Daily Tech Digest - July 25, 2020

Jump Over the Hidden Barriers to Digital Transformation

A key reason for the failures: a lack of clear, measurable business goals. Right now, no matter the business, eyes everywhere are on IT. To push through the transformation, you need to benefit not just yourself but your organization. You need to be able to speak the language of business, and here’s how you can do it. If you’re going to ask the company to support your program, talk about it in a way the C-suite can understand. Think about the use case they’ll be most interested to hear about. Shortening customer wait times? They’ll care. Aiding supply chains? They’ll listen. Remember, they’ll want numbers, too. The C-suite will do a cost-benefit analysis, but you should preempt this by conducting one beforehand. This shows your commitment to making the company more successful and inspires trust in the project through data. Avoid using too much technical jargon; doing so will get glassy-eyed looks and perhaps inspire them to give some other department a budget increase or greenlight a different project. Never make the C-suite do your work for you: Make them understand the value of your plans. Doing so may develop your soft skills.


6 Insights for Dynamic Leadership

Too often we get caught up in the inequity of having a problem. It’s unfair that we should suffer this or “that should have never happened in the first place!” What we need to focus on is how to safely address the problem, how to move forward, around, over or under it to get where we need to go. ... Focusing on “being decisive” misses the lesson. Start thinking about the information — what you have, what you need and whether you can wait for more. The goal is be able to reflect upon decisions and know that you would make the same one again tomorrow — even if they were wrong. ... If it’s not someone’s job, it’s no one’s job. And so, we’re taught to identify a specific person to carry out a task in order to get the task done. When it can be anyone’s job to cook dinner, you’ll be hangry by 7:00. But when you split the cooking every other day, you will go hungry a lot less often. As meetings end, tasks should be given to people and as specifically as possible with closed-loop communication built into the responsibility. ... Control yourself — it’s pretty much the only thing you can control. It’s the doctor whose face says “Everything’s cool — I got this.” It’s the pilot’s smooth, buttery drawl that announces the severe turbulence over the PA. It’s the expert in the room defusing an insane customer or devolving employee.


Management lessons of The True Believer

The True Believer is no less relevant today than when it was first published, despite its pessimistic view of human nature and skepticism toward mass movements. Several elements are of particular interest to business leaders. For example, Hoffer recognizes that “the chief passion” of the frustrated is to belong, and urges employers to cultivate “a vivid feeling of solidarity” in employees through collective pay schemes and other means, as teamwork boosts productivity: “Any policy that disturbs and tears apart the team is bound to cause severe trouble.” Another important source of belonging is the family. Dangerous mass movements, in Hoffer’s view, tend to undermine and be jealous of the family, which is yet another reason firms ought to be friendlier toward that beleaguered institution. Humans find passionate causes seductive, Hoffer knows, but he seems not to subscribe to any cultlike conception of a business. “The practical organization offers opportunities for self-advancement, and its appeal is mainly to self-interest,” he writes, adding that: “Where self-advancement cannot, or is not allowed to, serve as a driving force, other sources of enthusiasm have to be found if momentous changes, such as the awakening and renovation of a stagnant society or radical reforms in the character and pattern of life of a community, are to be realized and perpetuated.”


Microsoft Office the most targeted platform to carry out attacks

Researchers said that ... hacking browsers has become more expensive, as browser security has improved. “Browser developers put much effort into different kinds of security protections and mitigations,” Liskin said. “Attackers were looking for a new target, and MS Office has become a star.” Liskin added that there are plenty of reasons why cybercriminals choose to attack the popular suite. “Microsoft Office has a huge number of different file formats," he said. "It is deeply integrated into the Windows operating system." He also argued that when Microsoft created Office, it made several decisions that, in hindsight, aren’t optimal security-wise and are currently difficult to change. Making such alterations would have a significant impact on all the versions of the products, Liskin said. A new report from SonicWall released in July 2020 shows this trend is growing. Office files have overtaken PDF documents as a delivery mechanism for malware. Office documents make up 22.4% of all malicious file types, compared to 10.7% for PDFs. A bit of good news in the SonicWall report: The number of detected malicious Office files declined slightly at the end of the first half of 2020. 


Intel's 7nm products delayed; first 7nm client CPU expected in late 2022 or 2023

Intel is pushing back its 7nm product roadmap after identifying a defect mode in its 7nm process that resulted in yield degradation, Swan said. The yield of Intel's 7nm process is now trending approximately 12 months behind the company's internal target. "We've root caused the issue, and believe there are no fundamental roadblocks," Swan said. "But we've also invested in contingency plans to hedge against further schedule uncertainty. We've mitigated the impact of the process delay on our product schedule by leveraging improvements in design methodology, such as die disaggregation and advanced packaging." The news of the delay caused Intel shares to sink in after-hours trading. The delay comes in the context of Intel's challenges to transition to 10nm products, with its product roadmap repeatedly delayed.  "We've seen this movie before," Swan acknowledged Thursday. "We have learned from the challenges in our 10nm transition, and we have a milestone-driven approach to ensure our product competitiveness is not impacted by our process technology roadmap."


Self-Driving Money Is Coming To Consumer Fintech

The first step to autonomous finance is breaking down the barriers between these products. Open banking solutions like Plaid, which link fintechs and banks together, have made it easier to transfer money and data between platforms. Today, that looks like a hub-and-spoke model: I can move money from Venmo to my checking account to Vanguard. In the future, it will be point-to-point: I should be able to take $400 at-rest in Venmo and invest it directly into my Roth IRA, or split it 50/50 between my student loan payments and my credit card bill. Self-driving money limited to one app is like a self-driving car that only works on one road. The second step is where the ‘autonomous’ part comes in. Connected fintech services will use a combination of common-language rules set by the user and machine learning to manage money in the background. This goes a step beyond setting a retirement goal on a roboadvisor: I should be able to say “whenever I have spare money laying around, other than what I need for day-to-day expenses, reinvest it into whatever earns the highest return.” After that, I should never have to think about what’s happening with my money, other than when I receive updates from the service on how it is being put to work.


