today must have a data governance program. Lack of one can cause data inconsistencies, complicate data integration efforts, and create data integrity challenges. These issues can lead to a slew of negative outcomes: reputational damage, fines for noncompliance, reduced efficiency, and, of course, missed opportunities for business growth.


Government plans to catch tax fraudsters with help of AI

Cabinet Office minister Baroness Neville-Rolfe said fraud against “the public purse is unacceptable and we’re stepping up the fight against those who wish to profit off the backs of taxpayers”. “Through the use of cutting-edge technology, the PSFA will use data and AI to help us in the fight against fraudsters,” she added. The government previously signed another deal with Quantexa, in October 2021, to help combat Covid-19 loan scheme fraud. During the pandemic, fraudsters abused the government’s loan scheme, with a number of businesses making fraudulent claims. The contract with Quantexa was part of the government’s response to those criminal activities. As part of the contract, the government used Quantexa’s Contextual Decision Intelligence (CDI) platform, which enables customers to “create a connected view of [their] data to reveal relationships between people, places and organisations”. It analysed an initial set of 250 networks of people, organisations and places, processing more than 100 million data items.


Insurance IT leaders herald new era for digital customer experience

With new platforms evolving, insurance CIOs are eyeing new possibilities for the future. Liberty Mutual, which has been an industry leader in digital transformation, operates a hybrid cloud infrastructure built primarily on Amazon Web Services but with specific uses of Microsoft Azure and, lesser so, Google Cloud Platform. ... The insurance company under his direction spent 17 years developing a robust platform that today enables consumers to access an automated claims system that uses chatbots, cameras, and e-mail to initiate a claim and rent a car while a machine learning model analyzes the photograph of the damaged vehicle to detect whether its airbag has been deployed, for instance, and to determine immediately whether a vehicle is totaled or the damage is limited to a fender bender. That’s today. The platform will enable data scientists to build the next generation of applications for its consumers tomorrow. “We’re really trying to understand the metaverse and what it might mean for us,” said McGlennon. 


Lambda Throttling - How to Avoid It?

When your lambda is throttled and you reach the maximum parallel execution limit, lambda returns a throttling error. Lambda has a retry mechanism with exponential backoff that starts from 1 second and reaches a max of 5-minute windows which can even run for 6 hours (by default), to try to complete the execution of a failed event. We should also mention that for better error-proofing your code, you could use a dead-letter queue (DLQ) which other queues can target for messages that can’t be processed / consumed successfully. A DLQ is for the cases it still fails to execute, but that is just for reference, and we will not dive into that now. The meaning of this is tremendous. It doesn’t matter if we send a message with SQS, Eventbridge, or other async services; you will practically never need to think about handling throttling issues. ... However, in contrast to synchronous invocation, this will not impact your application and service level agreement (SLA), as the events will be kept in the internal Lambda service queue and handled in time when the resources have freed up to manage them. Every single one of them.


Will your incident response team fight or freeze when a cyberattack hits?

CISOs shouldn’t be surprised to hear that even well-prepared teams can have moments of paralysis; it’s just human nature, McKeown says. She says sometimes responders may experience cognitive narrowing, where they’re so focused on the situation directly in front of them that they can’t consider the full circumstances—an experience that can stop responders from thinking as they normally would. Niel Harper, an enterprise cybersecurity leader who serves as a board director with the governance association ISACA, witnessed a team freeze in response to a ransomware attack on his first day working with a company as an advisor. “They literally did not know what to do, even though they had some experience with [incident response] walkthroughs,” he recalls. “They were in panic mode.” Harper says he has seen other situations where the response was stymied and thus delayed. In some cases, teams were afraid that they’d be seen as overreacting. In others, they were paralyzed with the fear of being blamed. 


Why 2023 is the time to consider security automation

Security automation done right doesn’t usually mean replacing human intelligence and ability – rather, it aims to give people the requisite power to strengthen the organization’s security posture and mitigate threats. Security automation doesn’t necessarily have to be exotic. Especially if you’re just starting out, some of the simplest automation can have considerable impacts. ... “Over the last several years, engineering teams have automated nearly all of their development and deployment processes across APIs in CI/CD pipelines and unfortunately, security has oftentimes been an afterthought,” says Paul Nguyen, co-founder and co-CEO of Permiso. “Accordingly, attackers have leveraged stolen API keys and compromised service tokens as methods to infiltrate a network or service and move laterally.” The course correction isn’t to dump DevOps and CI/CD pipelines, obviously – it’s to better secure them, and automation is key. So is DevSecOps. “It’s time for security teams to embrace automation and bolster their defenses in order to be able to respond to the modern tactics of bad actors,” Nguyen says.



