Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - November 18, 2023

What You Need to Know About Securing 5G Networks and Communication

IoT devices have exploded over the past several years, and this growth shows no signs of slowing down. And all of these devices have one thing in common: Remote connectivity via a public 4G or 5G network, or, increasingly, a private 5G network. This explosion of connected devices creates an expanded attack surface, since the entire network is only as secure as its weakest link. Specifically, just because a network is secure, any devices attached to it that are not secure in how they communicate or receive updates create a breach opportunity. As a result, it’s essential that every device has an identity and each identity is managed. This might sound daunting, but it’s not as complex as it seems at first – it goes back to the building blocks of PKI. Much of the security industry has a handle on running PKI for enterprise networks in their organization (think laptops, mobile devices, and so on). Therefore, security teams are also enabled to do PKI for these smart devices — it’s the same approach for a different endpoint.

To AI Hell and Back: Finding Salvation Through Empathy

Iannopollo said the guides assisting in AI Hell could come from IT, marketing, or the executive team. “All of them understand the incredible opportunity of generative AI and the unparalleled transformative power of the new technology. And they know that without adequate security, privacy, and risk governance.” According to Forrester’s research, 36% of respondents in those groups said privacy and security are the greatest barriers to generative AI adoption, while another 31% said governance and risk were the biggest hurdle. Another 61% cited concerns that GenAI could violate privacy and data protection laws like the EU’s GDPR. “So, concerns exist,” she said. “But remember, Hell is a place of confusion.” As more frameworks come online -- more regulations, there may be less confusion and the guides will help businesses assess their AI adoption. ... Once you are out of AI Hell, like Dante, your story is not complete. Dante had to first stop in purgatory. And after spending time in AI Hell dealing with the questions of risk and threats, businesses will need to figure out a compliance strategy.

Conceptual vs. Logical vs. Physical Data Modeling

“Companies need to do Data Modeling to solve a specific business problem or answer a business question,” summarized Aiken. IT and businesses need to share goals and understanding to get to a data solution. Moreover, there needs to be a common language between systems for data to flow smoothly. However, slapping together any model or a big overarching enterprise architecture will not be helpful. A data model needs to achieve a particular purpose, and getting there requires a systematic process. Aiken’s three-dimensional model evolution framework provides resources for an improved data platform. It considers the existing architecture and the evolution needed to meet business needs and validates that stakeholders and builders are on the same page. A combination of conceptual, logical, and physical data models promises meaningful and useful results, especially where business and IT need to achieve a common objective. Doing the data modeling correctly and understanding requirements frees up 20% time and money for corporations to leverage their data capabilities and get more value from them.

AI: The indispensable ally in the information age

The implementation of AI in data centers must be viewed through a dual lens: risk mitigation and knowledge preservation. As we face a generational turnover in expertise within the industry, with a significant proportion of seasoned professionals retiring, there's an urgent need to capture and transfer this wealth of knowledge. AI and machine learning algorithms, when correctly trained and utilized, can play a crucial role in bridging this knowledge gap. By learning from clean data, and benchmarking and decisions made by experienced personnel, AI systems can emulate, and eventually, enhance these expert-driven processes. This transfer of knowledge is vital not just for maintaining current operational standards, but also for paving the way for more advanced, efficient, and resilient data center architectures. Moreover, AI's potential in managing and reducing operational risks in data centers is monumental. Advanced predictive analytics can foresee and mitigate potential failures, while continuous monitoring AI systems can identify anomalies that hint at future problems, allowing for preemptive maintenance and risk aversion.

Shadowy Hack-for-Hire Group Behind Sprawling Web of Global Cyberattacks

The cybersecurity firm's exhaustive analysis of data that Reuters journalists collected showed near-conclusive links between Appin and numerous data theft incidents. These included theft of email and other data by Appin from Pakistani and Chinese government officials. SentinelOne also found evidence of Appin carrying out defacement attacks on sites associated with the Sikh religious minority community in India and of at least one request to hack into a Gmail account belonging to a Sikh individual suspected of being a terrorist. "The current state of the organization significantly differs from its status a decade ago," says Tom Hegel, principal threat researcher at SentinelLabs. "The initial entity, 'Appin,' featured in our research, no longer exists but can be regarded as the progenitor from which several present-day hack-for-hire enterprises have emerged," he says. Factors such as rebranding, employee transitions, and the widespread dissemination of skills contribute to Appin being recognized as the pioneering hack-for-hire group in India, he says.

Security Firm COO Hacked Hospitals to Drum Up Business

According to the plea agreement, Singla on Sept. 27, 2018, knowingly transmitted a command that resulted in an unauthorized modification to the configuration template for the ASCOM phone system at Gwinnett Medical Center's Duluth hospital campus. As a result, all of the Duluth hospital's ASCOM phones that were connected to the phone system during Singla's transmission were rendered inoperable, and more than 200 ASCOM handset devices were taken offline, the court document says. Those phones were used by Duluth hospital staff, including doctors and nurses, for internal communication, including for "code blue" emergencies. The ASCOM phones were used to place calls outside of the hospital, the court document says. On that same day, Singla - without authorization - obtained information including names, birthdates and the sex of more than 300 patients from a Hologic R2 Digitizer connected to a mammogram machine at Gwinnett's Lawrenceville hospital campus, the document says. The digitizer, which was accessible through Gwinnett's virtual private network, was protected by a password.

