Daily Tech Digest - April 05, 2023

The evolving role of the CHRO in the post-pandemic era

A major landscape shift for CHROs is the advent of HR technologies that can be used as hiring as well as learning and development tools. By collecting and analysing critical HR data, companies can derive actionable insights to improve workforce, people, and talent management performance. Case in point, TDCX’s proprietary Flash Hire recruitment platform enables hiring managers to gauge a candidate’s competency and alignment with the job requirements more quickly through its artificial intelligence (AI) capabilities. ... Actionable insights can be combined with digital tools to boost employee productivity and encourage workers to further their career trajectories through learning and coaching for better outcomes. Additionally, digital tools can help organisations reach out and engage talent globally. While companies innovate their HR strategies by leveraging data analytics and digital tools, such efforts should also be balanced with a human touch. Many companies are already using technology such as robotic process automation and AI to improve hiring, boost employee productivity and encourage learning and career growth, and such instances will only continue to increase.


Three Trends in Enterprise Architecture to Optimize IT Operations

A shift to Continuous Delivery sees each team organize itself around an end-to-end value stream that brings ongoing and longer-term benefits to the business rather than short-term and time-bounded “wins” for individual departments. In addition, a Continuous Delivery approach aims to change the delivery model so that teams can work independently and with less direction rather than competing with one another for resources. ... In this model, each team holds responsibility for the design, operation, realization and future-state direction of their own semi-independent business area. Empowering teams in this way causes a shift in power control, making decision-making more democratic and less centralized. In addition, optimizing collaboration between teams brings about more active conversation and facilitation, resulting in a freer flow of information across the business. In shifting the Enterprise Architect role to a facilitator role than that of a data warden, the democratization of Enterprise Architecture significantly impacts the enterprise, evolving how it operates and the type of tooling it needs for success.


IT Leaders as Advocates for Continual Change

“All IT leaders should keep the concept of constant change top of mind, as it is essential for driving innovation, staying ahead of the curve, and responding quickly to new challenges and opportunities,” he says. Dennis Monner, chief commercial officer at Aryaka, explains businesses are coming to realize that digital transformation is a never-ending process. “As environments change and are on the verge of more change, IT leaders want to be well-prepared and be able to adapt,” he says. This means they need to be continuously evaluating their businesses, as well as different models of operation that may facilitate transformation more smoothly. “IT leaders must recognize when a particular approach may not be working as expected and when a pivot may be necessary,” he says. “Keeping an open mind to continual change means a business is putting the needs of its customers first, rather than forcing customers to adapt and settle for less than they deserve.” If a product or service isn’t resonating with customers, business leaders need to be willing to shake things up, as opposed to continuing down a path that will not yield results.


Top Digital Communication Skills You’ll Need For 2023

Cultural and social sensitivity is a significant part of d igital communication management. Understanding different cultural and social dynamics enables you to become a better business leader, and will help you to develop relevant communication strategies. This is why at BI students receive a grounding in psychological and sociological concepts underlying communication process. Modules such as ‘human interaction’ and ‘human-technology interaction’ educates students on different theories related to identity and diversity. Along with an extensive understanding of how people interact and communicate with each other through technology. ... To excel in a career management, it is vital that you have a clear understanding of the dynamics of communication. At BI, you will be introduced to solid theories and research which revolve around digital communication strategy, social media, network theory, and innovation and corporate storytelling. Our methods course covers the basics of qualitative and quantitative methods such as data handling, recoding, experimental statistics, and digital and social network data analysis.


How Unregulated Access and Advanced Processing Threaten Personal Privacy

Powerful tech companies like Google, Amazon, Meta, and Apple revolutionized data analytics and its use in the private sector. By combining widely collected user activity with behavioral psychology, commercial organizations alter choices that people make, often in the interest of profit maximization. While not illegal, such manipulation challenges the notions of individual choice in a liberal society. However, while processing capabilities have matured, the requirements to secure data during the collection, storage, and analysis phases grow increasingly complex. Companies face endless attempts to exploit networks and servers, keeping cyber security teams busy with ever-evolving threats. Preventing data breaches, such as the 2013-2015 exfiltration of personal information from the United States Office of Personnel Management (OPM), requires skilled technicians and powerful software working around the clock. Perhaps more concerningly, the proliferation of commercially-collected data has led to the rise of data brokers, who profit off the collection and sale of personal information within the current legal limitations of consumer data usage.


Should Every Incident Get a Retrospective?

Try to do this for every incident, and you’ll quickly run into practical limitations. Each incident can take tens of person-hours to study, and meanwhile, more incidents may stack up. At some point, there won’t be enough hours in the day, incident analysts to run investigations or money to spend. You’ll also soon exhaust your organization’s goodwill. Earlier in my career, I learned this lesson the hard way. My site reliability engineering (SRE) team had a keen interest in getting a handle on the growing number of production incidents in our cloud infrastructure. ... High-profile incidents as a whole should give you pause. These are exactly the kinds of incidents that we can learn the most from. However, tensions will run high, and even a company that normally embraces a blameless approach to retrospectives might look for someone to take the fall. Does your incident retrospective have the potential to cause harm to incident participants, or perhaps even termination? It might be best to focus on incidents that are less emotionally charged, especially at companies that are still early on the path toward blameless retrospectives.