Quote for the day:

"You can't delegate accountability" -- Gordon Tredgold

Daily Tech Digest - February 05, 2023

Cloud security top risk to enterprises in 2023, says study

Indeed, about two-thirds of UK respondents told PwC they had not yet fully mitigated the risks associated with digital transformation, in spite of the potential cost, and reputational damage, of an incident – 27% of global chief financial officers who took part said they had experienced an incident in the past three years that had cost over $1m. On a brighter note, there does seem to be plenty of money available to help, which runs contrary to forecasts from analysts at Forrester, who predicted a 3.6% decline in general IT spending this year as organisations face a budget shortfall. Cyber security seems relatively unaffected by PwC’s metrics, with 59% of UK respondents saying they expect their security budgets to increase. ... At just under half of UK organisations, a “catastrophic” cyber incident was held to be the top risk scenario they faced, ahead of both global recession or a resurgence of a new Covid-19 variant. PwC said this echoed the findings of a previous study of CEOs that found 64% of UK leaders were “extremely or very concerned” about cyber attacks hitting their ability to conduct business.


Projecting Cybersecurity in 2023

While cloud-based data storage can be equipped with cybersecurity measures to prevent data breaches, if an enterprise hosts a large amount of valuable customer data, even a partial breach can have far-reaching negative effects. This is because an organization’s cloud storage contains enormous hordes of extraordinarily valuable data, if an attacker gains access to merely a fraction of these data, it can cause significant damage. An example of this was the Revolut data breach in September 2022. ... Though remote work is nothing new, it will continue to be a security concern in the coming year. Hackers will become more innovative in their approaches to targeting remote workers. Enterprises are also struggling with ensuring privacy as their teams become more scattered geographically. Remote employment frequently results in an increase in ransomware, phishing and social engineering attacks. To address attacks related to remote workplaces, organizations must adopt zero trust policies, assuming that every device and user is a possible attacker. Zero trust is a relatively new practice, but it is gaining traction as one of the key points of


Enterprises turn to single-vendor SASE for ease of manageability

"There’s a significant market opportunity to bring traditionally enterprise-grade security services to the midmarket and to small and medium-sized business," he said. "For many smaller companies, SASE is an opportunity for an all-in-one security and networking solution that allows them to offer more advanced security without the complexity or price tag of standalone solutions." Gartner has also been seeing growing interest from clients for single-vendor SASE platforms, said analyst Andrew Lerner, who covers enterprise networking for the research firm. Small companies without separate security and networking teams are particularly interested in single-vendor solutions, as are companies large enough to have architecture teams. "Architecture teams sit above the day-to-day operations," Lerner said. As a result, they can see the challenges associated with using multiple vendors. "Those challenges include multiple points of integration, multiple policies, multiple management planes, multiple points of presence," Lerner said. "That all has to be tied together, and that creates administrative inefficiency and inefficient traffic flows."


Google is feeling the ChatGPT threat, and here's its response

The company has reportedly been scrambling to put together a redesigned Search home page that includes multiple sections for back and forth questions between the user and a Google-made chatbot like ChatGPT, but combined with traditional search results. Google now appears ready to show off what it's been working on, though it remains to be seen whether it's "Apprentice Bard", the chatbot its been reportedly testing internally that uses Google's own LaMDA conversational chatbot technology. According to The Verge, Google has also sent media invites to an event on Wednesday, February 8 where it will explain how it's "using the power of AI to reimagine how people search for, explore and interact with information, making it more natural and intuitive than ever before to find what you need." The event will be streamed on YouTube at 8:30am ET. The increased openness appears to reflect an effort at Google to remind the world that it has been at the forefront of AI research for the past decade and remains relevant as questions mount about ChatGPT's impact on Google's Search business. That's as Microsoft suddenly seems to have a wider opening with beyond the enterprise via its large stake in OpenAI.


iSIMs imminent? What the evolution of SIM cards means for enterprise IoT

As more businesses and industries around the world begin to commit to deploying massive IoT solutions, we will see a gradual growth in global iSIM adoption to support it. Another piece of the IoT puzzle is private 5G networks, which are also making big strides towards mass deployment. Private 5G is going to be crucial in supporting the connectivity demands of mMTC applications, delivering the “smart factories” and “smart airports” that have been talked about for some time. iSIMs will make it easier and more cost-effective for businesses to make this happen, meaning industry 4.0 is finally on the horizon. However, there is a drawback with iSIMs that businesses and device manufacturers will have to navigate. Because the SIM is directly built into the device, it means product development timelines are likely to be longer. Rather than the fairly “plug and play” nature of a SIM or eSIM, iSIMs will have to be progressively integrated into the IoT solutions. With that in mind, when can we expect iSIMs to really claim the SIM throne? While it’s likely that iSIMs will be deployed in the wild by 2024, we may have to wait a little while longer before we reach mass adoption.


