Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - June 15, 2024

Does AI make us dependent on Big Tech?

The assumption is that banks would find it impractical to independently develop the extensive computing power required for AI technologies. Heavy reliance on a small number of tech providers, would pose a significant risk, particularly for European banks. It is further assumed that these banks need to retain the flexibility to switch between different technology vendors to prevent excessive dependence on any one provider, a situation also known as vendor lock-in. And now they want to get the governments involved. The U.K. has proposed new regulations to moderate financial firms’ reliance on external technology companies such as Microsoft, Google, IBM, Amazon, and others. Regulators are specifically concerned that issues at any single cloud computing company could disrupt services across numerous financial institutions. The proposed rules are part of larger efforts to protect the financial sector from systemic risks posed by such concentrated dependence on a few tech giants. In its first statement on AI, the European Union’s securities watchdog emphasized that banks and investment firms must not shirk boardroom responsibility when deploying AI technologies.

How To Choose An Executive Coach? Remember The 5 C’s

A lot of people might put Congruence first, but if you don’t have Clarity the interpersonal dynamics are a moot point—it’s not just about liking your coach. Once you are clear on your goals and outcomes then you should seek a coach with whom you are willing to be psychologically vulnerable. You should test the potential coach to see if their style resonates with yours. For example, are they direct enough for you? Are they structured and organized, if you need that? ... You should be looking for Credibility—that is, relevant knowledge and expertise. You’ll learn the most by asking questions to explore the coach’s experience and track record. Has the coach worked with other executives at your level? Do they have a frame of reference for your situation and what you are grappling with? Have they worked in a similar environment and successfully coached others with similar challenges? Do they understand the corporate world and the politics of your type of organization? One thing to keep in mind is that many executives today are not just looking for a coach to help them with finding their own solutions, but also for “coach-sulting”—which may include advice and counsel on leadership, strategy, organizational development, team building and tactical problem-solving.

New Research Suggests Architectural Technical Debt Is Most Damaging to Applications

“Architectural challenges and a lack of visibility into architecture throughout the software development lifecycle prevent businesses from reaching their full potential,” said Moti Rafalin, CEO and co-founder of vFunction, a company promoting AI-driven architectural observability and sponsor of the study. “Adding to this, the rapid accumulation of technical debt hampers engineering velocity, limits application scalability, impacts resiliency, and amplifies the risk of outages, delayed projects, and missed opportunities.” Monolithic architectures bear the brunt of the impact, with 57% of organizations allocating over a quarter of their IT budget to technical debt remediation, compared to 49% for microservices architectures. Companies with monolithic architectures are also 2.1 times more likely to face issues with engineering velocity, scalability, and resiliency. However, microservices architectures are not immune to technical debt challenges, with 53% of organizations experiencing delayed major technology migrations or platform upgrades due to productivity concerns.

Surge in Attacks Against Edge and Infrastructure Devices

Not just criminals but also state-sponsored attackers have been exploiting such devices, Google Cloud's Mandiant threat intelligence unit recently warned. One challenge for defenders: Many network edge devices function as "black boxes which are not easily examined or monitored by network administrators," and also lack antimalware or other endpoint detection and response capabilities, WithSecure's report says. "It is difficult for network administrators to verify they are secure, and they often must take it on trust. Certain types of these devices also provide edge services and so are internet-accessible." Many of these devices don't by default produce detailed logs that defenders can monitor using security incident and event management tools to watch for signs of attack. "These devices are supposed to secure our networks, but by itself, there's no way I can install an AV client on it, or an EDR client, or say, 'Hey, give me some fancy logs about what is happening on the device itself,'" said Christian Beek, senior director of threat analytics at Rapid7, in an interview at Infosecurity Europe 2024.

Edge Devices: The New Frontier for Mass Exploitation Attacks

The attraction to edge devices comes from easier entry; and they provide easier and greater stealth once compromised. Since they often provide a continuous service, they are rarely switched off. Vendors design them for continuity, so purposely make them difficult or impossible for administrator control beyond predefined options. Indeed, any such individual activity can void warranties. They frequently do not produce logs of their activity that can be analyzed by SIEMs, and they cannot be monitored by standard security controls. In this sense they are similar to the OT demand for continuity — why fix something that ain’t broke? Until it is broke, by which time it is probably too late. The result is that edge devices and services often comprise software components that can be decades old involving operating systems that are well beyond end of life; and they are effectively cybersecurity’s forgotten man. Once inside, an attacker is hidden and can plan and execute the attack over time and out of sight. “Edge services are often internet accessible, unmonitored, and provide a rapid route to privileged local or network credentials on a server with broad access to the internal network,” says the report.

Quantum Computing and AI: A Perfect Match?

Quantum AI is already here, but it's a silent revolution, Orús says. "The first applications of quantum AI are finding commercial value, such as those related to LLMs, as well as in image recognition and prediction systems," he states. More quantum AI applications will become available as quantum computers grow more powerful. "It's expected that in two-to-three years there will be a broad range of industrial applications of quantum AI." Yet the road ahead may be rocky, Li warns. "It's well known that quantum hardware suffers from noise that can destroy computation," he says. "Quantum error correction promises a potential solution, but that technology isn't yet available." ... GenAI and quantum computing are mind-blowing advances in computing technology, says Guy Harrison, enterprise architect at cybersecurity technology company OneSpan, in a recent email interview. "AI is a sophisticated software layer that emulates the very capabilities of human intelligence, while quantum computing is assembling the very building blocks of the universe to create a computing substrate," he explains.