UK data regulator issues warning over generative AI data protection concerns

“Organisations developing or using generative AI should be considering their data protection obligations from the outset, taking a data protection by design and by default approach,” said Stephen Almond, the ICO’s director of technology and innovation, in the post. Almond also said that, for organizations processing personal data for the purpose of developing generative AI, there are various questions they should ask themselves, centering on: what their lawful basis for processing personal data is; how they can mitigate security risks; and how they will respond to individual rights requests. “There really can be no excuse for getting the privacy implications of generative AI wrong,” Almond said, adding that ChatGPT itself recently told him that “generative AI, like any other technology, has the potential to pose risks to data privacy if not used responsibly.” “We’ll be working hard to make sure that organisations get it right,” Almond said. The ICO and the Italian data regulator are not the only ones to have recently raised concerns about the potential risk to the public that could be caused by generative AI.


The Data Trifecta: Privacy, Security, and Governance from Reactivity to Resilience

The panelists broadly agreed that bringing together privacy, security, and governance teams to develop a tech-driven model of unified engagement can revolutionize a business’s efficiency and effectiveness. In Sommer’s observations, this form of platform approach cuts down on the number of individual interactions between teams, while at the same time distilling the load of regulatory obligations, all of which makes operations more manageable to support. Streamlining this process allows managers to automate rules and controls into the data in a manner that lets the data flow, “which ultimately means that our privacy teams and security teams can say yes to more projects,” noted Prestidge. “Then our data teams can get access to that approved data much quicker, speeding up all of the processes and reducing the risk.” ... “At the end of the day, the intentions behind most privacy regulations tend to be focused around protecting the consumer,” reflected Sommer. It’s therefore essential for data teams to implement a degree of consistency between promises made to consumers in initial privacy disclosures and the ways in which data is used – and shared – in current operations.


Designing Tabletop Exercises That Actually Thwart Attacks

"The big thing that we want to shoot for in these tabletops is as much realism as we can possibly get," Durrin says. But realism is difficult to simulate. Davidoff jokes about how "we tried using ChatGPT to run a tabletop exercise," and it didn't turn out so well. "It's like: 'I am the facilitator,' and starts walking you through the steps. But it's very boring. It doesn't give you any curveballs." Simulating realism, ironically, requires a good deal of showmanship: storytelling, audio and visual materials, and a certain creativity to generate the chaos and unpredictability you'd find in a cyberattack in real life. But little of this theater is completely made-up. "We try to leverage the experience that we've gained over the years of actually dealing with these attacks in the wild," Durrin notes, ... Enterprises that run these kinds of simulations tend to avoid those mistakes. "We've actually been able to see how those changes that we've made and tested inside of an incident response plan have benefited organizations in a very tangible and real sense," Durrin says, "in the speed of recovery, the quality of recovery and how the organization is actually able to get back on their feet after suffering from an incident."


Attention to detail matters

What about O’Brien’s theory that caring about details is something that you’re born with? I think people can learn to apply more attention to detail. If you give people enough context about why they should care about the little things, they should make the effort to internalize the lesson. That must be what happens in work environments in which people’s lives are on the line, such as operating rooms and airplane cockpits. But what about in the office? In the many years I spent as an editor managing teams of reporters, I learned it was a good practice, when I moved into a role, to tell my new colleagues that I didn’t like corrections—the notes reporters add at the end of an online article that explain how an earlier version got some spelling or fact wrong. I didn’t say it in a threatening way. I just shared it as a fact about me. That approach sent a clear signal that I expected people to check their facts before their piece was published. So, on the nature-or-nurture question, the answer is probably a bit of both—but the advice would be to cultivate a detail-oriented approach if you sense you might not be born with one.



Quote for the day:

"Listening & trusting the inner voice is one of the most important lessons of leadership." -- Warren Bennis

Daily Tech Digest - April 03, 2023

From CDO to CTIO – what tech leader job titles really mean, and who calls the shots

Like CDOs, Chief Technology Officers are very much on the rise. Particularly in technology companies themselves and in start-ups, you are likely to find a CTO at the head of the ship rather than a CIO, and this is also the case in many legacy businesses who are aiming to transform themselves into technology-led organisations: the emphasis on technology in the title better reflects the wider brief of today’s digital leader. So, the CTO role is very much ‘of our times’. There again, the CTO could also be a number two to the CIO who leads all of technology, architecture and/or software engineering. ... Hybrid roles have been very much on the rise recently, especially at the top end. Instead of having ‘just’ a CIO or CDO or CTO, Chief Technology & Information Officers are becoming more common. It’s a role that combines accountability for IT with technology/product delivery. The CTIO will act as an internal advisor to the Board on information strategy, infrastructure and systems as well as being the leader in new product development with an eye to the future and a horizon-scanning mindset.


CIOs must evolve to stave off existential threat to their role

Already under pressure to accelerate digital transformation, CIOs now often find their voices drowned out by LOB executives who are heavily involved in making technology decisions, according to the report. This trend could leave CIOs vulnerable to decreased influence over the corporate technical agenda, or pushed into a secondary C-suite role. ... To ward off LOB heads from their turf, Linus Lai, chief analyst and digital business research lead at IDC A/NZ, says CIOs must be able to demonstrate to other members of the C-suite how their actions and decisions directly boost the bottom and top lines. CIOs should also build stakeholder relationships within LOBs and leverage business relationship managers to better serve customer-facing organizations. “CIOs will have to ensure effective joint business outcomes from IT and LOBs by delivering strategic digital business advice and enabling effective upwards communication. They must initiate a critical review of sourcing practices to manage the supplier ecosystem to maintain architectural goals and spending targets ...