Microsoft’s new Teams Premium tier integrates with OpenAI's GPT-3.5

GPT-3.5 will be used to divide Teams meeting recordings into chaptered sections, generate titles and section descriptions, add personalized timeline markers that show when a user joined or left a meeting, as well as highlighting when a name was mentioned and when a screen was shared. Microsoft has long been a supporter of OpenAI, investing $1 billion in the company in 2019 to support its quest to create “artificial general intelligence,” and in 2020, it became the first company to license GPT for inclusion in its own products and services. GPT, which stands for Generative Pretrained Transformer, is a language model developed by OpenAI that uses deep learning techniques for natural language processing (NPL) to generate text that is remarkably similar to human writing. GPT-3.5 is the latest version of the model. In January, Microsoft announced the third phase of its long-term partnership with OpenAI, with a multiyear, multibillion dollar investment from the tech giant meant to help accelerate breakthroughs in AI, and the ability for Microsoft to access new AI-based capabilities it can resell or build into its products.


Tech workers seek alternative employment to avoid redundancy

With a large number of young people leaving the technology sector for various reasons, and the phrases “the great resignation” and “quiet quitting” gaining traction over the past year, organisations need to focus on ways to draw in new talent and keep the talent they already have. Until recently, a lack of skilled workers, increased use of technology and desperate employers put the power in the hands of jobseekers. But this is changing, with some suggesting the favour will shift towards employers this year. The recession has already seen high-profile tech companies such as Meta, Twitter, Microsoft and Amazon cut jobs in the thousands. When looking at redundancy concerns, CWJobs also looked at data from the Office for National Statistics, which suggests only 1.2% of firms in the “information and communications” sector are planning to let people go over the next three months – less than the average across the UK. Whether a looming threat or just rumours, the likelihood of employees having a “plan B” varies depending on location and age. Some 63% of respondents in London said they were applying for new jobs to protect their future, which is higher than the average.


Companies face data privacy maze, skills gap

“While businesses have invested significant resources into updating privacy protocols and notices to meet the Jan. 1, 2023 effective date for California and Virginia, there is still more work to be done to ensure covered businesses are ready for 2023 privacy compliance obligations,” the alert said. Forty-two percent of the ISACA respondents said their enterprise privacy budget is “somewhat or significantly” underfunded, down from 45% in 2022 and 49% in 2021. The association, which is made up of more than 165,000 professionals who work in IT-related fields, sent survey invitations during the fourth quarter of last year to about 46,000 of its constituents — mainly data privacy and security practitioners. A total of 1,890 respondents completed the survey. While many corporate executives are thinking about the potential fallout from data breaches — which are often in the headlines — there are still significant gaps to fill when it comes to broader data privacy obligations that are rapidly coming into force, according to Kazi. “It is possible to have good security in place but not be doing privacy very well,” she said.


Networking tips for IT leaders: A guide to building connections

Most experts agree you’ll get much more out of an in-person outing. But if budget or time are tight, online conferences can work, Mattson says. If you do opt for a webinar, make sure your camera is on, and comment when you can. “When you participate, people look at you as a go-to person, and that’s how you want to be seen,” Mattson says. “If you’re on mute and don’t look at the camera, that defeats the purpose.” And make sure to take advantage of any online networking opportunities the conference organizers provide. The pandemic has been a boon for online conferences. Megan Duty, vice president of technology and project delivery at Puritan Life, says her time available for networking increased because she was working at home more. “I wasn’t commuting as much and felt these conferences were important,” she says. ... Generally, Duty attends meetings that are relevant to insurance, leadership, women in technology, or those hosted by consulting groups she wants to get to know better. A lot of these forums are back in person, she says, and she traveled a lot during 2022. 


APT groups use ransomware TTPs as cover for intelligence gathering and sabotage

Many of the observed TTPs and collected tools have previously been attributed by other researchers to Kimsuky or Lazarus groups," the WithSecure researchers said in their new report. "The fact that references to both groups are observed could highlight the sharing of tooling and capabilities between North Korean threat actors." The researchers found malware similar to one called GREASE that was previously attributed to Kimsuky, as well as a custom version of In this incident WithSecure observed usage of a malware similar to GREASE, also previously attributed to Kimsuky. Another recovered malware was a custom version of Dtrack, a remote access Trojan (RAT), with a configuration very similar to one used by Lazarus in an attack against the Indian Kudankulam Nuclear Power Plant in 2019. The researchers also found usage of Putty Plink and 3Proxy, two tools previously observed in other Lazarus campaigns. The overlap with BianLian ransomware was the use of a command-and-control server hosted at an IP address previously used by BianLian attackers. 



