Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Daily Tech Digest - February 19, 2018


The problem is that employee satisfaction can be a double-edged sword. While satisfied employees are good for current activities, that very satisfaction can inhibit innovation. Transformative innovation is difficult. It is far easier to stick with what we know works and tweak the current process than it is to start over. People who are satisfied with the current way of doing business are not likely to transform it. People who transform their organizations must be aggravated enough with the current situation that they’re willing to bear the effort and risk to change it. Leaders who want their organizations to continuously transform must not only look for dissatisfaction on which to capitalize, but also be willing to cultivate dissatisfaction in their employees. ... The right kind of dissatisfaction is a mindset of constantly questioning the status quo and striving for more-than-incremental change. The wrong kind is constantly finding fault with the current situation, arguing that it is somebody else’s fault and assuming it’s somebody else’s responsibility to fix.



Dear IT security pros: it's time to stop making preventable mistakes

5 fumbling dumb mistake
Just think about it – how many log analysis services do you know? They generally all have a nice UI. Same goes for SIEMs. But the confusion comes with the graphic and alert overload – red and green icons telling analysts there are numerous findings that require attention. Security analysts usually don’t know which alerts to start executing on – and it’s hard to determine which alert is of the highest risk and which is just noise because no personnel changed its threshold. And to make matters worse, once a security analyst has opened an alert to start vetting it, they’re usually too scared to close down wide-open-to-the-internet ports because they don’t know the extent of the impact that will have on the company’s production environment. As a security advisor, the thing that really irritates me is just how preventable most (if not all) of the 2017 attacks I researched were. Companies like Equifax are not being decimated by unusually savvy hackers, they are being exposed by their own internal mistakes. Most of these errors are straight out of any “Tech Security 101” textbook.



Global cyber risk perception: Highest management priorities

The survey also found that a vast majority – 75% – identified business interruption as the cyber loss scenario with the greatest potential to impact their organization. This compares to 55% who cited breach of customer information, which has historically been the focus for organizations. Despite this growing awareness and rising concern, only 19% of respondents said they are highly confident in their organization’s ability to mitigate and respond to a cyber event. Moreover, only 30% said they have developed a plan to respond to cyber-attacks. “Cyber risk is an escalating management priority as the use of technology in business increases and the threat environment gets more complex,” said John Drzik, president Global Risk and Digital, Marsh. “It’s time for organizations to adopt a more comprehensive approach to cyber resilience, which engages the full executive team and spans risk prevention, response, mitigation and transfer.”


Meaningful AI Deployments Are Starting To Take Place: Gartner

Meaningful AI deployments are starting to take place: Gartner - CIO&Leader
Meaningful Artificial Intelligence (AI) deployments are just beginning to take place, according to Gartner. Gartner’s 2018 CIO Agenda Survey shows that 4% of CIOs have implemented AI , while a further 46% have developed plans to do so. "Despite huge levels of interest in AI technologies, current implementations remain at quite low levels," said Whit Andrews, research vice president and distinguished analyst at Gartner. "However, there is potential for strong growth as CIOs begin piloting AI programs through a combination of buy, build and outsource efforts," As with most emerging or unfamiliar technologies, early adopters are facing many obstacles to the progress of AI in their organizations. Gartner analysts have identified the following four lessons that have emerged from these early AI projects


Hacking critical infrastructure via a vending machine? The IOT reality

Many are currently, and rightly, concerned about protection from outside threats getting into important networks. The latest firewalls, intrusion prevention systems, advanced protection systems all play a part in defence, but as more and more connected devices enter networks, it is now critical to look at threats from within as well.  If firms do not have proper infrastructure to support IoT devices, they risk exposing their corporate networks to malicious activities. This can lead to devastating effects, especially if hackers uncover vulnerabilities in IoT devices within critical infrastructure. A good starting point for businesses as they take their network security efforts seriously in today's hyper-connected world, is to increase awareness of all the devices on the network and implement centralised management systems that help ensure compliance.