These Experts Are Racing To Protect AI From Hackers

Concerns about attacks on AI are far from new but there is now a growing understanding of how deep-learning algorithms can be tricked by making slight -- but imperceptible -- changes, leading to a misclassification of what the algorithm is examining. ... "Data poisoning can be one of the most powerful threats and something that we should care a lot more about. At present, it doesn't require a sophisticated adversary to pull it off. If you can poison these models, and then they're used widely downstream, you multiply the impact -- and poisoning is very hard to detect and deal with once it's in the model," says Slater. If that algorithm is being trained in a closed environment, it should -- in theory -- be reasonably well protected from poisoning unless hackers can break in. But a bigger problem emerges when an AI is being trained on a dataset that is being drawn from the public domain, especially if people know this is the case. Because there are people out there -- either through a desire to cause damage, or just to cause trouble -- who will try to poison the algorithm.


5 strategies to manage cybersecurity risks in mergers and acquisitions

In tech deals where technology is the target’s product or an important part of it, cybersecurity is a particular focus, said Philip Odence, general manager of Black Duck Audit Business at Synopsys, who specializes in due diligence in M&A transactions. As such, the acquiring company must determine if the target company has designed security into its software. If not, the acquiring company is buying into a bunch of unplanned future remediation work to address, he says. “As excessive problems will mean a heightened chance of getting breached, the buyer might want some portion of funds to be escrowed against such an eventuality,” Odence says. “It’s also not highly unusual for valuation to be negotiated if software is significantly not up to industry norms.” Buyers don’t expect perfection, but if there are more than an expected number of issues to address, the buyer’s perspective on the deal might change, Odence says. It’s rare for due diligence discoveries to kill a deal, but they could impact deal terms, timing, or valuation.


The Anatomy of a Comprehensive Penetration Test

The goal of a penetration test should be to deliver a blueprint for achieving an improved security posture so these organizations can be set up for success. This means including best practices for fixing any issues where specific implementation details are not known by the pentester. It doesn’t stop with just a list of diagnoses for vulnerabilities. A complete inventory of all assets should also be included, with detail on the asset type, IP address, and geolocation information. This will provide visibility into how large an organization’s attack surface is and allow teams to understand which issues should take priority when multiple are found. No asset or resource should be considered “out of scope” when conducting a penetration test. This includes not only the web application itself, but also any external resources that it relies on, including API servers and third-party integrations. Developers may claim that since they didn’t create those resources they shouldn’t be on the hook to secure them, but the organization still needs to be accountable because it is using them. 


The Art Of Letting Go: How Data Minimization Can Improve Cybersecurity And Reduce Cost

One of the biggest challenges organizations face when it comes to implementing data minimization is determining what data is necessary to keep and what can (or should) be disposed of. With the vast amount of data generated and collected every day, it can be overwhelming to know what data you have in the first place, what’s important (or critical or sensitive or regulated) and what data can—or should—be discarded. By reducing the amount of data stored, organizations can decrease their risk of data breaches and improve regulatory compliance. Data minimization can also streamline data management processes, leading to increased efficiency and cost savings. So, how does one begin the process of data minimization? It all starts with knowing your data. Organizations need to have a clear understanding of what data they are collecting, how sensitive it is and how it is being used. This can help identify unnecessary data—often called redundant, obsolete or trivial (ROT) data—that can be safely disposed of.


Five steps to champion a data product strategy

Treating data like a product gives more structure to the ownership, processes, and technology needed to provide the organisation with access to clean, curated, continuously-updated data. So, the data product becomes a consumption-ready set of high-quality, trustworthy, accessible data that can be applied to solve genuine business challenges. In short, it’s the best version of data available to service a defined purpose and achieve a desired outcome for the business. ... The first step once your strategy is signed off is to develop a minimum viable data product (MVDP). Start small so you can release quickly, before iterating and delivering further capabilities. Each release of your data product should offer a little more value. This will help drive adoption, as well as showing returns which will help you secure any additional funding or resources required. Success will of course also depend on your LOB partners understanding how to use the data product as part of their existing working processes. It is rare that adding a new process will be widely and successfully adopted. 


Preventing artificial deception in the age of AI

Managing the concerns without stifling the potential of AI is the key challenge facing regulators across the world. The US has chosen a hands-off approach, encouraging private sector investment and prioritising AI research and development. China has opted for a centralised system focused on economic development and societal governance. The EU has focused more on regulation emphasising transparency, accountability, and protection of human rights. This includes proposed new regulations to establish standards for AI development and deployment, including strict rules for high-risk AI applications and biometric data usage, aiming to build trust in AI through transparency and accountability while ensuring safety and ethical considerations. The UK has adopted what it is calling a pro-innovation approach by enabling current regulators to determine how best to adapt existing regulation to the deluge of AI development and progress using a set of common principles. Whichever approach is adopted, a new regulatory mindset will be required to keep up with the pace of change.