How to Structure and Build a Team For Long-Term Success

Leaders have to be careful not to get caught in a situation where somebody could misconstrue their kindness or attention, but being in leadership doesn't have to mean sacrificing gaining friendships. Balance being too friendly with being able to offer necessary corrections. By nature, I tend to be a people pleaser, so I must work on being tougher — especially early in relationships. After my collegiate basketball career ended, I became a high school basketball referee. I found that the whole game went smoother if I was tough in the first quarter of a game. It is important to establish a sense of control when they first hire a new team member, and then they can infuse the second, third and fourth quarters with more friendship. Leaders can have situations that test the relationships they're working to build. Let's say someone has two people on their team, and they have to decide which one gets promoted. The one who didn't get promoted might feel like the leader let them down. Leaders must maintain enough professional distance so that an employee knows it was not due to favoritism in this situation.

Data is Everybody’s Business: The Fundamentals of Data Monetization

Companies get better at data monetization by practicing it. “Rather than wait for the right set of capabilities to magically appear,” Owens says, “businesses should start engaging in monetization activities. The learning and the returns come from doing, not from talking about doing. For starters, organizations could choose one process or product to improve or a single business challenge to solve with data.” Creating data assets also means creating organizational governance so that the right people use the data in the right ways. Data assets can be monetized only after data is properly cleaned, permissioned with the right security, and made accessible to authorized users. “If you aren’t purposely managing and monetizing your data, it won’t pay off,” says Wixom. A big problem with data is that everybody is starting from scratch all the time, says Wixom. “There isn’t enough attention to accumulating knowledge and skills for the future benefit of the organization. But if you create data assets and establish enterprise capabilities to manage them properly, data can be reused limitlessly for all kinds of value-creating reasons across an organization.”

Blockchain could save AI by cracking open the black box

Blockchain is finally being unchained from crypto, and many now see its potential as a foundation of support and validation for another emerging technology -- AI. Blockchain -- and other distributed ledger technologies -- could even help solve AI's black box problem "by providing a transparent, immutable ledger to monitor model training and trace decision-making processes," according to the authors of a new report. "This gives organizations the ability to audit the data and algorithms used, enabling greater security and trust in AI systems." ... "As AI operations go mainstream -- and as people raise concerns about the technology -- leaders are recognizing the need for a more responsible AI that prioritizes data security and transparency," the survey's authors point out. "Ensuring trustworthiness and reliability of their AI tools is a top priority for businesses, and blockchain is the turnkey solution for addressing the risks that come with AI implementation." Executives have developed a greater level of understanding of blockchain. Seventy-seven percent say they fully understand blockchain and can explain the value of it to their teams -- up five percentage points over last year's survey.

FinOps Debuts Cloud Transparency Standards

Given that the project is backed by the largest players in the multi-billion dollar cloud market, several large enterprise-level users such as Goldman Sachs and Walmart, have also backed this initiative. “We are establishing FOCUS as the cornerstone lexicon of FinOps by providing an open source, vendor-agnostic specification featuring a unified schema and language,” says Mike Fuller CTO at the FinOps Foundation. “With this release, we are paving the way for FOCUS to foster collaboration among major cloud providers, FinOps vendors, leading SaaS providers and forward-thinking FinOps enterprises to establish a unified, serviceable framework for cloud billing data, increasing trust in the data and making it easier to understand the value of cloud spend,” Fuller said in a statement. As readers would know, cloud operators provide customers with billing data providing the costs of services they use, which also includes granular details around individual product costs, and discounts, if any. Businesses use this billing data from the service providers to track their spends, forecast future costs and build their SaaS budgets.

Quote for the day:

"Pursue one great decisive aim with force and determination." -- Carl Von Clause Witz

Daily Tech Digest - November 17, 2023

Here is how far we are to achieving AGI, according to DeepMindDeep

Mind presents a matrix that measures “performance” and “generality” across five levels, ranging from no AI to superhuman AGI, a general AI system that outperforms all humans on all tasks. Performance refers to how an AI system’s capabilities compare to humans, while generality denotes the breadth of the AI system’s capabilities or the range of tasks for which it reaches the specified performance level in the matrix. ... DeepMind suggests that an AGI benchmark would encompass a broad suite of cognitive and metacognitive tasks, measuring diverse properties, including linguistic intelligence, mathematical and logical reasoning, spatial reasoning, interpersonal and intrapersonal social intelligence, the ability to learn new skills, and creativity. However, they also acknowledge that it is impossible to enumerate all tasks achievable by a sufficiently general intelligence. “As such, an AGI benchmark should be a living benchmark. Such a benchmark should therefore include a framework for generating and agreeing upon new tasks,” they write.

Utilizing A Business Information Security Officer

Unfortunately, a majority of CISOs are spending their limited time firefighting issues rather than contributing to business strategy or forging relationships. This is where a business information security officer (BISO) can come in. According to Forrester, the BISO operates on behalf of the CISO, serving as an advisor and bridge to functional leaders. In other words, it’s a security role that puts business first. ... Security culture can be defined as the values, attitudes, customs, beliefs, and social behaviors that influence the security posture of an organization. It’s the stuff that drives secure behavior in employees (even when no one’s watching); it’s the security instinct that kicks in when someone sees something unusual or suspicious. Traditionally, most CISOs are not in close contact or communication with employees, and therefore, it is difficult for them to influence and promote a positive security culture. With the BISO role, it's different; since the BISO enjoys closer ties with various business groups and has a better understanding of employee requirements and sentiments, they are better positioned to influence culture change.