Low-Code Technology Boosts The Growth Of Specialist Bank

During its low-code journey, HTB invested heavily in testing capabilities, providing value with an improved turnaround time for any defects. Previously, developers would publish a change, finishing in the evening, then the test team would arrive the next morning and start the test pack, which could run for 3-4 hours, ensuring everything worked correctly and highlighting any regressions. The developers wouldn’t get feedback until lunchtime, therefore losing half a day of development time. Now, the developers publish an update and leave for the evening. Liberty Create takes 30 minutes to package the release and push it to the test environment, waking up the testing platform automatically once complete and running the series of tests. By 9 am, the test team starts the day with the results and the developers work on any fixes needed immediately. As a result, an extra half a day per developer is gained from every push. This acted as the first step for HTB on its journey to seamless integrated testing and DevOps. Today, HTB’s confidence in front-end building capabilities now influences how the bank approaches new potential suppliers with a clear strategy that needs to work with low-code.


Security Leaders Adapt to Manage Cyber Everywhere

We have placed a significant focus on our early talent development program, bringing in people who understand the business and can be trained to perform risk assessments and develop the necessary technical skills. Mentoring young professionals is one of my passions, and it is essential to develop the cybersecurity skills we need now and in the future. It’s important to make the time, however busy our schedules are, to help shape people into more than they thought they could be. In terms of collaboration across the profession, we are participating in the recently formed Health Information Sharing and Analysis Center (H-ISAC) in Japan, which is a community of life sciences organizations that have come together to share timely, relevant, actionable information on cybersecurity. Although we are competitors in business, we share a common goal to prevent, detect, and respond to cybersecurity concerns. We face many of the same challenges with respect to resources and professional staffing, so it helps all of us if we can work collaboratively.


Cloud Computing – Trends that Enterprises Should Watch Out For

The prevalence of mobile phones has majorly affected the business world. Anyplace, anytime access that these cloud-based apps provide turns to be perfect for remote working employees. Employees can essentially sign into any application with web-enabled devices like tablets or mobile phones to carry out their tasks in the cloud infrastructure. Information breaches, theft, and data omission are the major threats even for conventional IT infrastructures. But, as more organizations move to the cloud platforms, it’s crucial to guarantee that cloud service provider can ensure a secure framework for the wellbeing of their consumer’s information. Cloud security isn’t the only trend in cloud computing, but it’s important to be emphasized enough on by each organization. Consequently, an enormous demand for cloud security suppliers is emerging that guarantees that the data practices abide by GDPR and other compliances. With open-source cloud computing, firms can see various advantages. They can quickly scale their cloud foundation, including exceptions that are a lot more direct than the closed source platform, with fewer security concerns. 


Banning TikTok Won't Solve Our Privacy Problems

While all these drivers are legitimate concerns — we should express concern when a nation-state owns an application that is harvesting huge amounts of sensitive data — our focus on these factors conveniently bypasses the true problem. Applications are becoming increasingly more intrusive and we are surrendering our data ever more willingly without understanding the potential ramifications that will ripple far into the future. Once our data has been leaked, it is out there and we can't ask nicely to please have it back. That means if data we once thought was innocuous suddenly changes into something dangerous, perhaps because of a new piece of technology or a change to how we use data, then you are already at a disadvantage. Banning apps based solely on their country of origin (no matter how hostile) is not going to solve this problem; it is merely a Band-Aid that won't fully address all privacy and security concerns.  We need to address the underlying problem, take a hard look at what data our applications are collecting, and focus on improving privacy controls. We could throw a dart at a list of apps in most app stores and almost be guaranteed to hit one with some form of privacy issue.



Quote for the day:

"If you are not willing to give a less experienced qualified professional a chance, don't complain you are charged double for a job worth half." -- Mark W. Boyer

Daily Tech Digest - July 24, 2020

The challenges and opportunities of shadow IT

As more organizations adopt practices like self-service SaaS and BYOD, the need for greater visibility into their overarching corporate network of devices becomes even greater. Many organizations faced this crunch when moving their workforce remote only a few months ago as a response to COVID-19. Typically, the larger and more widespread an ecosystem of devices is, the more difficult it becomes for IT teams to maintain visibility and consequently cyber hygiene of those devices. We can expect many of the challenges around Shadow IT to only grow in the next few years as more enterprises adopt practices like BYOD, or even on an operational level, more flexible remote work policies. Consequently, enterprises will put a greater focus on automation to better identify and secure devices across their widened infrastructure. ... SaaS tools bring immediate dangers of freely shared file data that is not classified or labeled. Or to say this in a more technical manner, there is zero data governance in collaborative hybrid work environments over shared files. DLP tools fail to bring effective results in shared environments. For effective data protection, organizations must have virtual file labeling that offers an automated process in which all the relevant security, privacy, and operational policies are considered, and continually fine-tuned.


Open Banking – The Novel Mainstay of Digital Banking

Open banking is a safe way to give suppliers access to your financial data. It is establishing a statistics architecture, where a group of organizations can share the information via Application Programming Interfaces (APIs). These APIs are used by banking and financial companies to exchange data between them, thus helping to serve consumers better. Open banking allows banks to offer customized financial services to their consumers, majorly payment solutions. The revolution is both developing the industry toward platform-based, hyper-relevant distribution, and offering banks a precious opportunity to develop their networks and extend reach. In short, we can say open banking is more about sharing financial data by electronic means, securely, and only under circumstances when consumers agree. Therefore, when you share data voluntarily owing to legal reasons, you become a part of the open banking community. Gear up for a world of websites and apps, where one can select modern economic services and products from providers policed by the Financial Conduct Authority (FCA) and European equivalents.