Ok, I Was Wrong, MDM is Broken Too: Insular, Dictatorial MDM Doesn’t Work

Ok, I Was Wrong, MDM is Broken Too: Insular, Dictatorial MDM Doesn’t Work
In master data management, fundamentally, your data problems are not technology problems. They are not even MDM problems. Your data problems aren’t even really well … data problems. They are business problems. They are the problem of getting four business people, three data stewards and several application managers into a room to formally agree on what revenue is for a customer record stored in the sales, marketing, ERP, and finance systems. MDM problems are about getting the right people educated, motivated and in agreement. And this can be messy and difficult. When you succeed with MDM you succeed by working from the business down. When you fail you fail because you design and implement something around a technology first and then you ‘release’ your master data solution to various practitioners around your company and expect them to comply. Like my peers in my freshman programming course we race to implement without spending enough time planning, negotiating and understanding.


Dissect the SQL Server on Linux high availability features


The availability group configurations that provide high availability and data protection require three synchronous replicas. When there is no Windows Server failover cluster, the availability group configuration is stored in the master database on participating SQL Server instances, which need at least three synchronous replicas to provide high availability and data protection. An availability group with two synchronous replicas can provide data protection, but this configuration cannot provide automatic high availability. If the primary replica has an outage, the availability group will automatically fail over. However, applications cannot automatically connect to the availability group until the primary replica is recovered. You can have a mixed availability group that contains both Windows and Linux replicas, but Microsoft only recommends this for data migration.


“Less is More”: Four Steps to Aligning Your Project Queue and Goals Today

aligning-project-queue
Today, as grown ups, “busywork” no longer holds the cachet it once may have. With corporate belts tightening and analytics available that expose the efficacy of each and every tactic, bloat can be harmful or fatal to even the most well intentioned of marketing professionals. And with 40 percent of corporate enterprises still bemoaning the fact that they can’t prove the ROI of their marketing activities, it’s clear that in many marketing departments, the project queue may be filled with plenty to keep the team busy – but is it hitting the mark? I recently spent time with a financial services client that was struggling to define growth, as it battled for market share in a crowded segment. Upon evaluating its marketing portfolio, it was clear that it had completed many projects in the recent past – but only a handful had yielded what one would consider to be “big wins.” 


How to connect to a remote MySQL database with DBeaver

dbeaverhero.jpg
If your database of choice is MySQL, you have a number of options. You can always secure shell into that server and manage the databases from the command line. You can also install a tool like phpMyAdmin or adminer to take care of everything via a web-based interface. But what if you'd prefer to use a desktop client? Where do you turn? One possible option is DBeaver. DBeaver is a free, universal SQL client that can connect to numerous types of databases—one of which is MySQL. I want to show you how to install and use DBeaver to connect to your remote MySQL server. DBeaver is available for Windows, macOS, and Linux. I'll be demonstrating on a Ubuntu 17.10 desktop connecting to a Ubuntu Server 16.04. The installation of DBeaver is fairly straightforward, with one hitch. Download the necessary .deb file from the downloads page and save it to your ~/Downloads directory. Open up a terminal window and change into that directory with the command cd ~/Downloads.


5 things that will slow your Wi-Fi network

snail rocket fast speed
The 2.4 GHz frequency band has 11 channels (in North America), but only provides up to three non-overlapping channels when using the default 20 MHz wide channels or just a single channel if using 40 MHz-wide channels. Since neighboring APs should be on different non-overlapping channels, the 2.4 GHz frequency band can become too small very quickly. The 5 GHz band, however, provides up to 24 channels. Not all APs support all the channels, but all the channels are non-overlapping if using 20 MHz-wide channels. Even when using 40 MHz-wide channels, you could have up to 12 non-overlapping channels. Thus, in this band, you have less chance of co-channel interference among your APs and any other neighboring networks. You should try to get as many Wi-Fi clients as you can to use the 5 GHz band on your network to increase speeds and performance. Consider upgrading any 2.4 GHz-only Wi-Fi clients to dual-band clients.