Russian Hackers Linked to 'Largest Ever Cyber Attack' on Danish Critical Infrastructure

On the 11 companies that were successfully infiltrated, the threat actors executed malicious code to conduct reconnaissance of the firewall configurations and determine the next course of action. "This kind of coordination requires planning and resources," SektorCERT said in a detailed timeline of events. "The advantage of attacking simultaneously is that the information about one attack cannot spread to the other targets before it is too late." "This puts the power of information sharing out of play because no one can be warned in advance about the ongoing attack since everyone is attacked at the same time. It is unusual – and extremely effective." A second wave of attacks targeting more organizations was subsequently recorded from May 22 to 25 by an attack group with previously unseen cyber weapons, raising the possibility that two different threat actors were involved in the campaign. That said, it's currently unclear if the groups collaborated with each other, worked for the same employer, or were acting independently.

Demystifying Event Storming: A Comprehensive Guide to Understanding Complex Systems

Event Storming is a powerful and collaborative workshop-based technique used to gain a deep understanding of complex systems, processes, and domains. It was introduced by Alberto Brandolini, an expert in domain-driven design and Agile software development. Event Storming stands out as a versatile and practical approach that brings together stakeholders, domain experts, software developers, and business analysts to unravel the intricacies of a system. At its core, Event Storming is a visual modeling method that uses sticky notes and a large workspace, such as a wall or whiteboard, to represent various events and interactions within a system. These events can range from user actions, system processes, and domain events to business rules and policies. The workshop participants collaboratively contribute to this visual representation, creating a shared understanding of the system’s behavior and business processes. Event Storming starts with a domain description, then Big Picture. Big Picture Event Storming is the first step in understanding complex systems.

Integration of Cybersecurity into Physical Security Realm

In this era of evolving cyber threats, integrating cybersecurity into physical security is not a choice but an organizational necessity. In most cases, physical security and cybersecurity work as two sides of the same backbone in the spectrum of security. Physical security protects tangible assets, such as buildings, equipment, and people, from physical threats. On the other hand, cybersecurity focuses on safeguarding digital assets, information, and systems from virtual threats, including hacking, malware, and data breaches. In this context, just as a backbone provides structural support to the body, the integration of cybersecurity into the realm of physical security offers a robust defense for an organization. This fusion of digital and physical security measures creates a comprehensive defense strategy which safeguards firm-specific assets, personnel, and data from various threats. This integrated approach ensures not only the protection of the physical infrastructure but also the prevention of unauthorized access, tampering, and disruptions caused by cyberattacks. It is paramount to understand how cybersecurity enhances physical security systems’ resilience.

Bridging the expectation-reality gap in machine learning

The engineers who wrangle company data to build ML models know it’s far more complex than that. Data may be unstructured or poor quality, and there are compliance, regulatory, and security parameters to meet. There is no quick-fix to closing this expectation-reality gap, but the first step is to foster honest dialogue between teams. Then, business leaders can begin to democratize ML across the organization. Democratization means both technical and non-technical teams have access to powerful ML tools and are supported with continuous learning and training. Non-technical teams get user-friendly data visualization tools to improve their business decision-making, while data scientists get access to the robust development platforms and cloud infrastructure they need to efficiently build ML applications. At Capital One, we’ve used these democratization strategies to scale ML across our entire company of more than 50,000 associates. When everyone has a stake in using ML to help the company succeed, the disconnect between business and technical teams fades. So what can companies do to begin democratizing ML?

Generative AI Solution Architecture for Complex Enterprises

Generative AI tends to be non-deterministic (running it multiple times even with the same input may result in different behaviour each time it is run). Therefore, how we design, manage and test it needs different thinking from more traditional deterministic technologies. As with machine learning in general, maths and algorithms that are inaccessible to the average person (without knowledge of statistics and data science) create issues in understanding and transparency. Add to this the complexity of enterprise architecture (business, data, applications and applications) in modern organisations, and explainability becomes even more difficult. This non-deterministic behaviour also creates consistency, reliability and repeatability challenges. ... Scaling systems powered by machine learning is challenging. Creating an algorithm in a lab environment that comes up with an answer in several hours is OK for a one-off exercise, but simply won’t cut it for real-time customer interaction at scale. It won’t simply be the performance of the ML models; how you integrate these models with enterprise data stores and systems of record will also impact performance.

Why cyber war readiness is critical for democracies

We can’t talk about the war in Ukraine and not mention cyber attacks aimed at disrupting operational technology (OT) used by companies that are part of the country’s critical infrastructure (CI). In his talk, Ferguson briefly passed through the known attacks that hit CI entities with OT-specific malware, starting with Stuxnet in 2010 and ending with CosmicEnergy in 2023. Some of the attacks are believed to be the work of the US and Israel (Stuxnet), cybercriminals or are still unattributed (the destructive 2014 attack against a steel plant in Germany). But the rest, he noted, are all believed to have been mounted by Russian state-backed attackers. And, he says, they are getting better at it. Mirroring the development of attacks against IT systems, they have recently begun exploiting legitimate tools found in OT environments, so they don’t need to develop customized malware. Many attackers are scanning for OT-specific protocols and probing OT devices, Ferguson noted. While their actual exploitation hinges on the skills of the attackers, some modes of attack are available to those who are less skilled, but eager.