How to Offboard Departing IT Staff Members

Some terminations are not amicable, however, and those cases require immediate action. The IT department must implement an emergency revocation procedure that involves the instantaneous deactivation of all of the employee’s access credentials across all systems. Immediate action minimizes the risk of retaliatory actions or data breaches, which are heightened concerns in such scenarios. ... Departing employees often leave behind a trail of licenses and subscriptions for various software and online services used during their tenure. IT departments must undertake a thorough assessment of these digital assets to determine which licenses remain necessary, which can be reallocated and which should be terminated, based on current and anticipated needs. ... Hardware retrieval is an aspect of offboarding that requires at least as much diligence as digital access revocation — and often more, given the number of remote employees that many businesses have. All devices issued to employees — laptops, tablets, smartphones, ID cards and more — must be returned, thoroughly inspected and wiped of sensitive information before they are reassigned or decommissioned.

Integrating Transfer Learning and Data Augmentation for Enhanced Machine Learning Performance

Concretely, the first step consists of applying data augmentation techniques, including flipping, noise injection, rotation, cropping, and color space augmentation, to augment the volume of target domain data. Secondly, a transfer learning model, utilizing ResNet50 as the backbone, extracts transferable features from raw image data. The model’s loss function integrates cross-entropy loss for classification and a distance metric function between source and target domains. By minimizing this combined loss function, the model aims to simultaneously improve classification accuracy on the target domain while aligning the distributions of the source and target domains The experiments compared an enhanced transfer learning method with conventional ones across datasets like Office-31 and pneumonia X-rays. Different models, including DAN and DANN, were tested using various techniques like discrepancy-based and adversarial approaches. The enhanced method, incorporating data augmentation, consistently outperformed others, especially when source and target domains were more similar.

OIN expands Linux patent protection yet again (but not to AI)

Keith Bergelt, OIN's CEO, emphasized the importance of this update, stating, "Linux and other open-source software projects continue to accelerate the pace of innovation across a growing number of industries. By design, periodic expansion of OIN's Linux System definition enables OIN to keep pace with OSS's growth." Bergelt explained that this update reflects OIN's well-established process of carefully maintaining a balance between stability and incorporating innovative core open-source technologies into the Linux System definition. The latest additions result from OIN's consensus-driven update process. "OIN is also trying to make patent protection more accessible," he added. "We're trying to make it easier for people to understand what's in there and why it's in there, what it relates to, what projects it relates to, and what it means to developers and laymen as well as lawyers." Looking ahead, Bergelt said, "We made this conscious decision not to include AI. It's so dynamic. We wait until we see what AI programs have significant usage and adoption levels." This is how the OIN has always worked. The consortium takes its time to ensure it extends its protection to projects that will be around for the long haul.

Beyond Sessions: Centering Users in Mobile App Observability

The main use case for tracking users explicitly in backend data is the potential to link them to your mobile data. This linkage provides additional attributes that can then be associated with the request that led to slow backend traces. For example, you can add context that may be too expensive to be tracked directly in the backend, like the specific payload blobs for the request, but that is easily collectible on the client. For mobile observability, tracking users explicitly is of paramount importance. In this space, platforms, and vendors recognize that modeling a user’s experience is essential because knowing the totality and sequencing of the activities around the time a user experiences performance problems is key for debugging. By grouping temporally related events for a user and presenting them in a chronologically sorted order, they have created what has become de rigueur in mobile observability: the user session. Presenting telemetry this way allows mobile developers to spot patterns and provide explanations as to why performance problems occur.

Quote for the day:

“Every adversity, every failure, every heartache carries with it the seed of an equal or greater benefit.” -- Napoleon Hill

Daily Tech Digest - June 14, 2024

State Machine Thinking: A Blueprint For Reliable System Design

State machines are instrumental in defining recovery and failover mechanisms. By clearly delineating states and transitions, engineers can identify and code for scenarios where the system needs to recover from an error, failover to a backup system or restart safely. Each state can have defined recovery actions, and transitions can include logic for error handling and fallback procedures, ensuring that the system can return to a safe state after encountering an issue. My favorite phrase to advocate here is: “Even when there is no documentation, there is no scope for delusion.” ... Having neurodivergent team members can significantly enhance the process of state machine conceptualization. Neurodivergent individuals often bring unique perspectives and problem-solving approaches that are invaluable in identifying states and anticipating all possible state transitions. Their ability to think outside the box and foresee various "what-if" scenarios can make the brainstorming process more thorough and effective, leading to a more robust state machine design. This diversity in thought ensures that potential edge cases are considered early in the design phase, making the system more resilient to unexpected conditions.

How to Build a Data Stack That Actually Puts You in Charge of Your Data

Sketch a data stack architecture that delivers the capabilities you've deemed necessary for your business. Your goal here should be to determine what your ideal data stack looks like, including not just which types of tools it will include, but also which personnel and processes will leverage those tools. As you approach this, think in a tool-agnostic way. In other words, rather than looking at vendor solutions and building a stack based on what's available, think in terms of your needs. This is important because you shouldn't let tools define what your stack looks like. Instead, you should define your ideal stack first, and then select tools that allow you to build it. ... Another critical consideration when evaluating tools is how much expertise and effort are necessary to get tools to do what you need them to do. This is important because too often, vendors make promises about their tools' capabilities — but just because a tool can theoretically do something doesn't mean it's easy to do that thing with that tool. A data discovery tool that requires you to install special plugins or write custom code to work with a legacy storage system you depend on.