Quote for the day:

"Any one can hold the helm when the sea is calm." -- Publilius Syrus

Daily Tech Digest - February 01, 2023

Top 6 roadblocks derailing data-driven projects

Making the challenge of getting sufficient funding for data projects even more daunting is the fact that they can be expensive endeavors. Data-driven projects require a substantial investment of resources and budget from inception, Clifton says. “They are generally long-term projects that can’t be applied as a quick fix to address urgent priorities,” Clifton says. “Many decision makers don’t fully understand how they work or deliver for the business. The complex nature of gathering data to use it efficiently to deliver clear [return on investment] is often intimidating to businesses because one mistake can exponentially drive costs.” When done correctly, however, these projects can streamline and save the organization time and money over the long haul, Clifton says. “That’s why it is essential to have a clear strategy for maximizing data and then ensuring that key stakeholders understand the plan and execution,” he says. In addition to investing in the tools needed to support data-driven projects, organizations need to recruit and retain professionals such as data scientists. 


IoT, connected devices biggest contributors to expanding application attack surface

Along with IoT and connected device growth, rapid cloud adoption, accelerated digital transformation, and new hybrid working models have also significantly expanded the attack surface, the report noted.  ... Inefficient visibility and contextualization of application security risks leave organizations in “security limbo” because they don’t know what to focus on and prioritize, 58% of respondents said. “IT teams are being bombarded with security alerts from across the application stack, but they simply can’t cut through the data noise,” the report read. “It’s almost impossible to understand the risk level of security issues in order to prioritize remediation based on business impact. As a result, technologists are feeling overwhelmed by new security vulnerabilities and threats.” Lack of collaboration and understanding between IT operations teams and security teams is having several negative effects too, the report found, including increased vulnerability to security threats and blind spots, difficulties balancing speed, performance and security priorities, and slow reaction times when addressing security incidents.


Firmware Flaws Could Spell 'Lights Out' for Servers

Five vulnerabilities in the baseboard management controller (BMC) firmware used in servers of 15 major vendors could give attackers the ability to remotely compromise the systems widely used in data centers and for cloud services. The vulnerabilities, two of which were disclosed this week by hardware security firm Eclypsium, occur in system-on-chip (SoC) computing platforms that use AMI's MegaRAC Baseboard Management Controller (BMC) software for remote management. The flaws could impact servers produced by at least 15 vendors, including AMD, Asus, ARM, Dell, EMC, Hewlett-Packard Enterprise, Huawei, Lenovo, and Nvidia. Eclypsium disclosed three of the vulnerabilities in December, but withheld information on two additional flaws until this week in order to allow AMI more time to mitigate the issues. Since the vulnerabilities can only be exploited if the servers are connected directly to the Internet, the extent of the vulnerabilities is hard to measure, says Nate Warfield, director of threat research and intelligence at Eclypsium. 


As the anti-money laundering perimeter expands, who needs to be compliant, and how?

Remember: It’s not just existing criminals you’re looking for, but also people that could become part of a money laundering scheme. One very specific category is politically exposed persons (PEP), which refers to government workers or high-ranking officials at risk of bribery or corruption. Another category is people in sanctioned lists, like Specially Designated Nationals (SDN) composed by the Office of Foreign Assets Control (OFAC). They contain individuals and groups with links to high-risk countries. Extra vigilance is also necessary when dealing with money service businesses (MSB), as they’re more likely to become targets for money launderers. The point of all this is that a good AML program must include a thorough screening system that can detect high-risk customers before bringing them onboard. It’s great if you can stop criminals from accessing your system at all, but sometimes they slip through or influence existing customers. That’s why checking users’ backgrounds for red flags isn’t enough. You need to keep an eye on their current activity, too.


Digital transformation: 4 essential leadership skills

Decisiveness by itself is not enough. A strong technology leader needs to operate with flexibility. The pace of change is no longer linear, and leaders have less time to assess and understand every aspect of a decision. Consequently, decisions are made faster and are not always the best ones. Realizing which decisions are not spot-on and being able to adapt quickly is an example of the type of flexibility a leader needs. Another area leaders should understand is when, how, and from whom to take input when making adjustments. For example, leaders shouldn’t rely solely on customer input to make all product decisions. A flexible leader needs to understand the impact on the development teams and support teams as well. In our experience, teams with decisive and flexible leaders are more accepting of change. This is especially true during transformation. Leaders need to know when and how to be decisive to lead their team to success. In tandem, future-ready leaders can adapt to new information and inputs in today’s fast-paced technology environment.