Unpatched Critical Vulnerabilities Open AI Models to Takeover

The risk is not theoretical: Large companies have already embarked on aggressive campaigns to find useful AI models and apply them to their markets and operations. Banks already use machine learning and AI for mortgage processing and anti-money laundering, for example. While finding vulnerabilities in these AI systems can lead to compromise of the infrastructure, stealing the intellectual property is a big goal as well, says Daryan Dehghanpisheh, president and co-founder of Protect AI. "Industrial espionage is a big component, and in the battle for AI and ML, models are a very valuable intellectual property asset," he says. "Think about how much money is spent on training a model on the daily basis, and when you're talking about a billion parameters, and more, so a lot of investment, just pure capital that is easily compromised or stolen." Battling novel exploits against the infrastructure underpinning natural-language interactions that people have with AI systems like ChatGPT will be even more impacting, says Dane Sherrets, senior solutions architect at HackerOne.

How to prepare for anything

In Latin, Audi means listen (translated from German horch, which is also the name of Audi’s founder, August Horch). And that is exactly what Mohr decided to do: listen to the questions he and his team were asking themselves. Mohr chose a human approach to understanding how change comes about. It revolves around understanding and embracing the five levels or shades of uncertainty on the journey toward transformation: wonder, skepticism, curiosity, doubt, and creativity. ... “We needed to understand what really matters to our people in order to initiate meaningful change,” Stine Thomssen, who is part of Mohr’s leadership team, recalls. Understanding what really matters to your employees requires insight into their ways of thinking and talking about their everyday practice. This calls for a systematic approach of tapping into the questions people are asking one another in your organization. In the case of the paint shop, it involved setting up several workshops and using a digital platform to engage employees in peer-to-peer conversations about the future.

Quote for the day:

''The manager asks how and when, the leader aks what and why.'' -- Warren Bennis

Daily Tech Digest - November 16, 2023

The Digital Revolution and the Demand for Cyber Insurance

The problem with cyberattacks is this – it’s extremely unlikely that any individual or an organization can bring the potential of an attack down to zero. At the same time, with the advancements in technology – the attacks and risks are going to only get more complex and sophisticated. Hence, even the best firewalls and cybersecurity practices might prove toothless in the face of a highly-coordinated attack. The prognosis gets worse when one looks at the current state of preparedness. ... Cyber insurance policies have proven effective in helping businesses pay off liabilities arising from stolen customer data, compromised passwords, breached bank accounts, frozen databases and a lot more. A comprehensive and dynamic cyber insurance protection becomes necessary for almost every business when one considers the severe reputational damage, regulatory fines, legal charges and customer obligations that arise from a cyber attack incident. The best part about cyber insurance is that many insurers also assist businesses in managing the attack – including response, negotiating ransom, legal proceedings and further protection to prevent a repeat of such attacks in the future.

From PKI to PQC: Devising a strategy for the transition

“Independently of PQC as a topic, one of the challenges often voiced by our customers is that public key infrastructure (PKI) can exist in a company in a broad range of departments, making it difficult centralize the responsibility for and ownership of it,” Jason Sabin, Chief Technology Officer at digital security company DigiCert, told Help Net Security. Companies are solving that problem in different ways. In some cases, they centralize their cryptographic activity under one department and one head. In other cases, they create an acting committee, with stakeholders across the company who influence the direction of their programs. “The companies that have already started to centralize management have an organizational method to request that budget and schedule the activity. But for the organizations that have not, there’s a little bit of an organizational design challenge present. And that’s where, I think, the technology leaders need to partner with the business leaders to come up with the best organizational path forward,” he remarked.

Cisco: Generative AI expectations outstrip enterprise readiness

At the heart of most AI networks will be Ethernet, since high-bandwidth Ethernet infrastructure is essential to facilitate quick data transfer between AI workloads, Cisco stated. “Implementing software controls like Priority Flow Control (PFC) and Explicit Congestion Notification (ECN) in the Ethernet network guarantees uninterrupted data delivery, especially for latency-sensitive AI workloads.” For AI readiness, the Cisco research recommends that enterprises build in automation tools for network configuration in order to optimize data transfer between AI workloads. “Automation reduces manual intervention, improves efficiency, and allows the infrastructure to dynamically adapt to the demands of AI workloads,” the researchers said. ... A core component of the data center AI blueprint is Cisco’s Nexus 9000 data center switches, which support up to 25.6Tbps of bandwidth per ASIC and “have the hardware and software capabilities available today to provide the right latency, congestion management mechanisms, and telemetry to meet the requirements of AI/ML applications,” Cisco stated.

Security Is a Process, Not a Tool

A new approach is required that can be more easily scaled to record and map myriad interactions and processes continuously and at enterprise scale. Enter process mining for cybersecurity. Process mining has existed in numerous industries for over a decade. From enterprise resource management (ERP) systems to robotic process automation (RPA), where mapping a process is the first stage of deployment, capturing human interactions with technology as they run through their jobs is a familiar strategy. However, this approach has not been applied to cybersecurity for a handful of reasons. First, analyzing and cataloging processes is tedious work that many cybersecurity and IT teams prefer to leave to auditors. Asking the cybersecurity or IT or networking teams to add this to their already heavy workloads of monitoring and securing infrastructure and software is unsustainable. Second, while cybersecurity and audit teams have long relied on data collected by agents, that data is largely tied to events and changes in security tools, not on processes.

Info Stealers Thrive in Hot Market for Stolen Data

Despite fierce competition and the ever-present threat of takedowns, info-stealer innovation continues as newcomers debut constantly and existing players refresh their offerings regularly. ... Researchers said the info stealer is being spread through a variety of common distribution tactics, including malicious websites - often disguised as a legitimate installer - as well as drive-by downloads and phishing campaigns. First discovered in 2020, attackers have previously spread the malware using search engine optimization poisoning techniques. At the beginning of 2022, researchers at BlackBerry warned that the malware was often "being bundled with legitimate, signed software" a ploy that "makes it difficult to detect the threat before it has been deployed onto a victim system." Crypto wallets remain one of Jupyter's top targets. The malware searches outright for data files tied to 17 different types of wallets - including Atomic, Guarda, SimplEOS and NEON - as well as for wild-card filenames based on the word "wallet," plus OpenVPN and remote desktop protocol credentials, BlackBerry reported.