12 ways IT leaders can build business buy-in

Modern CIOs know to speak in business terms and leave the tech jargon behind. But those who are truly intertwined with their business unit colleagues are speaking not only about strategy but key components of it: growth, revenue, profit margin, and so on. As Kande explains, “The business is asking for technology to deliver business outcomes: Are we selling more products and services? Do we have [for example] more visibility into manufacturing or supplies?” ... Another approach Juliano uses to ensure IT and business are in lockstep as they advance organizational objectives is to identify and highlight shared goals. For him, that means in part articulating IT’s piece of initiatives as well as demonstrating IT’s commitment to co-owning success — and, if things don’t go right, co-owning failure, too. “Your IT deliverables should be 100% part of the business’ strategic goals,” he says. “But if you’re making plans and you’re not seeing that there’s a clear IT objective, then you’re reducing your chance of successes and I’d question why you’re not part of that execution. So get your name on those goals so you are seen as a co-deliverer. Make sure your name is primary or secondary owner.”


Digital transformation: How to teach the language of change

While the CIO or CTO is often the first ambassador for a digital transformation, they need close collaboration from their peers to be successful. Those who oversee the processes and the people in the organization must work closely with the CEO to transform all three legs to keep the stool upright. That means the entire C-Suite – chiefs of operations, HR, finance, marketing, communications, and others – must be able to speak the language of digital transformation fluently. It will take some work. The CEO, along with the CTO/CIO, will need to teach their peers what digital transformation is all about and how to make it happen. Then they all need to share a common vision, a shared commitment, and a deep sense of accountability for the success of the digital transformation. ... Anyone who has undergone a digital transformation knows that it is one of the most significant undertakings an organization can face. It reaches into every corner of the business, from operations to customer satisfaction to employee culture. And it sets the tone for the next transformation, whenever that may be.



Quote for the day:

"Not all readers are leaders, but all leaders are readers." -- Harry S. Truman

Daily Tech Digest - April 02, 2023

4 ways to make monolithic enterprise apps feel cloud-native

Fortunately, all hope is not lost if you have an enterprise app you can't containerize or "microservices-ize." Even if you can't "break down your monolith"—to quote the standard advice about how to modernize legacy apps—there are many practical steps you can take to make legacy, monolithic applications look and feel (in most respects) like modern, cloud-native apps. ... Most enterprise apps are compatible with the cloud in the sense that you can host them on cloud-based virtual machine (VM) instances using services from different cloud providers. By taking advantage of cloud hosting for enterprise apps, organizations can also leverage cloud automation tools, such as autoscaling policies and rules that automatically start or stop VMs. Deploying enterprise apps in a highly scalable, automated manner becomes possible. ... Although configuring load balancers for enterprise apps hosted in the cloud is not a strict requirement, doing so can substantially improve application performance and reliability. Load balancers help direct requests at application instances best able to handle them. 


What is Event Sourcing Design Pattern in Microservice Architecture? How does it work?

Event sourcing is a design pattern that stores the state of an application as a sequence of events in the order that they occurred, rather than simply storing the current state of the application. In microservice architecture, this pattern can help in achieving better scalability, fault tolerance, and resilience. Here’s how it works:An event is generated whenever a change occurs in the system. The event is persisted to an event store, which is essentially a log of all events that have occurred in the system. The current state of the system can be reconstructed at any time by replaying all of the events in the event store, in the order that they occurred. Each service in the microservice architecture can have its own event store, which can be used to maintain its own state. Services can subscribe to events that are relevant to them and update their own state accordingly. By using event sourcing, it is possible to achieve better fault tolerance and resilience. 
 

Why Cloud Data Replication Matters

There are many reasons for building applications that understand replication, with or without cloud support. These are basic topics that any developer has had to deal with, but they are even more important when applications go global and/or mobile. Then they need ways to keep data secure and located efficiently. ... As you can see, data replication does not explicitly depend on using cloud resources. Enterprises have been using their internal networks for decades with some of the same benefits. But with the addition of cloud-based resources, the opportunity to have extremely high availability and performance is easier than ever. Traditional data replication has now been extended beyond just replicating from a PC to a network or between two servers. Instead, applications can replicate to a global network of endpoints that serve multiple purposes. Traditionally, replication was used to preserve data in case of a failure. For example, replicas could be copied to a node if there was a failure, but replicas could not be used directly by an application.


Composable Architecture - Part 1

Composable architecture refers to an architectural pattern that allows for the creation of systems made up of small, independent, and interchangeable components. These components can be developed and deployed independently and can be combined together to create new applications or features. In this way, composable architecture is similar to the concept of microservices, where a system is broken down into small, self-contained units that can be managed and developed independently. Today, using Module Federation, it is possible to go beyond micro services and enable independent product squats to build robust micro applications that can be composed into a seamless functionality for both retail and corporate banking clients. ... By using micro frontends, banks can break down their front-end application into smaller, independent components that can be developed and deployed independently. This allows product squads to work independently and develop micro apps that can be composed together on the front end to make it seamless for the banking customer. 


How to Become an Enterprise Architect

An enterprise architect must effectively serve as a central nervous system of the business, making sure its various organs operate in a greater harmony – even when these local channels are out of communication with each other. As you might expect, this almost always comes down to a continuous stream of meetings that scale anywhere from big-picture issues like roadmap orientation and long-term strategies to more nuts-and-bolts implementation and putting out fires. ... While the broad skill set and think-outside-the-box mindset entailed in the job allows for some degree of flexibility, recruiters for potential enterprise architects typically look for an undergraduate degree in computer science or related discipline. Enterprise architects with a master’s degree will have even more solid prospects. Job candidates are expected to have a minimum of five years in the IT field – preferably a decade or more. ... As enterprise architects continue to become more sought after, an aspiring professional will benefit from a resume with certification in skills that custom-fit the position in question.