Quote for the day:



"Learn to do favors not for the people that can later return the favor but for those that need the favor." -- Unknown


Daily Tech Digest - November 16, 2017


Since blockchains are still (relatively) new pieces of technology, we are not exactly sure which decentralized applications will survive long term. The only certainty is that with advancement comes disruption, and we are likely to see fundamental shifts in the way many common markets work. One of the more exciting ways in which blockchain is affecting an industry is in the independent freelancers’ space. Freelancers and independent contractors make up a sizable chunk of the U.S. population: there are currently over 55 million domestic freelancers. Though this group has been growing significantly over the past several years, they are still plagued with annoying transaction costs and plenty of competition. Blockchains, in theory, will open up new doors for freelancers across the globe.



You Let That In? IoT Security Concerns

To this day, malware attacks based on similar technology are a part of daily Internet life. Conservative estimates predict 25 billion Internetconnected sensors by 2020. It’s unlikely that this horde will be protected by strong security. Security experts are spooked about the dangers of IoT and have recommended that the US federal government regulate the field to ensure that standard cybersecurity measures are part of the new devices. However, the current administration looks askance at new regulations, and even if they were to act, it would take some years to stop the current onslaught of an insecure IoT. We will be left to our own devices for cybersecurity protection for the immediate future. Let’s step back and look at the risks and what the educated consumer can do about mitigation.


Why AI Is the ‘New Electricity’

110617_AIfuture_rosie
Just as electricity transformed the way industries functioned in the past century, artificial intelligence — the science of programming cognitive abilities into machines — has the power to substantially change society in the next 100 years. AI is being harnessed to enable such things as home robots, robo-taxis and mental health chatbots to make you feel better. A startup is developing robots with AI that brings them closer to human level intelligence. Already, AI has been embedding itself in daily life — such as powering the brains of digital assistants Siri and Alexa. It lets consumers shop and search online more accurately and efficiently, among other tasks that people take for granted. “AI is the new electricity,” said Andrew Ng, co-founder of Coursera and an adjunct Stanford professor who founded the Google Brain Deep Learning Project, in a keynote speech at the AI Frontiers conference that was held this past weekend in Silicon Valley.


How patchable software can secure the IoT

patch
A new generation of patchable gadgets and software, such as Kidgy, is then needed for the IoT to endure. Already, smaller programs have sprung up from the initiative of tech-enthusiast around the country, but a broader approach, ideally one led by government regulators and tech-behemoths working in tandem, is desperately needed. Until the biggest fish in the pond realize that our current pattern of releasing unpatchable programs and hardware is fixed, the IoT will continue to suffer massive data breaches that plague companies and consumers alike. Of course, it shouldn’t come as a surprise to the business-savvy that the current generation of IoT gadgets is defined by their inability to be patched; the producers of these gadgets and software stand to make much more money if they can churn our unsecure products, and would shoulder the brunt of the cost if more stringent regulations were imposed.


Data Visionaries Help Companies Thrive Through Digital Transformation

Data Thrivers are taking steps to increase revenue, improve business outcomes, and transform data into dollars. Many Fortune 100 companies are building out innovation labs, as well as creating new roles for innovation executives and data management officers. Of the organizations who participated in the study, almost half already have a Chief Data Officer.  Data Survivors are losing revenue opportunities, lagging in employing data to enhance customer satisfaction, and being overwhelmed by their data. They use disparate tools to manage data that is in different formats and different locations, which adds extra complexity to managing security, risk, privacy, and compliance. ... Organizations that exhibit Data Thriver behaviors are adopting a diverse set of technologies, including data services for the hybrid cloud.