Balancing UX and Privacy With IoT

When we consider the compromised privacy of individuals, we are talking about each individual’s loss of control over personal information. When people invest in these interconnected devices, they are not entirely aware of how much of their personal information is tracked and saved by the manufacturer in a bid to improve user experience. An individual can lose control if someone hacks into their smartphone or computer and remotely operates other devices. There’s no doubt that our smartphones carry a majority of our information. They are linked to our bank accounts, email accounts and even systems that need authorization. In fact, experts predict that there would be about 31 billion connected IoT devices by the year 2021. Usually, hackers employ methods that are undetected, so more connections would mean an increase in hacking activities as well. The data collected from an individual’s smartphone or laptop can give hackers a detailed look into their activities, including internet searches and purchasing power. The information is typically used to work on user experience, but also can be used to target particular products to the individual. Sometimes, this data is even sold to other organizations that are looking for a target audience to sell their products.


Improving data management in the life sciences industry

If an email account is breached, the data on that user’s account will be visible to the attacker. Should emails featuring product artwork or containing sensitive information be visible to the employee, they will also be accessible to a cybercriminal who has admittance to the account. Despite stricter serialisation regulations and the efforts of the wider industry, the full supply chain remains at risk of this information being sold to counterfeiters. Addressing this possibility should be a priority for regulators now that a number of serialisation laws in key markets are over the line. New technologies provide opportunities to deliver better communication and collaboration while ensuring compliance and security. Often, this cannot be guaranteed by unsecure tools like email. Using platforms or systems that offer a shared workspace, accessible by multiple organisations, enables collaborative project management, with a clear, immutable audit trail. They also support companies in the gathering and analysis of data which has a number of high value use cases. One of the most promising and impactful will be improved supply and demand forecasting.


How Does Data Management Drive Efficiency for Organizations?

In an ideal business world, many different Data Management professionals collaborate and execute best practices to extract the maximum business value from their enterprise data assets. These professionals are data architects, data engineers, data modelers, DBAs, developers, data quality experts, and data governance experts, who work alongside executives and high-level, decision-makers to conceptualize, design, develop, and implement the desired Data Management infrastructure. Data Management teams often work with real-time data, which requires superior data capture, data integration, data preparation, and data analytics platforms — now available due to AI and ML. Many associated technologies like data fabric, graph processing, IoT, big data, edge computing, and so on need to work in conjunction with each other to make the unified Data Management system work. At a more nitty-gritty, technical level, complex Data Management tasks happen through Metadata Management, Master Data Management, advanced data compliance tasks, and continuous monitoring. A relatively new Data Management effort creates “data catalogs” to document which data is available where, including business glossaries, data dictionaries, and data lineage records.


Automating Machine Learning: Google AutoML-Zero Evolves ML Algorithms From Scratch

Evolutionary algorithm (EA) is a subset of evolutionary computation, a family of population-based trial and error problem solvers with a metaheuristic or stochastic optimization character. In evolutionary computation, an initial set of candidate solutions is first generated and then iteratively updated. Each new generation is produced by stochastically removing less-desired solutions and introducing small random changes. Evolutionary algorithms use mechanisms inspired by biological evolution such as reproduction, mutation, recombination, and selection. EAs often perform well in approximating solutions to a range of problems that would otherwise take too long to exhaustively process. The use of evolutionary principles for automated problem-solving was formally proposed and developed more than 50 years ago. Artificial evolution became a widely recognized optimization method as a result of the work of German researcher Ingo Rechenberg, who used evolution strategies to solve complex engineering problems in the 1960s and early 1970s. In 1987, Jürgen Schmidhuber published his first paper on genetic programming, and later that year described first general-purpose learning algorithms in his diploma thesis, Evolutionary Principles in Self-Referential Learning.


Rise of automation creates new RPA job descriptions

Automation engineers by nature need to have a broad set of capabilities in order to support a mix of no-code platforms, API integrations and traditional coding practices to build fully functional offerings for clients. Traditional development teams often look for talent that has deep capabilities in narrow fields. In contrast, Cottongim said automation engineers should be conversant in a wide variety of tools and techniques but not necessarily a master in any one. Automation engineers will also need to have skills beyond traditional roles for engaging with their business partners and being able to distill business needs into rapidly executed automation offerings. They will also need to be able to apply a customer-centric view and build in an agile manner, while partnering closely with their business teams. Cottongim also expects to see more demand for cloud architects and cloud engineers that can support intelligent automation needs. They will need to understand how to create applications built from a mix of VMs, databases, networking and high-availability management techniques. 


Is Open Finance worth getting excited about, or is it just spin?

On the bright side, there are protections in place and limitations; overseen by the regulator. Users completely own their data and can revoke the access they give to third-parties at any time. There are also restrictions on companies’ ability to sell the data directly to third-parties. Instead, companies holding the data can monetise it by recommending new pension providers and taking a commission fee, for instance, or charging consumers for the service (like Monzo has done). “What’s going to make or break the success longer term is ‘do you feel confident that you know where this data is going?'” Grose noted, highlighting the need to educate users on their data rights and companies’ use of their data. Nonetheless, Levine warned that some companies might be tempted to charge a so-called ‘privacy premium’, whereby consumers get a worse deal or product based on their financial data. “It only takes one kind of major loss of trust or issue that we find ourselves in a place where actually the whole industry is hurt, and we may be going backwards,” Levine said. Meanwhile, Vans-Colina added there’s a big risk that open banking and finance data will get hacked and leaked.


Data Governance: Stay Non-Invasive in Your Approach

People naturally rebel against the idea of being governed. Data governance is known in some circles as “People Governance” because it is people’s behavior – how they define, produce and use data – that is being governed. In other words, the data will do what we tell it to do, so we must govern people’s behavior if we want to improve the quality, value, and understanding of the data. Therefore, the approach the organization takes to govern the data (and the people) can make or break whether the data governance program is accepted or rejected by the organization. I have been known to say that, “the data will not govern itself.” Let me add to that with, “the documentation about the data, or the metadata, will not govern itself either.” Most of us have experienced data and metadata that has been left ungoverned. Why? Because people are not held responsible for the quality and/or value of the data or the documentation. As a result, there is no way to improve the efficiency and effectiveness of the way data assets are being leveraged. Ungoverned data is replicated many times over with many different versions of the “same” data. 