Tracking the Evolving Cybersecurity Jobs Landscape for 2023

For someone who is looking to start out in cybersecurity, a direct admit role to security is rare, especially as it bypasses the potential growth and opportunities to learn from other positions. Combs recommends finding a path through systems administration or another foundational area that provides contextual information to build on. “You can’t protect an entity if you don’t understand the systems that comprise the entity,” he says. Even as professionals become more experienced in cybersecurity, they must remain committed to their specialization with or without constant acknowledgment of their success. ... “On your best day, nothing happened. And then on your worst day, one shift where something happened, everybody’s like, ‘Why did you let this happen?’ But you’re like, ‘Nothing happened all those other days!’” With more open-source learning and professional development resources available than ever, Combs advises up-and-coming professionals to take advantage of all of them, but advises against bootcamps that make assertions of guaranteed employment.


Cybersecurity experts argue that pausing GPT-4 development is pointless

Despite concerns about the societal risks posed by generative AI, many cybersecurity experts are doubtful that a pause in AI development would help at all. Instead, they argue that such a pause would provide only a temporary reprieve for security teams to develop their defenses and prepare to respond to an increase in social engineering, phishing and malicious code generation. ... “We need a new class of AI trust, risk and security management [TRiSM] tools that manage data and process flows between users and companies hosting LLM foundation models. These would be [cloud access security broker] CASB-like in their technical configurations but, unlike CASB functions, they would be trained on mitigating the risks and increasing the trust in using cloud-based foundation AI models,” Litan said. As part of an AI TRiSM architecture, users should expect the vendors hosting or providing these models to provide them with the tools to detect data and content anomalies, alongside additional data protection and privacy assurance capabilities, such as masking.


Overcoming obstacles to introduce zero-trust security in established systems

Even small and midsize enterprises have undergone significant changes in recent years. To become more flexible, they embraced trends like remote work, BYOD, decentralized IT, and moved their operations to the cloud. It is not an exception that a business has no private network but naturally still has systems, apps, data and employees that need protection from still growing online threats. When balancing the security of this new reality with the needs of remote workforce, it is not only about the technology, which should be easy to use, reliable and not disturbing to the user, but also about employee education. Employees should be trained in new policies so that they don’t resist the new security procedures, but actively contribute to them. To give an example, multifactor authentication should not be seen as a nuisance but a standard part of logging in and second nature to all employees. Regular phishing drills should be conducted to train workers in spotting and reporting them.


Tech Titans: The crossroads of humanity and technology

“You cannot escape technology – tech is intertwined no matter what we do; it has become a utility like water, heat, and electricity. Not having access to technology can be detrimental to having access to the essentials of daily life. We need to work together to ensure that everyone – especially the underserved and disenfranchised communities – have access to technology.” ... But technology by itself is not the only deterrent, Hannah noted. Even if technology is available, the cost could be a challenge in such communities – especially when for those who struggle to provide necessities like food. Literacy in these communities is another key challenge. Pegues characterizes digital redlining as a socio-economic problem at the crossroads of humanity and technology, which triggered a question about technology’s ability to combat digital redlining. While acknowledging that “old habits are hard to break,” Pegues also called out the possibility of detecting and addressing the algorithms that advance this practice.


Why AI Could be Critical in Reducing the Court Backlog

Today, nearly every criminal investigation includes a substantial digital evidence component, whether that be texts, WhatsApp messages, emails, internet browser histories, or data from GPS devices and fitness trackers. Research conducted by the University of Exeter in conjunction with the UK police force, found that digital forensics are now used in over 90% of criminal cases. But our ever-growing digital footprint presents a significant challenge for criminal defence lawyers who now need to review unprecedented volumes of data ahead of trial. Legal teams that fail to thoroughly analyse all this information are at risk of not meeting evidentiary thresholds, as in the case of Liam Allan, where 40,000 text messages were omitted from evidence and caused the case to fall apart at the last minute. The pandemic may have prompted the UK courts to revise traditional methods of working and embrace new technology, such as video conferencing software for remote trials, but there is still much work to be done. 



Quote for the day:

"A leader or a man of action in a crisis almost always acts subconsciously and then thinks of the reasons for his action." -- Jawaharlal Nehru

Daily Tech Digest - March 30, 2023

5 cyber threats retailers are facing — and how they’re fighting back

Retailers are vulnerable to a range of direct e-commerce cyber threats far beyond ransomware. They include hackers altering gift cards and/or the systems used to activate and manage them, swapping barcodes on products to deceive self-checkout systems, defrauding return services via online return forms to obtain refunds for ordered items, hijacking customer accounts to steal their personal information, and stealing credit card numbers through digital skimming. Bot attacks on e-commerce sites are another threat that can’t be ignored. These automated scripts can use a browser to emulate human behavior, including mouse movements and clicks, making them difficult to detect. Advanced bots can hide their real location by routing traffic through anonymous proxies, anonymization networks, or through public cloud services. Bots can facilitate account takeover, through which hackers make fraudulent purchases using data from customer accounts such as gift cards, discount vouchers, and loyalty points, and even saved credit card information.