Microsoft launches Fabric, adds Copilot for the new platform

Microsoft Fabric is a new environment for data integration, data management and analytics, bringing together a set of capabilities that enable customers to model and analyze data in myriad ways. The suite includes Power BI, Microsoft's longstanding traditional BI platform on which users can develop and consume data products such as reports, dashboards and AI and machine learning models. In addition, Fabric includes Azure Synapse Analytics, a cloud-based service for data integration, data warehousing and big data analytics. Finally, Fabric includes Azure Data Factory, an extract, transform and load service that enables customers to integrate and transform data at scale. In addition to the three formerly separate platforms, Fabric includes a multi-cloud data lake called OneLake that automatically connects to every data workload within Fabric. OneLake comes with shortcuts to data sources such as Azure Data Lake Storage Gen2 and Amazon S3.The combination of the previously disparate platforms in a single environment is designed to simplify data management and analysis, according to Microsoft.

The Importance Of Continuous Testing In Agile And DevOps Environments

By embracing continuous testing, businesses can reduce test cycle times. This accelerated testing process integrates testing seamlessly throughout the development life cycle. As a result, organizations can deliver high-quality software faster, ensuring a quicker time to market. This agility allows them to respond promptly to customer demands, stay ahead of the competition and seize valuable market opportunities. ... Implementing continuous testing can increase collaboration among teams. By fostering effective collaboration and communication between development, testing, and operations teams, organizations can create a seamless integration of testing within their agile and DevOps processes. This alignment enables them to streamline workflows, enhance knowledge sharing, and drive efficient cross-functional teamwork, ultimately resulting in better software quality and faster time to market. ... By prioritizing continuous testing, organizations deliver bug-free and feature-rich products consistently, meeting or exceeding customer expectations.

Five Ways for Digital Trust Professionals to Improve Soft Skills

“Emotional intelligence is the ability to recognize, understand, manage, and effectively respond to one’s own and others’ emotions. The reality is that soft skills and emotional intelligence are even more important than technical skills as predictors of success. “Soft skills are important for auditors and cybersecurity professionals because they facilitate effective communication, build client confidence, foster trust, enhance teamwork and enable a nuanced understanding of organizational dynamics and human behavior, all of which are essential for identifying risks, conveying complex findings and ensuring the successful implementation of recommended security measures. ... Problem-solving: Problem-solving remains a constant need, particularly as AI and LLMs introduce new challenges. The stable importance of this skill indicates that while AI can provide significant data analysis, humans are still needed for ultimate decision-making, especially when ethical or complex considerations are involved."

How US SEC legal actions put CISOs at risk and what to do about it

If CISOs find themselves in this awkward position, step one is to meet with the general counsel and listen to the attorney's reasoning for the changes, Rasch said. If the CISO is still not satisfied, the next step is to meet with the CEO and listen to the chief executive's rationale. If the CISO is still not satisfied, Rasch suggests hiring outside counsel to offer an ostensibly objective assessment of whether the filing constitutes legal fraud. ... After retaining counsel, all subsequent moves are fraught with danger. "If the CISO believes that there has been a fraud to the SEC, the CISO has an obligation to report it to the board. That may itself be corporate suicide," Rasch said, adding that the next move-going to the feds-is even more problematic. "Going to the SEC is crossing the Rubicon." "The CISO is not an expert on SEC disclosures, but you have an officer who now knows that the company made materially false disclosures," Rasch said. "There is a legal obligation for the CISO to do so if the CISO is right. And only if the CISO is right."

Agile Coaching as a Path toward a Deeper Meaning of Work and Life

Agile coaching can only be learned in actual interactions with people, not by learning methodologies or concepts in classrooms. Of course, classroom training, books, and individual coaching can be of great help. However, the main purpose of all this is to build a social setting, where people can develop new ways of participating in conversations about work. In practice, the best way to learn is to participate in various coaching situations with a more experienced coach. The key is to reflect what kind of cooperative patterns emerged in those situations, and how they were handled. It is also important to learn where the focus of agile coaching is. When an expert, such as a software designer, focuses on developing a product, an agile coach focuses on the social patterns that are emerging around that product development. In practice, the coach learns to focus on the conversations and interactions between the software designers and helps to transform the cooperative patterns of product development.

Quote for the day:

"Don't wait for the perfect moment take the moment and make it perfect." -- Aryn Kyle

Daily Tech Digest - November 15, 2023

The IT Jobs AI Could Replace and the Ones It Could Create

Knowledge base managers and data scientists will be essential roles for enterprises as more and more data is fed into large language models (LLMs). “It's still a garbage in, garbage out problem, and if AI will now do more of our work, what we feed them is more important than ever,” says Katz. De Ridder expects to see prompt engineering to emerge as an important skill in the IT field rather than a distinct job. He describes new jobs that could come of the AI boom: agent and multiagent engineers. Agent engineers would maintain and adjust the AI agent processes, while multi-agent system engineers would function as project managers overseeing the complex processes and outcomes supported by multiple AI agents. These jobs will have myriad specializations tied to different fields, according to De Ridder. As more and more AI use cases emerge, IT workers could increasingly be looked at as AI co-pilots. How will they work alongside this technology to improve productivity, and how will they oversee AI capabilities to ensure the desired outcomes?