Blockchain-as-a-service allows enterprises test distributed ledger technology

FinTech - financial technology - blockchain network - distributed ledger wireframe
While heavily hyped, blockchain technology – which gained its initial notoriety from bitcoin cryptocurrency – has the potential to offer a new paradigm for the way information is shared; tech vendors and companies are rushing to figure out how they can use the distributed ledger technology to save time and admin costs. BaaS offerings are particularly attractive because many enterprises can look to their current cloud providers to offer them use of the nascent technology. "As with any new technology, there is a learning curve as enterprise customers put it into production," Fearnley said. "One advantage of partnering with a BaaS provider is users can leverage the lessons learned by the provider to help make their systems more secure." BaaS providers are also acting as consultants on the technology, Fearnley said.


Most Banks Still Not Ready For AI, Robotics: Study

banks
The study reveals digitizing products and services, customer journey and security as top focus areas for innovation and transformation. According to the report, retail banks continue their thrust on innovation in all functional areas, with customer experience and channels (both at 78%) being at the forefront. Other segments that have witnessed higher spends in innovation include products (67%), process improvement (64%) and marketing (57%). The research, in which over 300 bankers globally participated, found that retail banks consider large technology companies, challenger banks, and smaller fintech start-ups as threats to their growth. Similar to 2016, the greatest impact of transformation is expected to be in the areas of payments and mobile wallets. The study however points out that the top three innovation challenges include systems integration, legacy technology, and the time and cost required to move from concept to reality.


Banks are increasingly turning to open source projects. Here’s why.


“We want to get to open source as quickly as possible, to start to unlock tools you can use to test software you’re developing in open source — things that won't save us a dime from a human perspective but will make our software better,” said John Stecher, managing director, group head of open innovation and Rise at Barclays. (Rise is the fintech co-working space Barclays runs in seven cities.) “If we pick up developers on the outside world that start to contribute bug fixes, we then benefit from the economies of scale of doing open source development.” This can be a tough sell inside a firm due to legal and regulatory constraints, he acknowledged. “It's a long process, it takes time, but there is a big payout at the end because you slowly start to get higher-quality software at the end of the day,” Stecher said.


The US Pentagon ready to embrace open source software

US Pentagon Open Source Software
Commenting on the news is Javvad Malik, security advocate at AlienVault: “The arguments for and against the use of open-source software are long-standing. While licence costs are eliminated by using open source software, it doesn’t eliminate the associated costs of support, maintenance, and hardware requirements. In the big scheme of things, the license cost may be insignificant in some instances.” “The second widely-debated aspect is the security. The general consensus is that open source software may be more secure because there are more chances for researchers to discover flaws. However, as we saw with OpenSSH and similar, that is not always the case.” “Ultimately, it comes down to individual companies, its risk appetite, and financial requirements. ...”


The benefits of multi-cloud computing

business cloud services flowchart
Cloud-hosting providers come in all different and shapes and sizes, but rare is the provider that can fit all your requirements to a tee. Characteristics like upload speed, size requirements and more influence what makes the most sense for each of your business units can vary. Rather than bend your business processes to fit a specific provider’s setup and execution, play the field and explore different providers to find the best match for each part of your business to line up its functionality for a perfect fit.  ... When the Rebel Alliance figured out that the Empire’s Death Star had a weakness in that small thermal exhaust port, it was only a matter of time before the whole battles station went up in smoke. Some SPOF events occur through machine errors, others come by hacker attacks. Web architects use redundancy to avoid SPOF incidents but what happens when the system host goes down?



Quote for the day:


Failure is the opportunity to begin again more intelligently. -- Henry Ford


Daily Tech Digest - September 03, 2017

A Web Of Interoperable Blockchain Platforms

When blockchain technology first reared its head, interoperability was not a subject of much debate; there was only one blockchain and it was all about bitcoin. As time passed, more and more disparate blockchain platforms rose, among them Ethereum, and these various platforms innovated in different directions, creating their own protocols. These protocols make it impossible for the chains to send and receive data from one another for reasons similar to that of why a program designed for Windows OS will not function on Mac OS. ... These protocols are designed to both maximize efficiency between disparate blockchain deployments and allow for a co-existence between them to form, creating a more cohesive ecosystem. There are some great examples of innovation to that end.