IT leaders go small for purpose-built AI

A small AI approach has worked for Dayforce, a human capital management software vendor, says David Lloyd, chief data and AI officer at the company. Dayforce uses AI and related technologies for several functions, with machine learning helping to match employees at client companies to career coaches. Dayforce also uses traditional machine learning to identify employees at client companies who may be thinking about leaving their jobs, so that the clients can intervene to keep them. Not only are smaller models easier to train, but they also give Dayforce a high level of control over the data they use, a critical need when dealing with employee information, Lloyd says. When looking at the risk of an employee quitting, for example, the machine learning tools developed by Dayforce look at factors such as the employee’s performance over time and the number of performance increases received. “When modeling that across your entire employee base, looking at the movement of employees, that doesn’t require generative AI, in fact, generative would fail miserably,” he says. “At that point you’re really looking at things like a recurrent neural network, where you’re looking at the history over time.”

Why businesses need ‘agility and foresight’ to stay ahead in tech

In the current IT landscape, one of the most pressing challenges is the evolving threat of cyberattacks, particularly those augmented by GenAI. As GenAI becomes more sophisticated, it introduces new complexities for cybersecurity with cybercriminals leveraging it to create advanced attack vectors. ... Several transformative technologies are reshaping our industry and the world at large. At the forefront of these innovations is GenAI. Over the past two years, GenAI has moved from theory to practice. While GenAI has fostered many creative ideas in 2023 of how it will transform business, GenAI projects are starting to become business-ready with visible productivity gains becoming evident. Transformative technology also holds a strong promise to have a profound impact on cybersecurity, offering advanced capabilities for threat detection and incident response from a cybersecurity standpoint. Organisations will need to use their own data for training and fine-tuning models, conducting inference where data originates. Although there has been much discussion about zero trust within our industry, we’re now seeing it evolve from a concept to a real technology.

Who Should Run Tests? On the Future of QA

QA is a funny thing. It has meant everything from “the most senior engineer who puts the final stamp on all code” to “the guy who just sort of clicks around randomly and sees if anything breaks.” I’ve seen seen QA operating in all different levels of the organization, from engineers tightly integrated with each team to an independent, almost outside organization. A basic question as we look at shifting testing left, as we put more testing responsibility with the product teams, is what the role of QA should be in this new arrangement. This can be generalized as “who should own tests?” ... If we’re shifting testing left now, that doesn’t mean that developers will be running tests for the first time. Rather, shifting left means giving developers access to a complete set of highly accurate tests, and instead of just guessing from their understanding of API contracts and a few unit tests that their code is working, we want developers to be truly confident that they are handing off working code before deploying it to production. It’s a simple, self-evident principle that when QA finds a problem, that should be a surprise to the developers.

Implementing passwordless in device-restricted environments

Implementing identity-based passwordless authentication in workstation-independent environments poses several unique challenges. First and foremost is the issue of interoperability and ensuring that authentication operates seamlessly across a diverse array of systems and workstations. This includes avoiding repetitive registration steps which lead to user friction and inconvenience. Another critical challenge, without the benefit of mobile devices for biometric authentication, is implementing phishing and credential theft-resistant authentication to protect against advanced threats. Cost and scalability also represent significant hurdles. Providing individual hardware tokens to each user is expensive in large-scale deployments and introduces productivity risks associated with forgotten, lost, damaged or shared security keys. Lastly, the need for user convenience and accessibility cannot be understated. Passwordless authentication must not only be secure and robust but also user-friendly and accessible to all employees, irrespective of their technical expertise.

Modern fraud detection need not rely on PII

A fraud detection solution should also retain certain broad data about the original value, such as whether an email domain is free or corporate, whether a username contains numbers, whether a phone number is premium, etc. However, pseudo-anonymized data can still be re-identified, meaning if you know two people’s names you can tell if and how they have interacted. This means it is still too sensitive for machine learning (ML) since models can almost always be analyzed to regurgitate the values that go in. The way to deal with that is to change the relationships into features referencing patterns of behavior, e.g., the number of unique payees from an account in 24 hours, the number of usernames associated with a phone number or device, etc. These features can then be treated as fully anonymized, exported and used in model training. In fact, generally, these behavioral features are more predictive than the original values that went into them, leading to better protection as well as better privacy. Finally, a fraud detection system can make good use of third-party data that is already anonymized.

Deepfakes: Coming soon to a company near you

Deepfake scams are already happening, but the size of the problem is difficult to estimate, says Jake Williams, a faculty member at IANS Research, a cybersecurity research and advisory firm. In some cases, the scams go unreported to save the victim’s reputation, and in other cases, victims of other types of scams may blame deepfakes as a convenient cover for their actions, he says. At the same time, any technological defenses against deepfakes will be cumbersome — imagine a deepfakes detection tool listening in on every phone call made by employees — and they may have a limited shelf life, with AI technologies rapidly advancing. “It’s hard to measure because we don’t have effective detection tools, nor will we,” says Williams, a former hacker at the US National Security Agency. “It’s going to be difficult for us to keep track of over time.” While some hackers may not yet have access to high-quality deepfake technology, faking voices or images on low-bandwidth video calls has become trivial, Williams adds. Unless your Zoom meeting is of HD or better quality, a face swap may be good enough to fool most people.

A Deep Dive Into the Economics and Tactics of Modern Ransomware Threat Actors

A common trend among threat actors is to rely on older techniques but allocate more resources and deploy them differently to achieve greater success. Several security solutions organizations have long relied on, such as multi-factor authentication, are now vulnerable to circumvention with very minimal effort. Specifically, organizations need to be aware of the forms of MFA factors they support, such as push notifications, pin codes, FIDO keys and legacy solutions like SMS text messages. The latter is particularly concerning because SMS messaging has long been considered an insecure form of authentication, managed by third-party cellular providers, thus lying outside the control of both employees and their organizations. In addition to these technical forms of breaches, the tried-and-true method of phishing is still viable. Both white hat and black hat tools continue to be enhanced to exploit common MFA replay techniques. Like other professional tools used by security testers like Cobalt Strike used by threat actors to maintain persistence on compromised systems, MFA bypass/replay tools have also gotten more professional.