Microsoft Zero-Days Allow Defender Bypass, Privilege Escalation

But as with every Microsoft monthly update, there are several bugs in the latest batch that security experts agreed merit greater attention than others. The three actively exploited zero-day bugs fit that category. One of them is CVE-2023-36036, a privilege escalation vulnerability in Microsoft's Windows Cloud Files Mini Filter Driver that gives attackers a way to acquire system-level privileges. Microsoft has assessed the vulnerability as being a moderate — or important — severity threat but has provided relatively few other details about the issue. Satnam Narang, senior staff research engineer at Tenable, identified the bug as something that is likely going to be of interest to threat actors from a post-compromise activity standpoint. An attacker requires local access to an affected system to exploit the bug. The exploitation involves little complexity, user interaction, or special privileges. Windows Cloud Files Mini Filter Driver is a component that is essential to the functioning of cloud-stored files on Windows systems, says Saeed Abbasi, manager of vulnerability and threat research at Qualys.

How to infuse strategy into everything your company does

The strategic goal-setting landscape is evolving, moving beyond global companies like Patagonia. It’s shifting from top-down mandates to a dynamic, bidirectional model that fosters ambition and collaboration at all levels. In highly successful organizations like LeanIX, an enterprise architecture management firm, we have watched how OKRs have been both a philosophy and a recipe for success and growth. LeanIX’s use of OKRs is not just a way to break down the company’s strategy and to agree on a common focus for the quarter; it’s an integral part of adopting a growth mindset. This ensures that the entire organization is continuously thinking big, aiming high, and trying out new approaches to achieve the next significant leap. ... Contemporary boardrooms have to echo the aspirations and values of Gen Z, emphasising both diversity and innovation. Merely having organizational strategies and cultural values framed and displayed on walls won’t suffice. They must be actively lived and practiced. Over a third of Gen Z expect leaders to not just lead but inspire. They demand a transparency that goes beyond open communication.

The Art of Digital Continuity: Ensuring Data Availability in Disasters

During disasters, managers and IT employees bear the emotional burden of maintaining a calm and efficient work environment. This emotional labor can lead to stress and burnout, so managing it is key to maintaining productivity and data security during disasters. Here are some ways these professionals can cope with the emotional toll: Communication - Open and honest communication about the disaster’s impact is key for managing emotions. Keeping employees informed can help them feel more in control of the situation. Support - Providing psychological support, such as counseling or mental health resources, can help employees cope with stress and anxiety during a disaster. Training - Prioritizing training on disaster response and emotional management can prepare IT professionals for high-stress situations better. ... Remember that disaster preparedness is not a one-time effort — it requires continuous monitoring, testing, and adaptation to protect valuable data. When disaster strikes and data is lost, the first step is to create a new and improved information security plan.

Four Levels of Agile Requirements

Visioning: This is the initial step of gathering requirements. The goal is to help identify all the Themes and some features desired. This exercise begins to define the scope of what is expected. Brainstorming: The goal of this step is to identify all the features and stories desired. The key here is Breadth First, Depth Later. So instead of discussing the details of each feature and story, our main goal is to FIND all the features and stories. Breakdown: The goal of this step to break down and slice the stories that are still too large (EPICs) into smaller chunks. You probably have already done a lot of slicing during brainstorming, but as you comb your backlog, the team will realize that some stories are still too large to be completed within an iteration. Slicing stories is an art and I will dedicate an entire blog to it! Deep Dive: This is the step everyone wants to jump into right away! Yes, finally, let’s talk about the details. What will be on the screen, what are the exact business rules and how will we test them, what will the detailed process look like, what are the tasks we need to get done to complete this story.

Dynamic Availability: Protocol-Based Assurances

The distinctive feature of proof-based consensus protocols is the fact that the protocol continues to function even when there is only one miner. Therefore miner nodes are free to leave and re-enter the competition at any time. Thus, the protocol maintains availability even under undesirable network conditions. To deal with cases where there are multiple leaders (concurrent solvers of the puzzle), honest nodes follow a simple rule: select the ledger with the highest number of blocks (i.e., the longest chain). In cases where chains have equal lengths, pick the one that you witnessed the earliest. Note that, in the given scenario, there is no way to determine whether there is a set of adversaries that are processing a parallel ledger without informing the rest of the network until their ledger becomes longer than the chain of the benevolent node. When they have a longer chain, they reveal their chain, waiting for the rest of the network to adapt to it, thus effectively ignoring all transactions that were in the neglected blocks. Due to this, one can never be sure whether a transaction is irreversible.

Are firms using mergers and acquisitions to inherit talent?

“I don’t think there’ll be an explosion in the number of acquisitions over the year ahead, but the people and team acquisition element will play a bigger role than in the past,” she says. “Technology is moving so fast that if you acquire a team already working well together on bleeding-edge technology, you can be up and running from day one.” But purchasing a business to get hold of talent is one thing. Holding onto that talent to deliver on the hoped-for value from the acquisition is quite another. The problem here is that if employees are unhappy with the move, feel uncertain about the future, or cannot see any post-deal career progression opportunities, they will simply vote with their feet. ... A key problem with the way many M&A transactions are conducted though, he believes, is that “people tend to come last on the priority list after financing and geography” - even though “you’re asking them to do the equivalent of move home, which because the decision isn’t theirs, can feel threatening”. But Robbins warns: “You fundamentally need to retain people, skills and capabilities if the deal is going to be a success. The business depends on two things - its customers and its staff, and if you’re not giving them what they want, it’s not going to go well.”