Creating a modern data governance strategy to accelerate digital transformation

Though it’s early in our journey toward modern data governance, we do have a few best practices to share. Primarily, we recommend that you address your data governance strategy holistically. As illustrated below, we designed our approach so that standards, embedded into the engineering process and data centralization on the modern data foundation worked together to ensure end-to-end modern data governance. Build standards into your existing process and implement them as engineering solutions. By approaching data governance during the design phase of the larger Enterprise Data strategy, we have been able to institutionalize “governance by design” into the engineering DNA—and apply it to data at every touchpoint. We are building our data governance controls into the centralized analytics infrastructure and analytics processes. Consider implementing a modern data foundation with integrated toolsets. The EDL, with its built-in governance services and capabilities, does more than scale data governance efforts—it enables enterprise analytics for the whole organization. 



Quote for the day:

"Be so good at what you do that no one else in the world can do what you do." -- Robin Sharma

Daily Tech Digest - July 23, 2020

Blockchain for Master Data Management

Blockchain allows visibility and traceability of the inventories of the needed supplies. Enterprises can trace and track the documentation and financial transaction. Compared to traditional manual and error-prone approaches, the shared masted information becomes much more accessible. The digitally extended enterprise can use all parts, products, suppliers, warehouses, inventory, documentation, tracing, and financial transaction masters stored on the Blockchain to function as an efficient and optimized pipeline. Supply Chains leveraging Blockchain master data and information are applicable in all industries, and there are various innovative initiatives, projects, and solutions that have demonstrated the compelling value proposition for Blockchain for Supply Chain. ... It gets even more exciting and compelling when the supply chain crosses international borders and involves various country-specific logistical regulatory and financial documents that need to be processed. The IBM-Maersk cross-border shipping Blockchain solution is a compelling text-book example of Blockchain for Supply Chain master data. Maersk had done a study in 2014 tracing roses and avocadoes from Kenya to the Netherlands. The study identified several inefficiencies.


Working Remotely: Good Practices and Useful Resources

While remote working may appear straightforward, there are common issues that come up as you shift to this way of working that may not be apparent, even if you’ve done regular remote days as part of your working week. For people thrust into this suddenly, the impact of the change will be significant. This is not “normal” remote working, in which people have time to plan how they will set up their space, find equipment and furniture which suits their location and lifestyle and make a considered transition to working remotely. This is responding to change in the most immediate way, it probably involves sharing the working space with a spouse, partner, parents or flatmate and quite likely children who are simultaneously trying to figure out how remote-schooling works. One of the most important pieces of advice which has been repeated around the world as societies respond to the need for people to be isolated is “be kind” - be kind to yourself, be kind to your colleagues, be kind to your staff, be kind to your manager, be kind to the people sharing your space.


Phishing attacks and ransomware are the most challenging threats for many organizations

Poor asset and inventory management can prove problematic if an organization is hit by a cyberattack or learns of a serious vulnerability. Only 58% of those surveyed said they can determine within 24 hours every vulnerable asset in their organization following a critical exploit. More than 40% said it would take them 24 hours or longer to identify each vulnerable system. Granting access privileges to users is also a challenge. Too little, and employees have difficulty doing their jobs. Too much, and you open the door to security risks. In this case, though, IT teams tend to lean toward too much. Almost half (48%) admitted to giving at least some users more access privileges than required. Finally, trying to explain the need for certain security methods and projects to the board or senior management can be an onerous task faced by high-level IT personnel. In this case, 52% of the respondents said they had a good discussion and got their point across, though the outcome was not as expected. Only 13% said that these types of presentations go over well and that the board members understand the security situation.


New look for Microsoft Office and Microsoft 365 will tackle work-life distractions on desktop and mobile

In recent years, Microsoft has simplified the Office 'ribbon' — the strip at the top of Office apps with tools, buttons and shortcuts — as well as introduced dark mode and brought its Fluent Design scheme to bear on these apps in mobile and desktop.  "The next wave of Microsoft 365 UX changes will go even further by fading brand colors from app headers and exploring adaptive commanding. A flexible ribbon that progressively discloses contextually relevant commands at the right time just where you need them," explains Friedman.  By flexible, Friedman told The Verge that Microsoft means Office will give users a simplified toolbar that moves around the screen to where users find it most helpful, while commands are surfaced when contextually relevant.  Friedman notes that the ribbon interface originated on the desktop but that Microsoft is trying to reimagine what intent and context-aware commanding looks like when work is carried out across multiple devices.  "Having your ribbon commands follow your actions and being context aware will reduce cognitive load and increase focus on the task at hand, whether you're on your phone in the subway or your tablet on the sofa or your desktop," he told The Verge.


AI is accelerating the move to a touchless world

"As a result of COVID-19, customers are increasingly looking for digital, no-touch connections with organizations, given the constraints and concerns about physical interactions in a new-normal, socially distanced world," Capgemini said. "Our research shows that even when lockdowns are lifted, customers across the world say they will still be looking to make increased use of touchless interfaces, such as voice interfaces, facial recognition, or apps." Touchless interfaces are moving beyond improving the customer experience in an increasingly health-and-safety conscious world into the enterprise. Three-quarters of organizations believe that increasing customer appetite for non-touch practices will persist even in the post-pandemic world. This is helped by the fact that customers' trust in AI is on the rise, with 67% of customers reporting that they trust the personalized recommendations and suggestions provided by AI-enabled interactions. "Trust is something very difficult to gain and very easy to lose," the report quotes Luciano Floridi, a philosophy and ethics information professor and director of the Digital Ethics Lab at the University of Oxford, as saying.


Why Builder Is Often an Antipattern and How to Replace it With Fluent Builder

First of all, let's define the goal. The goal here is to return checks back to compile time. If code which does not build complete POJOs will not pass compilation, then there will be no need for dedicated tests, no need to perform checks in build() method. But, most importantly, we will remove a lot of mental overhead from developers. So, how this can be done? Probably, the most obvious way is to use the Fluent API pattern. The Fluent API has two parts (just like Builder, by the way): provide a convenient way to invoke methods in a chain (both, Fluent API and Builder are identical in this part) and restrict every subsequent call in the chain to only an allowed set of methods.  The second part is what is most interesting for us. By limiting the set of methods that can be invoked at every step of building POJOs, we can enforce a particular sequence of calls and enable the call to the build() method only when all fields are set. This way, we shift all checks back to compile time. As a convenient side effect, we also make sure that all places where particular a POJO is built look identical. 