Pathways to a More Sustainable Data Center

“When building a data center to suit today's needs and the needs 20 years in the future, the location of the facility is a key aspect,” he says. “Does it have space to expand with customer growth? Areas to remediate and replace systems and components? Is it in an area that has an extreme weather event seasonally? Are there ways to bring more power to the facility with this growth?” He says these are just a few of the questions that need to be thought of when deploying and maintaining a data center long term. "Technology may be able to stretch the limits of what’s possible, but sustainability starts with people,” Malloy adds. “Employees that implement and follow data center best practices keep a facility running in peak performance.” He says implementing simple things such as efficient lighting, following management-oriented processes and support-oriented processes for a proper maintenance and part replacement schedule increase the longevity of the facility equipment and increase customer satisfaction. 


Enterprise architecture modernizes for the digital era

Although leading enterprise architects see the need for a tool that better reflects the way they work, they also have concerns. “Provenance and credibility are key, so you risk making the wrong decisions as an enterprise architect if there’s no accuracy in the data,” Gregory says of how EAM tools are reliant on data quality. Winfield agrees, adding: “The difficult bit is getting accurate data into the EAM.” Gartner, in its Magic Quadrant for EA Tools, reports that the EAM sector could face some consolidation, too: “Due to the importance and growth in use of models in modern business, we expect to see some major vendors in adjacent market territories make strategic moves by either buying or launching their own EA tools.” Still, some CIOs question the value of adding EAM tools to their technology portfolio alongside IT service management (ITSM) tools, for example. The Very Group’s Subburaj foresees this being a challenge. “Some business leaders will struggle to see the direct business impact,” he says. 


Career path to CTO – we map out steps to take

Successful CTOs will need a range of skills, including technical but also business attributes. “The ability to advise and steer the technology strategy that is right for the business in the current and changing market conditions is crucial,” says Ryan Sheldrake, field CTO, EMEA, at cloud security firm Lacework. “Spending and investing wisely and in a timely manner is one of the more finessed parts of being a successful CTO.” ... “To achieve a promotion to this level, you need both,” she says. “For most of the CTO assignments we deliver, a solid knowledge base in software engineering, technical, product and enterprise architecture is required, as well as knowledge of cloud technologies and information security. From a leadership perspective, candidates need excellent influencing skills, strategic thinking, commercial management skills, and the gravitas to convey a vision and motivate a team.” There are ways in which individuals can help themselves stand out. “One of the critical things I did that really helped me develop into a CTO was to have an external mentor who was already a CTO,” says Mark Benson, CTO at Logicalis UKI. 


How Good Data Management Enables Effective Business Strategies

Data governance should also not be overlooked as an important component of data management and data quality. Sometimes used interchangeably, there are important differences. If data quality, as we’ve seen, is about making sure that all data owned by an organization is complete, accurate, and ready for business use, data governance, by contrast, is about creating the framework and rules by which an organization will use the data. The main purpose of data governance is to ensure the necessary data informs crucial business functions. It is a continuous process of assessing, often through a data steward, whether data that has been cleansed, matched, merged, and made ready for business use is truly fit for its intended purpose. Data governance rests on a steady supply of high-quality data, with frameworks for security, privacy, permissions, access, and other operational concerns. A data management strategy that encompasses the elements described above with respect to data quality will empower a business environment that can successfully achieve and even surpass business goals – from improving customer and employee experiences to increasing revenue and everything in between.


What Is Policy-as-Code? An Introduction to Open Policy Agent

As business, teams, and maturity progress, we'll want to shift from manual policy definition to something more manageable and repeatable at the enterprise scale. How do we do that? First, we can learn from successful experiments in managing systems at scale:Infrastructure-as-Code (IaC): treat the content that defines your environments and infrastructure as source code. DevOps: the combination of people, process, and automation to achieve "continuous everything," continuously delivering value to end users. Policy as code uses code to define and manage policies, which are rules and conditions. Policies are defined, updated, shared, and enforced using code and leveraging Source Code Management (SCM) tools. By keeping policy definitions in source code control, whenever a change is made, it can be tested, validated, and then executed. The goal of PaC is not to detect policy violations but to prevent them. This leverages the DevOps automation capabilities instead of relying on manual processes, allowing teams to move more quickly and reducing the potential for mistakes due to human error.



Quote for the day:

"Those who are not true leaders will just affirm people at their own immature level." -- Richard Rohr