Troubleshooting Windows with Reliability Monitor

Reliability Monitor zeroes in on and tracks a limited set of errors and changes on Windows 10 and 11 desktops (and earlier versions going back to Windows Vista), offering immediate diagnostic information to administrators and power users trying to puzzle their way through crashes, failures, hiccups, and more. ... There are many ways to get to Reliability Monitor in Windows 10 and 11. At the Windows search box, if you type reli you’ll usually see an entry that reads View reliability history pop up on the Start menu in response. Click that to open the Reliability Monitor application window. ... Knowing the source of failures can help you take action to prevent them. For example, certain critical events show APPCRASH as the Problem Event Name. This signals that some Windows app or application has experienced a failure sufficient to make it shut itself down. Such events are typically internal to an app, often requiring a fix from its developer. Thus, if I see a Microsoft Store app that I seldom or never use throwing crashes, I’ll uninstall that app so it won’t crash any more. This keeps the Reliability Index up at no functional cost.

Quote for the day:

"Success is a state of mind. If you want success start thinking of yourself as a sucess." -- Joyce Brothers

Daily Tech Digest - June 13, 2024

Backup lessons learned from 10 major cloud outages

So, what’s the most critical lesson here? Back up your cloud data! And I don’t just mean relying on your provider’s built-in backup services. As we saw with Carbonite, StorageCraft and OVH, those backups can evaporate along with your primary data if disaster strikes. You need to follow the 3-2-1 rule religiously: keep at least three copies of your data, on two different media, with one copy off-site. And in the context of the cloud, “different media” means not storing everything in the same type of system; use different failure domains. Also, “off-site” means in a completely separate cloud account or, even better, with a third-party backup provider. But it’s not just about having backups; it’s about having the right kind of backups. Take the StorageCraft incident, for example. They lost customer backup metadata during a botched cloud migration, rendering those backups useless. This hammers home the importance of not only backing up your primary data but also maintaining the integrity and recoverability of your backup data itself.

4 Ways to Control Cloud Costs in the Age of Generative AI

First and foremost, prioritize building a cost-conscious culture within your organization. IT professionals are presented with some serious challenges to get spending under control and identify value where they can. Educating teams on cloud cost management strategies and fostering accountability can empower them to make informed decisions that align with business objectives. Organizations are increasingly implementing FinOps frameworks and strategies in their cloud cost optimization efforts as well. This promotes a shared responsibility for cloud costs across IT teams, DevOps, and other cross-functional teams. ... Implementing robust monitoring and optimization tools is essential. By leveraging analytics and automation, your organization can gain real-time insights into cloud usage patterns and identify opportunities for optimization. Whether it's rightsizing resources, implementing cost allocation tags, or leveraging spot instances, proactive optimization measures can yield substantial cost savings without sacrificing performance.

Gen AI can be the answer to your data problems — but not all of them

One use case is particularly well suited for gen AI because it was specifically designed to generate new text. “They’re very powerful for generating synthetic data and test data,” says Noah Johnson, co-founder and CTO at Dasera, a data security firm. “They’re very effective on that. You give them the structure and the general context, and they can generate very realistic-looking synthetic data.” The synthetic data is then used to test the company’s software, he says. ... The most important thing to know is that gen AI won’t solve all of a company’s data problems. “It’s not a silver bullet,” says Daniel Avancini, chief data officer at Indicium, an AI and data consultancy. If a company is just starting on its data journey, getting the basics right is key, including building good data platforms, setting up data governance processes, and using efficient and robust traditional approaches to identifying, classifying, and cleaning data. “Gen AI is definitely something that’s going to help, but there are a lot of traditional best practices that need to be implemented first,” he says.

Scores of Biometrics Bugs Emerge, Highlighting Authentication Risks

Biometrics generally are regarded as a step above typical authentication mechanisms — that extra James Bond-level of security necessary for the most sensitive devices and the most serious environments. ... The critical nature of the environments in which these systems are so often deployed necessitates that organizations go above and beyond to ensure their integrity. And that job takes much more than just patching newly discovered vulnerabilities. "First, isolate a biometric reader on a separate network segment to limit potential attack vectors," Kiguradze recommends. Then, "implement robust administrator passwords and replace any default credentials. In general, it is advisable to conduct thorough audits of the device’s security settings and change any default configurations, as they are usually easier to exploit in a cyberattack." "There have been recent security breaches — you've probably read about them," acknowledges Rohan Ramesh, director of product marketing at Entrust. But in general, he says, there are ways to protect databases with hardware security modules and other advanced encryption technologies.

Mastering the tabletop: 3 cyberattack scenarios to prime your response

The ransomware CTEP explores aspects of an organization’s operational resiliency and poses key questions aimed at understanding threats to an organization, what information the attacker leverages, and how to conduct risk assessments to identify specific threats and vulnerabilities to critical assets. Given that ransomware attacks focus on data and systems, the scenario asks key questions about the accuracy of inventories and whether there are resources in place dedicated to mitigating known exploited vulnerabilities on internet-facing systems. This includes activities such as not just having backups, but their retention period and an understanding of how long it would take to restore from backups if necessary, in events such as a ransomware attack. Questions asked during the tabletop also include a focus on assessing zero-trust architecture implementation or lack thereof. This is critical, given that zero trust emphasizes least-permissive access control and network segmentation, practices that can limit the lateral movement of an attack and potentially keep it from accessing sensitive data, files, and systems.