Google ambushes on-prem PostgreSQL with AlloyDB Omni

Self-managed AlloyDB Omni provides a pathway to modernize legacy databases on-premises before moving to the cloud, analysts said. “Database migrations can be complex and costly, especially when combined with migration from on-premises infrastructure to cloud. AlloyDB Omni provides a pathway for organizations to modernize those workloads in-place by migrating to AlloyDB Omni on-premises,” said Matt Aslett, research director at Ventana Research. “This move can be seen as one step prior to a potential move to the AlloyDB managed service, or with a view to retaining the workloads in on-premises data centers or on edge infrastructure due to sovereignty or performance requirements,” he added. According to Omdia’s Chief Analyst Bradley Shimmin and dbInsight’s Principal Analyst Tony Baer, AlloyDB Omni combines the best of open-source PostgreSQL and Google Cloud’s architecture, making it more appealing than rival services such as AWS Aurora for PostgreSQL and Microsoft’s CitiusDB, among others.


How to Succeed As a New Chief Information Security Officer (CISO)

As a CISO, you probably have an endless to do list of vital chores that can keep you preoccupied. FFor this reason, you may be cut off from your coworkers and superiors, limiting your exposure to strategic and operational information shared through informal channels such as one on ones, small group brainstorming sessions, and, yes, even boring meetings. Stay in touch with your mentor(s) as you make this shift. Having a clear idea of your challenges and working with a coach can help your CISO first 90 days and adjust more smoothly. Participate in the discussion to better understand the company’s goals, potential, and threats. Building productive relationships with employees and other divisions is crucial to your success as a chief information security officer. Coordinate early on with the major players by setting up a meeting schedule. Determine which divisions you will work with, such as legal, audit, risk, marketing, and sales. As a result, we will be better able to establish connections to facilitate the rollout of cybersecurity awareness campaigns and related policies. The CISO needs to work in tandem with other executives.


Why it is time all businesses became data-driven

Encouragingly, the future of data skills is in safe hands. Data from the British Computer Society (BCS) recently revealed that interest in computing degrees is growing more than other courses. According to BCS data, 92,980 18-year-olds applied to start computing degrees this year in the UK, a 9.6% rise demonstrating the sector’s continued appeal. The Society believes that increasing interest in the degree course was likely a result of the higher profile of AI and a realisation about the career prospects for computing graduates in areas like cyber security and climate change data science. For those organisations looking to increase their data skills sooner, though, several programmes in the market can match you with a data scientist. As the now old adage goes – data is the new oil. With its value likely to continually increase, those organisations that do not recognise its value will undoubtedly be left behind, allowing competitors to overtake them. With no sign of market conditions easing, now is the time to evolve. Not doing so could be devastating.


Clouds vs Edges: Which Computing Wins the Race?

One of the key benefits of edge computing is its ability to reduce latency, or the delay between a user’s request and the response. With traditional cloud computing, data is sent to a central data center for processing, which can result in latency that is too long for certain applications. Edge computing can help address this issue by bringing computation closer to the source of the data, reducing the time it takes to process the data. Another advantage of edge computing is its ability to support real-time data processing and analysis. Edge computing allows applications to react quickly to changes in data by processing it closer to where it is being produced, which is crucial for applications that require real-time data processing, like self-driving cars and industrial automation. ... Both edge computing and cloud computing are critical components of modern computing infrastructure, and each has its advantages and disadvantages. Edge computing enables data processing and analysis to occur closer to the source of data, resulting in lower latency, improved reliability, and greater security. 


CEOs feel responsible for security, but ill at ease on stepping up

This gap in perception, according to the research, lies partly in the meaning of accountability: instead of seeing themselves as accountable – being the face of the mistake – CEOs should assume co-responsibility for cyber resilience together with their CISO. Second, CEOs should stay away from blindly trusting their technology teams. Instead, they should move to a state of informed trust about their enterprise’s cyber resilience maturity. Third, CEOs should embrace what the authors call the “preparedness paradox” — an inverse relationship between the perception of preparedness and resilience. The better-prepared CEOs think their organisation is for a serious cyberattack, the less resilient their organisation likely is, in reality. And fourth, CEOs should adapt their communication styles to regulate pressure from external stakeholders who have different and sometimes conflicting demands. Depending on the stakeholder and the situation, CEOs should either be a transmitter, filter, absorber or amplifier of pressure.


Why exams intended for humans might not be good benchmarks for LLMs like GPT-4

Exams designed for humans assume that the test-taker already possesses these preparatory skills and knowledge, and therefore do not test them thoroughly. On the other hand, language models have proven that they can shortcut their way to answers without the need to acquire prerequisite skills. “Humans are presumably solving these problems in a different, more generalizable way. Thus we can’t make the assumptions for LLMs that we make for humans when we give them tests,” Mitchell said. For instance, part of the background knowledge for zoology is that each individual is born, lives for a while and dies, and that the length of life is partly a function of species and partly a matter of the chances and vicissitudes of life, says computer scientist and New York University professor Ernest Davis. “A biology test is not going to ask that, because it can be assumed that all the students know it, and it may not ask any questions that actually require that knowledge. But you had better understand that if [you’re going to be] running a biology lab or a barnyard,” Davis told VentureBeat.