Your Digital Transformation Won't Succeed Without Cultural Change

Companies from the pre-digital era therefore need to adjust or shift their organizational culture to keep up in today’s digital world. MIT Sloan Management Review and Deloitte recently released their third annual Digital Business report. The report highlighted five key practices of companies developing into "more mature digital organizations." Each of these five key practices focuses on some aspect of organizational culture, a clear indication of the importance culture plays in a company’s ability to adopt new business methods and practices. The question is why is modifying culture so challenging and what guidance can companies follow to increase the likelihood of a successful cultural change?


Business intelligence data is getting even more user friendly

In the digital era, data is pervasive. For many organizations, the amount of data they collect has become a major problem. Others struggle to identify what data will be most helpful for them to gather. Big data, while revolutionary, has created a glut of information leaving companies trying to figure out how to structure it to generate actionable insights. Business Intelligence is at the core of any kind of long-term business strategy, because it helps make sense of the data. When utilized, data strategy can have a big impact on any operation. When surveyed, 72% of business leaders said that they lacked the tools to effectively manage their data for their existing and future efforts. To meet that need, technology companies are beginning to bring more integrated solutions to market.


3 key advantages for AI in the retail space

We’ve learned how to understand real-time customer queries via NLP and extract value from legacy data using machine learning methodology. The challenge of making use of ongoing customer feedback is bigger, but so are its benefits. This challenge requires joint forces. First, an NLP engine needs to extract sense from a query in natural language. After, machine learning steps in to extract value from this sense. Using classification, intelligent machines assign meaning to data, relying on their background and existing knowledge. In practice, the system classifies certain products, say “books,” by categories, say “popular among women over 65.” For retail, this means more focused recommendation and upselling. Using clustering for new information, in turn, opens totally new horizons.


Emotional Intelligence Needs a Rewrite

In short, when it comes to detecting emotion in other people, the face and body do not speak for themselves. Instead, variation is the norm. Your brain may automatically make sense of someone’s movements in context, allowing you to guess what a person is feeling, but you are always guessing, never detecting. Now, I might know my husband well enough to tell when his scowl means he’s puzzling something out versus when I should head for the hills, but that’s because I’ve had years of experience learning what his facial movements mean in different situations. People’s movements in general, however, are tremendously variable. To teach emotional intelligence in a modern fashion, we need to acknowledge this variation and make sure your brain is well-equipped to make sense of it automatically.


Get real on container security: 4 rules DevOps teams should follow

The numbers underscore that paying attention to the packages and components that make up a container image is extremely important, especially if the container is from a public repository. Managing the software supply chain requires that companies regularly test their container images for vulnerabilities and vulnerable dependencies. The first lesson is for developers to use container images from sources that they trust, said Anders Wallgren, chief technology officer at Electric Cloud, a software deployment company. "Use images of well-known provenance. If you are going to use Ubuntu, use the published machine instance." In addition, any container image—whether sourced or homegrown—should be frequently tested for vulnerabilities and unwanted software. Luckily, software testing can be easily automated, and should be.


Open Banking - What Does It Mean For Banks And Fintechs?

Open Banking is a new set of regulations in the UK that were created to give consumers more control over their money. The Competition and Markets Authority (CMA) issued new rules that would allow consumers to more easily manage their money, switch accounts to find the best deals for their particular needs, as well as avoid high overdraft charges. These new regulations will go into effect in January 2018. As part of the Open Banking regulations, the CMA set a package of remedies to increase innovation and improve competition in retail banking. This includes a requirement for the nine largest current account providers to make available to authorized third parties – customer consent and secure access to specific current accounts in order to read the transaction data and initiate payments.


Distributed, always-on data management

Data platforms should support applications in context, blending transactional, analytical, search, and graph capabilities. In a financial services context, that might mean taking a credit card transaction, analyzing the customer’s buying patterns and searching for the information to approve the transaction. Data management platforms have to process multiple workloads in a single data platform simultaneously. ... A data platform must provide zero downtime. For example, one DataStax customer kept its recommendation engine running despite a hurricane that took down a whole data center. All of the company’s databases failed except DSE because its architecture was able to retain uptime via data distribution across other data centers.