How neural network training methods are modeled after the human brain

At a foundational level, neural nets start from some untrained or pretrained state and the weights are then adjusted by training the network to make the output more accurate. While this may sound simple, adjusting the weights can take lots of time and compute power to get correct. Each hidden layer in the neural net detects a specific class of features. If we take a neural net that is built to detect cats, the first layer might detect some level of abstraction in the image. The next layers then detect a further level of abstraction. With enough training data, the neural net will adjust its weights to be able to detect if the image presented is a cat or not a cat. Now, you've built a model that identifies cats, a binary classifier that will give you a probability of whether the image is a cat or not. However, since this model was not trained on bird images, or car images, or flower images, the entire process needs to start over to accurately detect each different object. While there are approaches to take a neural network that has learned one thing and apply it to another similar training task, called transfer learning, in general, neural networks are narrow in what they have learned.


Chinese hackers blamed for the spread of MgBot Trojan across India, Hong Kong

It is believed that the RAT is being deployed via spear phishing emails and is used in targeted attacks against political entities and individuals. "The lures used in this campaign indicate that the threat actor may be targeting the Indian government and individuals in Hong Kong, or at least those who are against the new security law issued by China," the team says. If a victim downloads the phishing document and enables macros, the payload is deployed and executes, disguising itself as Realtek Audio Manager tool. The final payload is dropped via the Application Management (AppMgmt) Service on Windows. MgBot is able to link up to a command-and-control (C2) server to transfer stolen device data, take screenshots, log keys, kill, disable, and create processes, create Mutex resource restrictions, and uses persistence mechanisms. The malware's authors have also attempted to stop the malicious code from being analyzed through the implementation of anti-analysis and anti-virtualization methods. These include the self-modification of code, checks for existing antivirus products, and scans for virtualized environments such as VirtualBox. 


How COVID is Changing Technology Futures

In a normal economic downturn, you'd see companies getting conservative. However, in this one, companies are realizing that they are behind in the game, and they need to respond to a new situation. "This will turn into a real innovation accelerator," Biltz said. First, it's changing where investments are going. For instance, at grocery stores a percentage of the workforce will be regularly spraying and sanitizing surfaces. There will be infrastructure changes like the addition of plexiglass guards. Floor tape has been added to show people where to stand. Plus, there have been so many changes to the supply chain, Biltz said. He noted that over the last 4 months there's been a 60% increase in store pickups, and a lot of business moving forward will be conducted digitally and via mobile devices. How does it look for Accenture's clients? "We've got a bunch of companies that say the way they do business needs to change," Biltz said. "They need to innovate to figure out how to Rubik's Cube the new way to do it." Thankfully, over the last 10 years most companies have already been heavily investing in their own digital transformations. "This rapid change is almost a stress test for that," Biltz said. "Companies had been trying to make themselves more agile."


Making Workplaces More Humanistic

eing able to become vulnerable will support you in building good business and a more humanistic workplace. To develop the skills to do self-reflection is one of the key activities that you are able to do for yourself and your environment. As a leader, you keep a mirror for your team to see potentials, opportunities, and obstacles. but if you can not see yourself clearly in it, how are you able to reflect on your own behavior and share that with your people, your team? ... I had team members of many ages, races, genders, orientations, and preferences. I had multiple people with mental challenges that could best be described as "neurodiversity". I never cared about how people looked, where they came from, or what they did in their free time. The only thing that mattered was: are they contributing to better products and a better company? If yes, then they were welcome. A humanistic workplace embraces humans of all stripes and colors. A humanistic workplace supports professionals to perform better. In an earlier interview from StretchCon 2020, InfoQ explored how leaders can foster high-performing teams. 



Quote for the day:

"Leaders must see the dream in their mind before they will accomplish the dream with their team." -- Orrin Woodward

Daily Tech Digest - July 22, 2020

Preventing data loss and mitigating risk in today’s remote work environment

Regulations, particularly in the financial services sector, often contain specialized requirements for certain data, which specifies that an organization must control their encryption key. Typically, a very small percentage of a customer’s data falls into this category, but it is important for our customers to care for that specific data correctly. To address that regulatory and unique need for some organizations, today we are pleased to announce the public preview of Double Key Encryption for Microsoft 365, which allows you to protect your most confidential data while maintaining full control of your encryption key. Double Key Encryption for Microsoft 365 uses two keys to protect your data, with one key in your control and the second in Microsoft’s control. To view the data, one must have access to both keys. Since Microsoft can access only one key, your data and key are unavailable to Microsoft, helping to ensure the privacy and security of your data. With Double Key Encryption for Microsoft 365, you not only hold your own key, but this capability also helps you to address many regulatory compliance requirements, easily deploy the reference implementation, and enjoy a consistent labeling experience across your data estate. For more information, check out the Tech Community blog.


Twitter hack raises alarm among government officials, security experts

It's still not known whether a nation-state actor was involved, although Kennedy, like many security experts, notes that “it sure is interesting timing with the election coming up.” However, because President Trump relies so heavily on Twitter to communicate his messages, Kennedy doesn’t believe that Russia would be the culprit this go-around. “If you think Trump and Russia are in cahoots, it would not be in the Russians’ best interest to make Twitter look like an untrusted source of information.” The distinction between Twitter and other critical services is that Twitter doesn’t maintain a unique infrastructure for which the marketplace cannot quickly and easily provide a substitute. It is, in essence, just a form of speech, which is backed by sophisticated infrastructure, to be sure. It is fundamentally a communications platform protected by the First Amendment right to free speech, some experts say. “Regardless of the ubiquity of platforms like Twitter, they are not 'critical infrastructure' like the telephone system or the electric grid that are necessary to the operation of vital functions,” Robert Corn-Revere, First Amendment law expert and partner at Davis, Wright, Tremaine LLP tells CSO. “It is not as if news or political dialog would stop if Twitter were disrupted,” he adds.