10 Years of Kubernetes: Past, Present, and Future

There is little risk (nor reason) that Wasm will in some way displace containers. WebAssembly’s virtues — fast startup time, small binary sizes, and fast execution — lend strongly toward serverless workloads where there is no long-running server process. But none of these things makes WebAssembly an obviously better technology for long-running server process that are typically encapsulated in containers. In fact, the opposite is true: Right now, few servers can be compiled to WebAssembly without substantial changes to the code. When it comes to serverless functions, though, WebAssembly’s sub-millisecond cold start, near-native execution speed, and beefy security sandbox make it an ideal compute layer. If WebAssembly will not displace containers, then our design goal should be to complement containers. And running WebAssembly inside of Kubernetes should involve the deepest possible integration with existing Kubernetes features. That’s where SpinKube comes in. Packaging a group of open source tools created by Microsoft, Fermyon, Liquid Reply, SUSE, and others, SpinKube plumbs WebAssembly support directly into Kubernetes. A WebAssembly application can use secrets, config maps, volume mounts, services, sidecars, meshes, and so on.

Cultivating a High Performance Environment

At the organizational level, how is a culture that supports high performers put in place and how does it remain in place? The simple answer is that cultural leaders must set the foundation. A great example is Gary Vaynerchuk. As CEO of his organization, he embodies many high performing qualities we’ve identified as power skills. He is the primary champion (Sponsor) for this culture, hires leaders (resources) who make up a group of champions, and these leaders hire others (teams) who expand the group of champions. Tools, tactics, and processes are put in place by all champions at all levels to support, build, and maintain the culture. Those who don’t resonate with high performance are supported as best and as long as possible. If they decide not to support the culture, they are facilitated to leave in a supportive manner. As organizations change and embrace true high performance (power skills), authentic high performers will proliferate. Organizations don’t really have a choice about whether to move to the new paradigm. This is the way now and of the future. Steve Jobs said it well: “We don’t hire experts to tell them what to do. We hire experts to tell us what to do.”

Top 10 Use Cases for Blockchain

Smart contracts on the blockchain can also automate derivate contract execution based on pre-defined rules while automating dividend payments. Perhaps most notable, is its ability to tokenise traditional assets such as stocks and bonds into digital securities – paving the way for fractional ownership. ... Blockchain can also power CBDCs – a digital form of central bank money that offers unique advantages for central banks at retail and wholesale levels, from enhanced financial access for individuals to greater infrastructural efficiency for intermediate settlements. With distributed ledger transactions (DLT), CBDCs can be issued, recorded and validated in a decentralised way. ... Blockchain technology is becoming vital in the cybersecurity space too. When it comes to digital identities, blockchain enables the concept of self-sovereign identity (SSI), where individuals have complete control and ownership over their digital identities and personal data. Rather than relying on centralised authorities like companies or governments to issue and manage identities, blockchain enables users to create and manage their own.

Encryption as a Cloud-to-Cloud Network Security Strategy

Like upper management, there are network analysts and IT leaders who resist using data encryption. They view encryption as overkill—in technology and in the budget. Second, they may not have much first-hand experience with data encryption. Encryption uses black-box arithmetic algorithms that few IT professionals understand or care about. Next, if you opt to use encryption, you have to make the right choice out of many different types of encryption options. In some cases, an industry regulation may dictate the choice of encryption, which simplifies the choice. This can actually be a benefit on the budget side because you don't have to fight for new budget dollars when the driver is regulatory compliance. However, even if you don't have a regulatory requirement for the encryption of data in transit, security risks are growing if you run without it. Unencrypted data in transit can be intercepted by malicious actors for purposes of identity theft, intellectual property theft, data tampering, and ransomware. The more companies move into a hybrid computing environment that operates on-premises and in multiple clouds, the greater their risk since more data that is potentially unprotected is moving from point to point over this extended outside network.

Automated Testing in DevOps: Integrating Testing into Continuous Delivery

Automated testing skilfully diverts ownership responsibilities to the engineering team. They can prepare test plans or assist with the procedure alongside regular roadmap feature development and then complete the execution using continuous integration tools. With the help of an efficient automation testing company, you can reduce the QA team size and let quality analysts focus more on vital and sensitive features. ... The major goal of continuous delivery is to deliver new code releases to customers as fast as possible. Suppose there is any manual or time-consuming step within the delivery process. In that case, automating delivery to users becomes challenging rather than impossible. Continuous development can be an effective part of a greater deployment pipeline. It is a successor to and also relies on continuous integration. Continuous integration is entirely responsible for running automated tests against new code changes and verifying whether new changes are breaking new features or introducing new bugs. Continuous delivery takes place once the CI step passes the automated test plan.

Quote for the day:

"If you really want the key to success, start by doing the opposite of what everyone else is doing." -- Brad Szollose

Daily Tech Digest - June 11, 2024

4 reasons existing anti-bot solutions fail to protect mobile APIs

Existing anti-bot solutions attempt to bend their products to address mobile-based threats. For example, some require the implementation of an SDK into the mobile app, because that’s the only way the mobile app can respond to the main methods used by WAFs to identify bots from humans. Such solutions also typically require separate servers to be deployed behind the WAF, which are used to evaluate connection requests to discern legitimate connections from malicious ones. These “workarounds” impose single points of failure, performance bottlenecks, and latency, and often come with unacceptable capacity limitations. On top of that, WAF mobile SDKs also have limitations in terms of the dev framework support and can require developers to rewrite the network stack to achieve compatibility with the WAF. Such workarounds create more work and more costs. To make matters worse, because most anti-bot solutions on the market are not sufficiently hardened to protect against clones, spoofing, malware, or tampering, hackers can easily compromise, bypass, or disable the anti-bot solution if it’s implemented inside a mobile app that is not sufficiently protected against reverse engineering and other attacks.