12 Places to Intervene - Rethink FinOps Using a Systems Thinking Lens

When we analyze a problem, we often try to look for certain points or places where we can focus our efforts to gain maximum leverage on the system to achieve our desired outcome. For example, if you are in a situation to lift a motorbike that’s fallen down, you don’t pull up from every part that you can hold on to. Instead, you find the best part and a way to hold (based on the bike design and your strengths) to pull up with the least effort and damage. Similarly, for complex socio-technical systems, Donnella Meadows, in her book Thinking in Systems, proposes 12 places where you can "intervene" to achieve maximum impact. These are known as leverage points or points of intervention. A system intervention is a deliberate effort to change or improve a system’s behavior, processes, or outcomes. It involves identifying problems and implementing changes to improve the overall functioning of the system. Donella Meadows introduces the 12 leverage points in the increasing order of leverage. 


Employee engagement: Why it matters

A dominant theme that emerged in Professor Heskett’s research is that organizations “lack leadership talent with the attitude, training, and willingness to devote time to the difficult task of engagement.” Too often, he points out, “an annual employee survey is taken, trends analyzed and reported back, opportunities for improvement discussed … and management returns to handling other primary responsibilities.” Dr. Heskett’s research also suggests that managers often put too much emphasis on “making the numbers” to the exclusion of other goals. On the other hand, if employee engagement is the goal, “making the numbers” would come much more easily. According to Heskett, engaged workers are more likely to remain on the job, are more productive and higher-performing, and foster higher levels of customer engagement – all of which boost profits and growth. Assessing and evaluating workplace engagement levels can be challenging, and there’s no single standard approach.


Examining key disciplines to build equity in the IT workplace

It can be difficult for women to have a sense of belonging facing these challenges. Speaking of the senior tech leader at the leadership table, there’s underrepresentation of women and even more underrepresentation of Black women. So resilience, fuelled by self reliance and confidence, helps to navigate a career path. “Being in a minority can bring self-doubt, especially if you’re in an environment that isn’t supportive or causes doubts,” she says. “So know the value you bring to the table and the difference you’re making. Some environments are going to appreciate this more than others, but it’s important you don’t let others minimize your contributions. For example, if you work hard and lead your team to launch a tech solution that positively impacts the organization’s bottom line, that is value you can quantify. Having said that, we still have a ways to go about women in tech still being overlooked and passed over for promotions. The numbers are getting better, but we’re still there.”



Quote for the day:

"Teamwork is the secret that make common people achieve uncommon result." -- Ifeanyi Enoch Onuoha

Daily Tech Digest - March 29, 2023

9 Qualities of a Successful CTO

No one expects CTOs to be fortune tellers, but they do need to have a strong sense of what’s going on in the technology marketplace. A good CTO anticipates what is likely to come along in terms of new products, features, and challenges to address.You can be the best technologist and strategist in the world, but it won’t matter if you are unable to communicate those strategies in a way that speaks to your audience. “To excel as a CTO, it is essential to have a keen ability to identify technology trends ahead of the curve,” says Aron Brand, CTO of CTERA, a provider of cloud-based products. “A successful CTO is always on the lookout for the latest advancements in technology, having a deep understanding of the industry and anticipating future developments,” Brand says. “This allows them to make informed decisions about which technologies to invest in and which to avoid. They have the foresight to see the big picture and understand the long-term impact of their decisions, while also considering the immediate needs of the organization.”


ChatGPT Data Breach Confirmed as Security Firm Warns of Vulnerable Component Exploitation

According to OpenAI’s investigation, the titles of active users’ chat history and the first message of a newly created conversation were exposed in the data breach. The bug also exposed payment-related information belonging to 1.2% of ChatGPT Plus subscribers, including first and last name, email address, payment address, payment card expiration date, and the last four digits of the customer’s card number. This information may have been included in subscription confirmation emails sent on March 20 and it may have also been displayed in the subscription management page in ChatGPT accounts on the same day. OpenAI has confirmed that the information was exposed during a nine-hour window on March 20, but admitted that information may have been leaked prior to March 20 as well. “We have reached out to notify affected users that their payment information may have been exposed. We are confident that there is no ongoing risk to users’ data,” OpenAI said in a blog post.


5 ways to tell you are not CISO material

By definition, a CISO's role is to manage cyber risk. That involves assessing and managing risk across the enterprise and making choices based on those assessments. If you are not able to make risk-based decisions or have a hard time figuring out how to prioritize threats — particularly in high-pressure, high-stress situations — you probably want to steer clear of the CISO role. The same is true if you have a tendency to avoid taking responsibility for your decisions and actions. The CISO role is not for individuals who are averse to taking responsibility for an action they might advocate or implement, according to Chris Pierson, founder and CEO of Blackcloak. "If you approach things from the perspective of a CYA, adversarial, or risk avoidance mentality then you may decrease your ability to partner with others to achieve a combined mission or goal," Pierson tells CSO. "Being someone who cannot tolerate, or own risk, may impact your ability to operate effectively and turn off other people to partnering with you."


Being Responsible for Data

There are four possibilities listed in the article for what could happen, and I find them fascinating from a data analysis standpoint. Essentially a ruling against tech companies could shape how many of these companies process data in the future. While we might like to ensure these companies do not promote harmful content, think about this from the data analysis view? Do you want these companies to moderating how they provide results? Would this mean that we need to more carefully craft our search terms? In the context of tremendous floods of information, we often depend on Google, Bing, or some search algorithm to distinguish among the various meanings of words to bring back results relevant to us. At the same time, we might wish that everyone got the same results from the same search terms. Separate from the results, what about related results, or suggested items that might be related. I find the quality of these can vary for me, but often there is something "sponsored" or "I might like" that is helpful to me. Or just interesting. 