Cybersecurity Lessons from the Pandemic

When a crisis hits, it's usually late in the investigation that we discover the unknowns that we didn't know about. For example, when COVID-19 initially became known, experts assumed it had spread to only a few Asian countries. As a result, many countries outside of Asia immediately set in motion preventive measures and travel bans for people traveling from those countries, while still keeping open borders for other nations. It was discovered later how coronavirus spread to rest of the world and that cases in Italy had escalated drastically in just a few days, thereby revealing the true extent of spread and risk exposure. Similarly, when a cyberattack happens, it is mostly during the ongoing investigation, and often later rather than earlier, that one finds out about the true extent of infiltration, risk exposure, and the effects on an organization's infrastructure and business. It's this meta-ignorance that poses a challenge and prevents us from being immune to these unknown threats that we don't know. The other aspect that connects the challenges of a pandemic to the challenges we face today in cybersecurity is the extensive globalization, digitalization, and interconnections.


COVID-19 fuels cyber attacks, exposes gaps in business recovery

With added risks from third-party applications and the supply chain, these findings revealed that the extended enterprise was under pressure, according to Rick McElroy, VMware Carbon Black's cyber security strategist. The COVID-19 outbreak also unveiled gaps in business recovery planning of 89% in the country, who described such holes as slight to severe. Another 86% uncovered gaps in their IT operations as a result of the pandemic, while 85% identified problems due to a remote workforce and 73.5% had issues related to visibility of cybersecurity threats. McElroy said: "The global situation with COVID-19 has put the spotlight on business resilience and disaster recovery planning. Those organisations that have delayed implementing multi-factor authentication (MFA) appear to be facing challenges, as 32% of Singaporean respondents say the inability to implement MFA is the biggest threat to business resilience they are facing right now. "These figures indicate that the surveyed CISOs (chief information security officers) may be facing difficulty in a number of areas when answering the demands placed on them by the COVID-19 situation," he said. 


AI Adoption – Data governance must take precedence

Unsurprisingly, across the board research and development dominate in current AI adoption trends, followed closely by applications in IT and customer service. That being said, respondents cited a widening range of industry areas in which functional parts of a company use AI. As a whole, this indicates that companies are increasingly turning to AI and machine learning as a business tool. Obstacles are to be expected on the path to digital transformation, particularly with unfamiliar entities in the mix. For AI adoption, the most prevalent obstructions are: a company culture that doesn’t recognise a need for AI, difficulties in identifying business use cases, a skills gap or difficulty hiring and retaining staff and a lack of data or data quality issues. With this broad spectrum of challenges, it is worth delving into a couple of them. Firstly, it is interesting to note that an incompatible company culture mostly affects those companies that are in the evaluation stage with AI. When rephrased, perhaps it is obvious – a company with “mature” AI practices is 50 percent less likely to see no use for AI. By contrast, in a company where AI is not yet an integrated business function, resistance is more likely.


Remote working: We're stressed and distracted and making these security errors

"Working in unusual environments can be stressful and distracting," said Hancock. "Prior to the pandemic, people were used to operating in distinct spaces - home, work, social - and we had different ways of understanding the world in each space. The events of 2020 mean these spaces have blurred, and we've had to quickly learn new ways of operating and this has its challenges." Other reasons for people clicking on phishing emails included the fact that they looked legitimate (43%) and the fact that they appeared to have come from a senior executive (41%) or a well-known brand (also 41%). Men were twice as likely as women to fall for phishing scams, with 34% of male respondents saying they have clicked on a link in a spoof email compared to just 17% of women. Those working in the tech industry were the most likely to click on phishing emails, with nearly half of respondents in this sector (47%) admitting having done so. This was closely followed by employees in banking and finance, with 45% of workers admitting to have clicked on phishing links in emails. Fatigue was another factor in causing workers to click on malicious links, and was also cited as a top reason for sending an email to the wrong person by 44% of respondents. Nearly half (46%) of respondents said they had experienced burnout in their career.


4 Steps to Help You Plan a Cyber Resilience Roadmap

Keep in mind resources are not purely technological. Your resource mix is made of up technological and human capital, including how they operate and interact with each other. You can have the latest-and-greatest tools all properly configured, but, if you do not have an experienced and properly-trained team managing and maintaining these tools, these tools may never see the light of day.  You also need to be cognizant that all current and future information security tools could lead you into a privacy jam if use is not thought through. Anything from real-monitoring issues to holding too much (or unnecessary) amounts of personally identifiable information (PII) increases the liability side of your balance sheet. Therefore, it’s the totality of your resource mix that will help determine your current position. So how do you determine your current position? It all begins with risk management. Risk management is by no means a science, even though a lot of science goes into it. As some environments become more complex, their likelihood for fragility increases, notes risk management expert Nassim Nicholas Taleb in his book “Antifragile: Things That Gain from Disorder.”


Engineering Successful Cloud Migrations

The perception of agility on the cloud is largely from the lens of provisioning. Unlike the infrastructure on premises, provisioning necessary infrastructure and platform resources is far more convenient on the cloud, albeit at a cost. But this is only a small component in the overall process of launching a change into production. Achieving agility on the cloud involves relentless automation and optimisation of not just the delivery pipeline but also the business. When combined with lean practices and evolutionary architectural principles, businesses rapidly adjust to capitalise on opportunities and reduce risks. The emergence of digital technologies on cloud platforms, in combination with agile practices, promises faster innovation. Most cloud vendors are offering technologies that are building blocks for IoT sub-systems, data science applications, big data pipelines, and AI/ML services. This allows cloud consumers to build and evolve digital applications on the cloud fairly quickly. This convenience comes with its own challenges. Vendor lock-in is a big risk as these technologies offered by different cloud vendors may not be compatible. Applications built using Domain Driven Design techniques can be migrated between different cloud offerings if they have interfaces to these technologies on the host cloud offering.