Advancing interoperability in Africa: Overcoming challenges for digital integration

From a legal perspective, Mihret Woodmatas, senior ICT expert, department of infrastructure and energy, African Union Commission (AUC), points out that differing levels of development across countries pose a challenge. A significant issue is the lack of robust legal frameworks for data protection and privacy. ... Hopkins underscores the importance of sharing data to benefit those it is collected for, particularly refugees. While sharing data comes with risks, particularly concerning security and privacy, these can be managed with proper risk treatments. The goal is to avoid siloed data systems and instead foster coordination and cooperation among different entities. Hopkins discussed the digital transformation across states and international agencies, emphasizing the need for effective data sharing. Good data sharing practices enable various entities to provide coordinated services, significantly benefiting refugees by facilitating their access to education, healthcare, and employment. Interoperability also supports local communities economically and ensures a unique and continuous identity for refugees, even if they remain displaced for years or decades.

Cloud migration expands the CISO role yet again

CISOs must now ensure they can report to the SEC within four business days of determining an incident’s materiality, describing its nature, scope, and potential impact. They must also communicate risk management strategies and incident response plans to ensure the board is well-informed about the organization’s cybersecurity posture. These changes require a more structured and proactive approach because CISOs must now be aware of compliance status in near real-time, not only to provide all cybersecurity incident data and context to the board, compliance teams, and finance teams, but to ensure they can determine quickly whether an incident has a material impact and therefore must be reported to the SEC. CISOs who miss making a timely disclosure or have the wrong security and compliance strategy in place can expect to be fined, even if the incident doesn’t turn into a catastrophic cybersecurity event. Boards must be able to trust that CISOs can answer any question related to compliance and security quickly and accurately, and the board themselves must be familiar with cybersecurity concepts, able to understand the risks and ask the right questions.

Generative AI Is Not Going To Build Your Engineering Team For You

People act like writing code is the hard part of software. It is not. It never has been, it never will be. Writing code is the easiest part of software engineering, and it’s getting easier by the day. The hard parts are what you do with that code—operating it, understanding it, extending it, and governing it over its entire lifecycle. A junior engineer begins by learning how to write and debug lines, functions, and snippets of code. As you practice and progress towards being a senior engineer, you learn to compose systems out of software, and guide systems through waves of change and transformation. Sociotechnical systems consist of software, tools, and people; understanding them requires familiarity with the interplay between software, users, production, infrastructure, and continuous changes over time. These systems are fantastically complex and subject to chaos, nondeterminism and emergent behaviors. If anyone claims to understand the system they are developing and operating, the system is either exceptionally small or (more likely) they don’t know enough to know what they don’t know. Code is easy, in other words, but systems are hard.

Is Oracle Finally Killing MySQL?

Things have changed, though, in recent years with the introduction of “MySQL Heatwave”—Oracle’s MySQL Cloud Database. Heatwave includes a number of features that are not available in MySQL Community or MySQL Enterprise, such as acceleration of analytical queries or ML functionality. When it comes to “analytical queries,” it is particularly problematic as MySQL does not even have parallel query execution. At a time when CPUs with hundreds of cores are coming to market, those cores are not getting significantly faster, which is increasingly limiting performance. This does not just apply to queries coming from analytical applications but also simple “group by” queries common in operational applications. Note: MySQL 8 does have some parallelization support for DDLs but not for queries. Could this have something to do with giving people more reason to embrace MySQL Heatwave? Or, rather move to PostgreSQL or adopt Clickhouse? Vector Search is another area where open source MySQL lacks. While every other major open source database has added support for Vector Search functionality, and MariaDB is working on it, having it as a cloud-only MySQL Heatwave Feature in the MySQL ecosystem is unfortunate, to say the least.

Giant legacies

Thought leadership in general demands we stand on the shoulders of innovators who have gone before. Thinking in HR is no exception. The essence of this debt was captured in the Hippocratic Oath this column had proposed for HR professionals: "I shall not forget the debt and respect I owe to those who have taught me and freely pass on the best of my learnings to those who work with me as well as through professional bodies, educational institutes or other means of dissemination. ... Thinking brilliant new concepts or applying those that have taken root in one field to another is necessary but not sufficient for creating a LOG. There are two other tests. If the concept, strategy or process proves its worth, it should be lasting. It need not become an unchangeable sacrament but further developments should emanate from it rather than demand a reversal of the flow. While we can sympathize with radical ideas (or greedy cats) that are brought to a dead end by 'malignant fate', we cannot honour them as LOGs. Apart from durability over time, we have transmission across organisational boundaries which establishes the generalizability of the innovation.

Solving the data quality problem in generative AI

One of the biggest misconceptions surrounding synthetic data is model collapse. However, model collapse stems from research that isn’t really about synthetic data at all. It is about feedback loops in AI and machine learning systems, and the need for better data governance. For instance, the main issue raised in the paper The Curse of Recursion: Training on Generated Data Makes Models Forget is that future generations of large language models may be defective due to training data that contains data created by older generations of LLMs. The most important takeaway from this research is that to remain performant and sustainable, models need a steady flow of high-quality, task-specific training data. For most high-value AI applications, this means fresh, real-time data that is grounded in the reality these models must operate in. Because this often includes sensitive data, it also requires infrastructure to anonymize, generate, and evaluate vast amounts of data—with humans involved in the feedback loop. Without the ability to leverage sensitive data in a secure, timely, and ongoing manner, AI developers will continue to struggle with model hallucinations and model collapse.