How CISOs Can Reduce the Danger of Using Data Brokers

"Due to the increasing regulatory compliance framework regarding data collection notice and consent, there are data brokers that have huge subsets of their data that is not 'clean' and they cannot make reps and warranties about it to third parties that want to leverage that data," says Sean Buckley, an attorney with law firm Dykema who specializes in data privacy issues. "The risk to the data broker circles back to whether their data is 'clean' and whether they can prove it if necessary." ClearData CISO Chris Bowen argues that data tracking is critical when dealing with purchased files, but it can also prove quite difficult — even impossible — if the organization didn't tag it sufficiently from the beginning. "You need to closely track where the data lives and where it flows," Bowen says. "You need to tag the source of each field in the database. You need consistent links through petabytes of data, structured and unstructured." Most security executives are not comfortable with this approach because dataflow analysis is outside of their usual remit, he adds.


Unlocking Digital Business Transformation Success

It is often misunderstood that technology is at the heart of digital transformation. Although technology could create exponential possibilities in the current digital economy, it is really the transformation part—the journey an organization takes with its ecosystem of people—that creates the solid foundation to accelerate these opportunities. Buy-in is essential for achieving long-term sustained success in the context of digital business transformation, where initiatives may be complex and significantly impact the business. There are a few inventive strategies that can successfully gain people’s buy-in and influence them to change both their attitudes and behaviors. To start, trust and empathy are the foundational components that lay the groundwork for buy-in and effective collaboration, and it is at the center of digital transformation strategies. The role of the leadership team shifts from being directive to one that promotes a safe, open and trustworthy environment. Another key element in engaging the human element for transformation is to focus on adding value.


UK DPDI bill seeks to reform GDPR - here's what you need to know

"Clarifications around legitimate interests, scientific research and automated decision making are bound to make it easier for companies to explore the potential of new technologies and AI without worrying about the risk of technical non-compliance with rules that lack clarity," he told TechRadar. From a user's perspective, the proposal is said to also be advantageous in coping with the issues of the so-called "pop-up fatigue." The term describes the act of consumers clicking away their rights of privacy in order to escape repetitive and annoying cookies. "But users will probably see little practical differences. Cookie consents will still be needed for many advertising-related cookies (and many businesses may adopt a single EU-level approach). This is at least until browser based controls are more developed," said Patrikios ... "The DPDI Bill is a power grab by the government that will undermine data rights in the UK. The bill weakens data subjects rights and corporate accountability mechanisms, politicizes the ICO, and expands the Secretary of State’s powers in numerous, undemocratic ways," said Abigail Burke


Why a College Degree is No Longer Necessary for IT Success

“Some the most talented, brilliant technical professionals I know … who are currently leading top tech research roles and holding executive positions at prestigious organizations, do not have degrees,” she says. “Smart organizations recognized their talent; their success speaks for itself.” With many IT skills, including software development and data science, it’s important for learners to gain hands-on experiences where they're practicing and applying their skills in real-time, observes Mike Hendrickson, vice president of tech and dev products at educational technology firm Skillsoft. “Many online learning platforms provide interactive, flexible training solutions that meet people where they are, whether they're learning independently or within their organization.” Hendrickson believes that online training can be far more efficient than a four-year college program. “Another benefit is this training can be tailored to company-specific or industry-focused content and solutions, so learners can practice and apply their skills to real work environments and scenarios,” he explains.


6 ways to avoid and reduce data debt

Like technical debt, data debt is easier to identify after its creation. Data debt often requires teams to refactor or remediate the issues before building data pipeline improvements or new analytics capabilities. Implementing best practices that minimize new data debt is harder, especially when teams can’t predict all the future analytics, dashboarding, and machine learning use cases. Michel Tricot, cofounder and CEO of Airbyte, says, “Debt is not bad. However, debt needs to be repaid, which should be the focus because important decisions will be made with the data.” ... “Data observability is when you know the state and status of your data across the entire life cycle,” says Grant Fritchey, devops advocate at Redgate Software. “Build this kind of observability when you set up a dataops process to know if and where something has gone wrong and what’s needed to fix it.” Grant also says that data observability helps communicate data flows to business users and establishes an audit trail to support debugging and compliance audits.


The Role of Human Resources in Cybersecurity

Developing an effective cybersecurity awareness training program requires a balance between providing enough information to be useful and not overwhelming. Human resources’ expertise with employees through the years is an invaluable resource for creating cybersecurity training programs that are engaging and frequent (but not too frequent). The CIO, on the other hand, is an essential partner in training employees on cybersecurity. The CIO’s role is to work with the human resources department to ensure their technology needs are met and help guide them to more effective solutions. The CIO is also a partner for employee recruitment, hiring and retention, especially for IT and security professionals. The CIO can affect organizational change by partnering with human resources and IT to develop an integrated cybersecurity awareness training program for employees of all technical proficiencies. Building upon HR’s close connection with every employee, the CIO can lead the way in building a culture of cybersecurity.



Quote for the day:

"Leadership is the wise use of power. Power is the capacity to translate intention into reality and sustain it." -- Warren Bennis