Why the Future for Enterprise Success Has to be Agile

Agile solutions enable enterprises to mitigate risks and reduce project failures, gaining a competitive edge and seize new opportunities in the digital age. Through iterative development and continuous feedback cycles, organizations can identify and address potential issues early on. This piece-by-piece approach minimizes the likelihood of costly mistakes and allows for corrections and updates in real-time, ensuring successful project delivery. Working in an Agile way also means that enterprises can be better prepared for the hype points in technology, such as the boom of generative AI this year. Agile enterprises are much better positioned to react and readjust their offerings in real time, addressing the interests of their market, than those with lengthy, drawn-out development timelines. This isn’t to say that Agile enterprises aren’t planning ahead, but instead that they follow a test-and-learn approach, with their plans being flexible and malleable to the ebbs and flows of the market.

Developer Empowerment Via Platform Engineering, Self-Service Tooling

“As a developer the way we build, test and deploy has gotten more complex,” Medina said, in her role play as a developer, lamenting her loss of autonomy in this time of public cloud, serverless workloads and Kubernetes. “Unfortunately that means that, as a developer, if I want to have access to the things that I need when I want them, I’m at the mercy of other teams to bring things up for me. I’m at the mercy of the platform engineering team and I hate waiting for people to do things for me,” she said. Indeed a platform engineering team never is short on backlog items. But often they are stuck performing the operations role so much that they aren’t able to build those golden paths and automation. “OK, as platform engineers, we have the keys to the so-called cloud kingdom, but, listen, it’s not all about you. It’s not all about DevEx. We also have to maintain reliable systems. And it’s too much work and we are super stressed. We are at the point where we are drowning in Jira tickets,” Villela replied, wearing the hat of a platform engineer.

Understanding OWASP’s Bill of Material Maturity Model: Not all SBOMs are created equal

Much as with other industry efforts such as zero trust, the journey towards establishing widespread mature BOMs with sufficient detail and depth will be just that — a journey. That said, resources such as OWASP's SBOM Guide and the BOM Maturity Model can serve as great tools that organizations, software suppliers and consumers can use to mature their implementation of SBOMs and ensure they are providing sufficient insight and details to be used in activities such as software asset inventory, vulnerability management and software supply chain security. ... While the journey may seem daunting, the alternative is continuing the historical status quo of blind software consumption with limited transparency and insight into the software we are consuming, its lineage, who's been involved in it and what has occurred to it along the way. We wouldn't settle for this level of opaque risky consumption in other industries such as food and pharmaceuticals and with software increasingly driving nearly every aspect of society, we shouldn't settle for a lack of transparency here either.

Quote for the day:

"Difficulties strengthen the mind, as labor does the body." -- Seneca

Daily Tech Digest - November 14, 2023

Balancing act: CISOs knife-edge role in modern cybersecurity

Enhanced personal liability and duty of care are becoming increasingly unavoidable for many industries under the NIS2 (Network and Information Systems Directive) - a directive to set higher standards for cybersecurity across the European Union - and DORA (Digital Operational Resilience Act). This change is unnerving for CISOs as their role is officially recognized by regulators, shareholders, and customers. 62% cited concerns about personal liability in a recent global survey by Proofpoint, demonstrating the increased pressures of the role. ... Cybercriminals are already experienced users of AI, with ransomware producers incorporating AI and machine learning techniques into their malware while using it to target specific victims and evade antivirus software detection. Such use of advanced technology is expected to continue as ransomware developers become more proficient in their tactics and multiply the challenges CISOs will face. While AI can automate threat detection and response, it requires an understanding of past threat activity.

Exploring the Role of Consensus Algorithms in Distributed System Design

Consensus, in the context of distributed systems, is the act of getting a group of nodes to agree on a single value or outcome, even if failures and network delays occur. This agreement is vital for the proper functioning of distributed systems, for it ensures that all nodes operate cohesively and consistently, even when they are geographically dispersed. ... At the heart of many consensus algorithms is the concept of Leader election, as it establishes a single node responsible for coordinating and making decisions on behalf of the group. In other words, this leader ensures that all nodes in the system agree on a common value or decision, promoting order and preventing conflicts in distributed environments. Fault tolerance is a critical aspect of consensus algorithms as well, as it allows systems to continue functioning even in the presence of node failures, network partitions, or other unforeseen issues. Consistency, reliability, and fault tolerance are among the primary guarantees offered.

Rogue state-aligned actors are most critical cyber threat to UK

These groups have become emboldened to act with impunity regardless of whether or not they have Russia’s official backing, and the NCSC said it had “concerns” that these groups have a higher risk appetite than those advanced persistent threat (APT) actors – such as Sandworm – that operate as units of the Russian intelligence and military services. This makes them a far more dangerous threat because they may seek to attack CNI operators without constraint and without being able to fully understand, or control, the impact of their actions. The consequences of this could be exceptionally severe. At the same time, Russian APTs continue to advance their goal of weakening and dividing Moscow’s adversaries by interfering in the democratic process using mis- and disinformation and cyber attacks. ... Of particular concern next go round will be large language models (LLM), which will almost certainly be used to generate fabricated content and deepfakes before the election, and a developing trend of targeting the email accounts of prominent individuals, as previously reported.