DevSecOps Made Simple: 6 Strategies

Collective Responsibility describes the common practices shared by organizations that have taken a program-level approach to security culture development. Broken into three key areas: 1) executive support and engagement, 2) program design and implementation, 3) program sustainment and measurement, the paper suggests how to best garner (and keep) executive support and engagement while building an inclusive cultural program based on cumulative experience. ... Collaboration and Integration addresses the importance of integrating DevSecOps into organizational processes and stresses the key role that fostering a sense of collaboration plays in its successful implementation. ... Pragmatic Implementation outlines the practices, processes, and technologies that organizations should consider when building out any DevSecOps program and how to implement DevSecOps pragmatically. ... Bridging Compliance and Development is broken into three parts offering 1) an approach to compartmentalization and assessment with an eye to minimizing operating impact, 2) best practices on how compliance can be designed and implemented into applications, and 3) a look at the different security tooling practices that can provide assurance to compliance requirements.

Change Management Skills for Data Leaders

Strategic planning and decision-making are pivotal aspects of successful organizational transformation, requiring nuanced change management skills. Developing a strategy for organizational change in Data Management is a critical task that requires an understanding of both the current state of affairs and the desired future state. For data leaders, this involves conducting a thorough assessment to identify gaps between these two states. ... Developing effective communication and collaboration strategies is paramount in navigating the complexities of change management. A key component of this process involves crafting clear, concise, and transparent messaging that resonates with all stakeholders involved. This ensures that everyone, from team members to top-level management, understands not only the nature of the change but also its purpose and the benefits it promises to bring. ... Resilience is not just about enduring change but also about emerging stronger from it. Data leaders are often at the forefront of navigating through uncharted territories, be it technological advancements or market shifts, which requires an inherent ability to withstand pressure and bounce back from setbacks.

Sanity Testing vs. Regression Testing: Key Differences

Sanity testing is the process that evaluates the specific software application functionality after its deployment with added new features or modifications and bug fixes. In simple terms, it is the quick testing to check whether the changes made are as per the Software Requirement Specifications (SRS). It is generally performed after the minor code adjustment to ensure seamless integration with existing functionalities. If the sanity test fails, it's a red flag that something's wrong, and the software might not be ready for further testing. This helps catch problems early on, saving time and effort down the road. ... Regression testing is the process of re-running tests on existing software applications to verify that new changes or additions haven't broken anything. It's a crucial step performed after every code alteration, big or small, to catch regressions – the re-emergence of old bugs due to new changes. By re-executing testing scenarios that were originally scripted when known issues were initially resolved, you can ensure that any recent alterations to an application haven't resulted in regression or compromised previously functioning components.

Quote for the day:

"The two most important days in your life are the day you are born and the day you find out why." --Mark Twain

Daily Tech Digest - June 10, 2024

AI vs humans: Why soft skills are your secret weapon

AI can certainly assist with some aspects of the creative process, but true creativity is something only humans can achieve, for several reasons. Firstly, it often involves intuition, emotion and empathy, as well as thinking outside the box and making connections between seemingly unrelated concepts. Creativity is often shaped by personal experiences and cultural background, making every individual’s creative work unique. ... Leadership and strategic management will continue to be driven by humans. When making decisions, people are able to consider various factors such as personal relationships or company culture. General awareness, intuition, understanding of broader contexts that lie beyond data and effective communication skills are all human traits. ... Humans possess a crucial trait that AI is unable to replicate (although it’s definitely coming closer): Empathy. AI can’t communicate with your team members at the same level, provide solutions to their problems or offer a listening ear when necessary. Managing a team means talking to people, listening and understanding their needs and motivations. The human touch is essential to make sure that everyone is on the same page.

How to Avoid Pitfalls and Mistakes When Coding for Quality

When code quantity is so exaggerated that redundancies emerge, "code bloat" occurs. An abundance of unnecessary code can adversely affect the site's performance and the code can become too complex to maintain. There are strategies for addressing redundancy; however, as code is implemented, it is crucial for it to be modularized or broken down into smaller modular complements with the proper encapsulation and extraction. Code that is modularized promotes reuse, simplifies maintenance, and keeps the size of the code base in check. ... There is a tendency to "reinvent the wheel" when writing code. A more practical solution is to reuse libraries whenever possible because they can be utilized within different parts of the code. Sometimes, code bloat results from a historically bloated code base without an easy option to conduct modularization, extraction, or library reuse. In this case, the most effective strategy is to turn to code refactoring. Regularly take initiatives to refactor code, eliminate any unnecessary or duplicate logic, and improve the overall code structure of the repository over time.

The BEC battleground: Why zero trust and employee education are your best line of defence

Even with extensive employee training, some BEC scams can bypass human vigilance. Comprehensive security processes are essential to minimize their impact. The zero-trust security model is crucial here. It assumes no inherent trust for anyone, inside or outside the network. With zero trust, every user and device must be continuously authenticated before accessing any resources. This makes it much harder for attackers. Even if they steal a login credential, they can’t automatically access the entire system. A key component of zero trust is multi-factor authentication (MFA) which acts as multiple locks on every access point. Just like a physical security system requiring multiple forms of identification, MFA requires not just a username and password, but an additional verification factor like a code from a phone app or fingerprint scan. This makes unauthorised entry, including through BEC scams, much harder. So, any IT infrastructure implemented must have zero trust and MFA at its core. A complement to zero trust is the principle of least privilege access; granting users only the minimum level of access required to perform their jobs.

Why CISOs need to build cyber fault tolerance into their business

For a rapidly evolving technology like GenAI, it is impossible to prevent all attacks at all times. The ability to adapt to, respond, and recover from inevitable issues is critical for organizations to explore GenAI successfully. Therefore, effective CISOs are complementing their prevention-oriented guidance for GenAI with effective response and recovery playbooks. Regarding third-party cybersecurity risk management, no matter the cybersecurity function’s best efforts, organizations will continue to work with risky third parties. Cybersecurity’s real impact lies not in asking more due diligence questions, but in ensuring the business has documented and tested third-party-specific business continuity plans in place. “CISOs should be guiding the sponsors of third-party partners to create a formal third-party contingency plan, including things like an exit strategy, alternative suppliers list, and incident response playbooks,” said Mixter. “CISOs tabletop everything else. It’s time to bring tabletop exercises to third-party cyber risk management.”