Dell XPS 15 9500 (2020) review: Still the 15-inch laptop to beat

Cramming a 15.6-inch screen into a chassis with a 344mm by 230mm footprint is quite a feat. This year's model comes in at 18mm thick (1mm more than the 2019 XPS 15), and has a starting weight of 1.8Kg, which you'll certainly feel in a backpack. The trade-off is a very robust build utilising carbon fibre to add a real solidity to the chassis. There's no give in the thin lid section, nor in the base, wrist rest or keyboard. A sleeve probably isn't necessary to provide in-bag protection, unless you want to preserve a scratch-free finish to the outer chassis. There are two other notable design changes compared to last year's model. One of these is the touchpad, which has increased significantly in size. It now looks almost comically huge, but in fact the size makes navigation around the screen easier: there's no need to feel for one edge if you want to drag the cursor from one side of the screen to the other. After writing this review, going back to my regular laptop's smaller touchpad felt positively constraining. ... The XPS 15 9500 really stands out for the quality of its 15.6-inch display. My review unit had the top-end 4K+ touch screen with 3,840 by 2,400 resolution (290ppi). 


The State of Hacktivism in 2020

While the days of high-risk technical hacks dominating headlines may be gone, the Twitter hijack and BlueLeaks show there are still hackers looking to access secure data — and their reasons remain varied. One thing that might temper planned hacktivist actions could be "the hammer of the state" in the form of aggressive law enforcement, says Coleman, author of "Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous." DDoSecrets has said they're prepared for the US government to come after them, but Coleman isn't so sure. "The question is whether BlueLeaks will be stamped out in the next few months. But the blocking and censorship makes them more visible," she says. Organizing groups to participate in social media actions is not prevented under the Computer Fraud and Abuse Act (CFAA), the broad antihacking law that has been amended several times but not dramatically changed since it was passed in 1986. But more technical hacks of networks remain illegal, and prosecutors still have broad leeway in pursuing computer crimes, seven years after the prosecution and subsequent suicide of Internet hacktivist Aaron Swartz under the CFAA.



Quote for the day:

"Let us not look back in anger or forward in fear, but around in awareness." -- James Thurber

Daily Tech Digest - July 21, 2020

Why You Should Consider A Career In Data Science.

Another thing that makes data science so popular is that it accepts people of all sorts, regardless of their background and domain. People in literally any industry can move into data science and still do amazing work in their industry with the help of data science. People from the banking and finance industry, food and health sector, arts, climate science, engineering, and physics can all couple their domain knowledge and expertise with data science and make ground-breaking progress. You do not necessarily need to have a BSc or MSc in computer science or engineering in order to start a career in data science but rather couple data science with whatever career you currently have, find a problem you can solve with the combination of both and do something. Data science in combination with Artificial Intelligence, Machine Learning, Robotics, and the Internet of Things has the power to literally automate anything in order to make lives easy. Automation of tasks can also bring huge progress to companies since work can now be done faster. Also, when work is done by humans, there is a natural tendency to be inconsistent and make human-related errors. Automating tasks handles these problems and gives us better results in a shorter time.


Top CEOs Agree That Culture Is The Key Before, During And After Crisis

“The One Carnegie approach, starting with myself and our executive team, really means coming together around common values. It doesn’t matter the country, language, race or religion, we wanted people to come together around our strong values. Just like Dale Carnegie would say, ‘Try honestly to see things from the other person’s point of view.’ “The essence is that we want to value each person as an individual and as part of an organization. People value transparency and openness. When the pandemic hit, our One Carnegie foundation helped us tremendously. From a cultural standpoint, there was transparency, and we communicated very clearly what was happening and how we were responding to it. We shifted our entire global in-person training business to live online trainer delivery, and this could not have happened without a culture of working together and moving fast. Our strong culture created alignment in all 86 countries. People felt safe asking questions and working together. The results we are seeing are extraordinary.” CEO Gary Terrinoni of Brooklyn Hospital, founded in 1839 and cited as the number one safety net hospital in America, shared, “We had to move people around to be able to support the issues that we had with COVID-19, and people just stepped up. 


What to look for when modernizing the Data Lake

Whether a company is born into the digital world or has a more traditional business, they must invest and excel in tech advances such as mobility, cloud computing, and most importantly, advancedanalytics and data science. Doing so will equip them with the right tools to innovate their existing operations and deliver a seamless experience to customers. However, it isn’t that easy to achieve this goal. To realize the benefits of advances in technologies, organizations must leverage all their data. This requires modernizing their data architectures. In other words, organizations must unlock andmigratetheir data from multiple, heterogeneous systems including legacy mainframe systems and enterprise applications, and quickly process and refine it for consumption in AI and ML initiatives. Modern, cloud-based data lakes provide enterprises the agility and flexibility they need to store and process massive volumes of diverse data. Things to keep in mind when architecting a modern data lake. Data architectures are constantly evolving. Companies are adding new sources of data, offloading data to new target systems for processing and refining, and adding new analytical tools and solutions to their technology infrastructure.


If software architects' soft skills fail, so does the business

The history of software development contains rich lessons, both good and bad. We assume that current capabilities (like elastic scale) just appeared one day because of some clever developer, but those ideas were often born of hard lessons. Pets.com represents an early example of hard lessons learned. Pets.com appeared in the early days of the internet, hoping to become the Amazon.com of pet supplies. Fortunately, they had a brilliant marketing department, which invented a compelling mascot: a sock puppet with a microphone that said irreverent things. The mascot became a superstar, appearing in public at parades and national sporting events. Unfortunately, management at Pets.com apparently spent all the money on the mascot, not on infrastructure. Once orders started pouring in, they weren't prepared. The website was slow, transactions were lost, deliveries delayed, and so on … pretty much the worst-case scenario. So bad, in fact, that the business closed shortly after its disastrous Christmas rush, selling the only remaining valuable asset (the mascot) to a competitor. What the company needed was elastic scale: the ability to spin up more instances of resources, as needed. 