Fostering an automation-driven operations mindset in enterprises

By embracing automation, companies are changing the way they operate. This can mean rethinking their entire business model to become more profitable and competitive. However, this change is not always easy. Businesses face various challenges, such as dealing with disruptions in the market, figuring out the right number of employees needed for their operations, and keeping up with the ever-changing market conditions. Businesses are recognising that in order to stay relevant and successful, they need to undergo a digital transformation. This means adopting new technologies and ways of doing things to achieve significant positive changes in their operations. Automation has the power to create these changes across all types of industries, including retail, logistics, manufacturing, and the BFSI sector. ... This shift is so significant that the market for industrial automation in India is expected to double from USD 13.23 billion in 2023 to USD 25.76 billion by 2028. This is a clear indication that companies are investing heavily in automation to ensure they remain competitive and up to date with the latest advancements.

MongoDB vs. ScyllaDB: A Comparison of Database Architectures

The MongoDB architecture enables high availability through the concept of replica sets. MongoDB replica sets follow the concept of primary-secondary nodes, where only the primary handles the write operations. The secondaries hold a copy of the data and can be enabled to handle read operations only. A common replica set deployment consists of two secondaries, but additional secondaries can be added to increase availability or to scale read-heavy workloads. MongoDB supports up to 50 secondaries within one replica set. Secondaries will be elected as primary in case of a failure at the former primary. ... Unlike MongoDB, ScyllaDB does not follow the classical relational database management system (RDBMS) architectures with one primary node and multiple secondary nodes, but uses a decentralized structure, where all data is systematically distributed and replicated across multiple nodes forming a cluster. This architecture is commonly referred to as multiprimary architecture. A cluster is a collection of interconnected nodes organized into a virtual ring architecture, across which data is distributed.

Relationship management: The unsung art of optimizing IT teams

Getting the most out of IT staff and unleashing synergies among IT teams is among the more underappreciated skills an IT leader must have to optimize their organization’s efforts. And for that you must develop an uncanny knack for relationship management and an understanding of how differing personalities can enforce and work with one another to great effect. After all, IT brings together a diverse range of personalities, from statisticians, mathematicians, and developers who are rooted in the rigors of computer science, to liberal arts majors who might just as soon be writing a novel if it could pay the bills. So, how do you as an IT leader unify these wide-ranging personalities into a cohesive project team? The short answer is that you don’t try to change anyone. Instead, you seize on common goals most team members have: To see success, feel good about the work they do, and contribute in ways that play to their strengths — while avoiding what they find off-putting or unproductive.

As perimeter defenses fall, the identify-first approach steps into the breach

An identity-first strategy is all about knowing the identity of all humans and non-humans accessing points within the enterprise. In other words, the strategy calls for the organization to know each employee, contractor, and business partner as well as endpoint, server, or application that seeks to connect. It is often also called identity-centric or identity-first security. It's foundational to implementing zero trust because zero trust says trust no entity until that entity — whether human or machine — can authenticate that it is who it says it is and can verify it has been authorized to access the network, application, API, server, etc. that it's seeking to access. ... As Avijit explains, no single solution delivers an identity-first strategy. Rather, it requires a synthesis of policies, practices and technology — like nearly everything else in cybersecurity. Those elements must come together to achieve three key objectives, says Henrique Teixeria, senior director analyst at Gartner, a research and advisory firm.

Collaborative strategies are key to enhanced ICS security

Cooperation between IT (information technology) and OT (operational technology) departments is extremely important to address unique security challenges in industrial sectors. The IT department is usually responsible for managing computer systems, networks, and data, while the OT department manages operating systems, industrial control systems, and sensors. Synergy between these departments allows for a better understanding and confrontation of threats involving industrial control systems. IT teams have expertise in information security, and OT teams have years of experience working with industrial systems. By combining the knowledge of both departments, one can proactively identify and address security vulnerabilities and threats. The advantages of training these departments with each other are many. First, understanding both aspects – INFORMATION and industrial technology – allows for more effective identification and analysis of security challenges that are specific to the industrial sectors.

3 cybersecurity compliance challenges and how to address them

Changes in regulations can be as rapid as the introduction of new products or the emergence of new threats and attacks. Thus, organisations need to be agile enough to keep up with regulatory changes. Unfortunately, not many of us have the ability to do this on our own. Cybersecurity skills shortage continues to be a problem when it comes to compliance. Many organisations lack the right people to properly address cyber threats, let alone continuously monitor regulatory changes. The challenge of keeping up with changing regulations can be addressed with the help of resources that track updates for you. Often, these are related to specific business niches. For companies involved in credit and financial service operations, for example, the cybersecurity alerts of the National Association of State Credit Union Supervisors (NASCUS) provide up-to-date information on the latest regulations that affect those in the business of extending credit and other financial services. There are also regulation monitoring subscription services that provide updates on regulations in general.

Ethical Considerations in AI and Cloud Computing: Ensuring Responsible Develop and Use

Transparency and ethics go hand in hand. With AI, transparency is an essential ethical practice that plays a role in meaningful consent, accountability, and algorithmic auditing. Transparency is essential for driving public acceptance and trust in AI. AI has been accused of having a “black box” problem, referring to the lack of transparency in how it operates and the logic behind its decisions. The use of complex algorithms and proprietary systems contributes to the problem. Ethical practices must address the black box issue by ensuring a high level of transparency in AI development and deployment. ... Assigning responsibility for the outcomes provided by AI-driven systems is perhaps the most important ethical consideration to be considered. If an AI-powered system guiding medical diagnosis makes a decision that leads to failed medical treatment, who should take responsibility? Is the AI developer, the technology firm that deployed the AI, or the doctor ultimately accountable for the bad information?

Quote for the day:

"A leader is one who sees more than others see, who sees farther than others see and who sees before others see.” -- Leroy Eimes