AI system poisoning is a growing threat — is your security regime ready?

CISOs shouldn’t breathe a sigh of relief, McGladrey says, as their organizations could be impacted by those attacks if they are using the vendor-supplied corrupted AI systems. ... Security experts and CISOs themselves say many organizations are not prepared to detect and respond to poisoning attacks. “We’re a long way off from having truly robust security around AI because it’s evolving so quickly,” Stevenson says. He points to the Protiviti client that suffered a suspected poisoning attack, noting that workers at that company identified the possible attack because its “data was not synching up, and when they dived into it, they identified the issue. [The company did not find it because] a security tool had its bells and whistles going off.” He adds: “I don’t think many companies are set up to detect and respond to these kinds of attacks.” ... “The average CISO isn’t skilled in AI development and doesn’t have AI skills as a core competency,” says Jon France, CISO with ISC2. Even if they were AI experts, they would likely face challenges in determining whether a hacker had launched a successful poisoning attack.

Accelerate Transformation Through Agile Growth

The problem is that when you start the next calendar year in January, you get a false sense of confidence because December is still 12 months away — all the time in the world, or so it seems, to execute your annual strategic plan. But then by April, after the first quarter has ended, chances are you’ll have started to feel a bit behind. You won’t be overly worried, however; you know you still have plenty of time to catch up. But then you’ll get to September and hit the 100-day-sprint which typically comes right after Labor Day in the United States. Now, panic will set in as you race to the end of the year desperately trying to hit those annual goals that were established all the way back in January. In growth cycles longer than 90 days, we tend to get off track. But it doesn’t have to be this way. You can use the 90-Day Growth Method to bring your team together every quarter to review and celebrate your progress over the past 90 days, refocus on goals and actions, and renew your commitment to achieving them. Soon, you and your team will feel re-energized and ready to move forward with courage and confidence for the next 90 days.

We need a Red Hat for AI

To be successful, we need to move beyond the confusing hype and help enterprises make sense of AI. In other words, we need more trust (open models) and fewer moving parts ... OpenAI, however popular it may be today, is not the solution. It just keeps compounding the problem with proliferating models. OpenAI throws more and more of your data into its LLMs, making them better but not any easier for enterprises to use in production. Nor is it alone. Google, Anthropic, Mistral, etc., etc., all have LLMs they want you to use, and each seems to be bigger/better/faster than the last, but no clearer for the average enterprise. ... You’d expect the cloud vendors to fill this role, but they’ve kept to their preexisting playbooks for the most part. AWS, for example, has built a $100 billion run-rate business by saving customers from the “undifferentiated heavy lifting” of managing databases, operating systems, etc. Head to the AWS generative AI page and you’ll see they’re lining up to offer similar services for customers with AI. But LLMs aren’t operating systems or databases or some other known element in enterprise computing. They’re still pixie dust and magic.

How Data Integration Is Evolving Beyond ETL

From an overall trend perspective, with the explosive growth of global data, the emergence of large models, and the proliferation of data engines for various scenarios, the rise of real-time data has brought data integration back to the forefront of the data field. If data is considered a new energy source, then data integration is like the pipeline of this new energy. The more data engines there are, the higher the efficiency, data source compatibility, and usability requirements of the pipeline will be. Although data integration will eventually face challenges from Zero ETL, data virtualization, and DataFabric, in the visible future, the performance, accuracy, and ROI of these technologies have always failed to reach the level of popularity of data integration. Otherwise, the most popular data engines in the United States should not be SnowFlake or DeltaLake but TrinoDB. Of course, I believe that in the next 10 years, under the circumstances of DataFabric x large models, virtualization + EtLT + data routing may be the ultimate solution for data integration. In short, as long as data volume grows, the pipelines between data will always exist.

Protecting your digital transformation from value erosion

The first form of value erosion pertains to cost increases within your project without an equivalent increase in the value or activities being delivered. With project delays, for example, there are usually additional costs incurred related to resource carryover because of the timeline increase. In this instance, the absence of additional work being delivered, or future work being pulled forward to offset the additional costs, is a prime illustration of value erosion. ... Decrease in value without decreased costs: A second form occurs when there’s a decrease in value without a cost adjustment. This can happen due to changing business priorities or project delays, especially within the build phase. As an alternative to extending the project timeline, organizations may decide to prioritize and reduce features to meet deadlines. ... Failure to Identify and plan for potential risks leaves projects vulnerable to unforeseen complications and budgetary concerns. Large variances in initial SI responses can be attributed to different assumptions on scope and service levels provided.

Ask a Data Ethicist: What Is Data Sovereignty?

Put simply, data sovereignty relates to who has the power to govern data. It determines who is legally empowered to make decisions about the collection and use of data. We can think about this in the context of two governments negotiating between each other, each having sovereign powers of self-determination. Indigenous governments are claiming their sovereign rights to their people’s data. On the one hand, this is a response to the atrocities that have taken place with respect to data gathered and taken beyond the control of Indigenous communities by researchers, governments, and other non-Indigenous parties. Yet, as data becomes increasingly important, many countries are seeking to set regulatory standards for data. It makes sense the Indigenous governments would assert similar rights with respect to their people’s data. ... Data sovereignty is an important part of Canada’s Truth and Reconciliation calls to action. The FNIGC governs the relevant processes for those seeking to work with First Nations in Canada to appropriately access data.

Quote for the day:

"The secret to success is good leadership, and good leadership is all about making the lives of your team members or workers better." -- Tony Dungy