Successful innovation doesn’t have to be disruptive—it’s often small, incremental, and fast

The tension between breakthrough and incremental approaches can be found in most settings, not just online businesses. For example, medicine has had a long tradition of searching for interventions that have transformative outcomes on patients. But perhaps, as surgeon and researcher Atul Gawande argues, success “is not about episodic, momentary victories, though they do play a role. It is about the longer view of incremental steps that produce sustained progress.” That, Gawande continues, “is what making a difference really looks like. In fact, it is what making a difference looks like in a range of endeavors.” One endeavor, manufacturing, has known and practiced this approach for decades. In Toyota’s renowned production system, for example, real-time experiments by its factory workers to eradicate problems are an integral part of its continuous improvement system. Even there, people are expected to form clearly articulated, testable hypotheses and explain their logic for each attempted improvement. Of course, breakthrough and disruptive innovation will continue to play an important role in driving growth, as there are limits to incremental approaches.


Determining and overcoming blockchain fatigue

“Blockchain fatigue sets in mainly due to the fact that not many people fully understand what this technology offers and so have difficulties trying to implement it into their business or process. This lack of understanding can lead to frustration and consequently a dwindling enthusiasm for the technology. “While still in its infancy, blockchain is perhaps stretching the patience of those who were initially overly optimistic about the technology. The continued lack of full-scale implementation of blockchain is creating this sense of fatigue as there are still no end-to-end fully deployable solutions available for enterprises. “Most of the work still focuses on small pilot projects and this, coupled with technology immaturity, lack of standards and a general misunderstanding of how blockchain technology works and what it offers, is also contributing to the market feeling fatigued with blockchain.” While usage of blockchain within various sectors continues to grow and develop beyond its best known function within cryptocurrencies, a recent study from Deloitte shows that a rising number of senior executives and practitioners worldwide are seeing the technology as overhyped, with 55% stating this in 2020. With this in mind, what must organisations do to overcome blockchain fatigue and continue to keep faith?


How Quantum Mechanics will Change the Tech Industry

In a digital computer, the system requires bits to increase its processing power. Thus, in order to double the processing power, you would simply double the amount of bits — this is not at all similar in quantum computers. A quantum computer uses qubits, the basic unit of quantum information, to provide processing capabilities unmatched even by the world’s most powerful supercomputers. How? Superposed qubits can simultaneously tackle a number of potential outcomes (or states, to be more consistent with our previous segments). In comparison, a digital computer can only crunch through one calculation at a time. Furthermore, through entanglement, we are able to exponentially amplify the power of a quantum computer, particularly when comparing this to the efficiency of traditional bits in a digital machine. To visualise the scale, consider the sheer amount of processing power each qubit provides, and now double it. But there’s a catch — even the slightest vibrations and temperature changes, referred to by scientists as “noise”, can cause quantum properties to decay and eventually, disappear altogether. While you can’t observe this in real time, what you will experience is a computational error.


Remote work is the new normal. But the tech problems won't go away

Once the technical issues are overcome, there is much to be gained from an off-premise workforce. Employees themselves seem to draw a better work-life balance out of telecommuting; in fact, three-quarters of UK employees have reported not wanting to go back to the office full-time. Half of the business leaders surveyed by Riverbed named a better work-life balance as a bottom-line benefit for their employees as a result of remote working. An equal proportion of respondents also mentioned savings from office space, and 43% said that they expected flexible working to increase productivity. "In a year's time, I believe the biggest difference to everyday work will be that people will be much more available, without all of the complications and logistics that we have always known, and this will make them more efficient and productive," says Bombagi. Since the start of the crisis, he has noticed that he can fit in up to eight virtual customer meetings on a given day, where he could previously only do two, and only if they were both based in London.  His working day used to be planned around logistics: "If I'm going to be on the Tube, I know I can't make a call. If I'm driving somewhere, I can make a call, but I can't do a presentation. If I'm on a plane, apart from some email, I can't really do anything," says Bombagi.


Quantum Computing: Looking Ahead To Endless Possibilities

It’s a strange behavior of quantum mechanics whereby the more complex the calculation is, the more impressive the algorithm becomes. Sometimes the result of square root acceleration is trumped by completing calculations in a logarithm of the time — so exponentially faster. Essentially, unlike the computers we know and use, it’s not a simulation or manufactured programmatic function that’s doing the calculating — it’s the quantum world, which needs to be maintained at almost absolute zero temperature with no interruptions or interactions with its surroundings. We’re so far away from these realities in an applicatory sense, but the fact that we know they are there — and in a few special cases, they already exist — is enough of a reason to begin thinking. If we don’t acknowledge the potential and possibilities now, by the time it does become application-worthy, the AI contingent will have already missed the boat. The aforementioned "few special cases" so far include the likes of Microsoft, IBM and Intel, as well as Google. They are further ahead than anyone else has been in history to unlocking the scope of quantum computing. To be able to wade through vast swathes of data laden with millions and billions of constraints, all in the blink of an eye.


Bringing NetOps Up to Speed With DevOps

Fortunately for NetOps teams, myriad networking vendors today readily offer pre-built, certified solutions for DevOps platforms, making it easier to get started on a cloud-native journey by automating activities such as device onboarding and configuration changes. This way, network administrators can leverage existing vendor partnerships, in-house knowledge and technology that is already proven within the larger IT environment. Additionally, network engineers shouldn’t need—and won’t have the extra time—to become top-notch developers to take advantage of programmability during their cloud-native journey. Developing basic programming skills is advantageous, but network management systems that offer Python scripting, a consistent set of APIs and webhooks can perform the “heavy lifting” when it comes to enabling extensibility with third-party IT platforms. Today, this level of extensibility includes being able to integrate with third-party IT service management tools. A common use case that can realize significant time savings and greater network and application availability is to auto-trigger and assign an incident ticket when a performance SLA is breached. 



Quote for the day:

"The task of leadership is not to put greatness into humanity, but to elicit it, for the greatness is already there." -- John Buchan