AI chatbots can provide business value when used wisely

One area where businesses are finding the most value from AI today is in customer service. Chatbot applications are among the most mature areas of AI. But enterprises are finding that, while AI chatbots can provide value, they have to be deployed the right way. For online test preparation company Magoosh Inc., that means giving machines license to recommend responses to simple customer service queries, while still maintaining a team of agents who handle more complicated issues. Magoosh uses a customer service bot from DigitalGenius to handle incoming customer service inquiries. The system scans messages for their content and recommends prewritten responses that can be personalized or sent out as is.


The product design challenges of AR on smartphones

So there’s a very real and difficult problem in getting a user to get their phone out while they are in the best place to use your app. Notifications could come via traditional push messages, or the user might think to use the app by seeing something in the real world that they want more information on, and they already know your app can help with this. Otherwise, your app just needs to work anywhere, either through using unstructured content, or being able to tap into content that is very, very common. This problem is the No. 1 challenge for all the “AR graffiti” type apps that let people drop notes for others to find. It’s almost impossible for users to be aware that there’s content to find. FYI —  this is just another version of the same problem that all the “beacon” hardware companies have, getting the shopper to pull out their phone to discover beneficial content.



Quote for the day:


"As long as you are fighting for what is right instead of who is right, you can never lose!" -- @Rory_Vaden


Daily Tech Digest - July 16, 2017

Getting Started With Apache Ignite

Although often associated with relational database systems, it is now used far more widely with many non-relational database systems also supports SQL to varying degrees. Furthermore, there is a huge market for a wide range of SQL-based tools that can provide visualization, reports, and business intelligence. These use standards such as ODBC and JDBC to connect to data sources. ... The latest releases of the Apache Ignite project provide support for Data Manipulation Language (DML) commands, such as INSERT, UPDATE, and DELETE. Additionally, some Data Definition Language (DDL) support has also been added. Furthermore, index support is also available and data can be queried both in RAM and on disk. A database in Apache Ignite is horizontally scalable and fault-tolerant, and the SQL is ANSI-99 compliant. Figure 1 shows the high-level architecture and vision.


How a new wave of machine learning will impact today’s enterprise

Advances in deep learning and other machine learning algorithms are currently causing a tectonic shift in the technology landscape. Technology behemoths like Google, Microsoft, Amazon, Facebook and Salesforce are engaged in an artificial intelligence (AI) arms race, gobbling up machine learning talent and startups at an alarming pace. They are building AI technology war chests in an effort to develop an insurmountable competitive advantage. Today, you can watch a 30-minute deep learning tutorial online, spin up a 10-node cluster over the weekend to experiment, and shut it down on Monday when you’re done – all for the cost of a few hundred bucks. Betting big on an AI future, cloud providers are investing resources to simplify and promote machine learning to win new cloud customers. This has led to an unprecedented level of accessibility that is breeding grassroots innovation in AI.


Under the hood of machine learning

The key design point that allows Apache Mesos to scale is its two-level scheduler architecture. Unlike a monolithic scheduler that schedules every task or virtual machine, the two-level scheduler delegates actual tasks to the frameworks. The first-level scheduling allows Mesos Master to decide which framework gets the resources based on allocation policy. The second-level scheduling happens at the framework level, which decides which tasks to execute. This enables data services to run without resource contention with the other data services in the cluster, improving framework scheduling regardless of scale. It also allows the Mesos Master to be a lightweight piece of code that is easy to scale as the size of the cluster grows. Working with Apache Mesos, though, can be challenging in terms of building the framework and components.


5 Common Challenges to Building BI in the Cloud

Building successful Business Intelligence solutions is a well-documented process with many successful, and unsuccessful projects to learn from. The traditional BI/DW model has always been challenging, but a lot of good practices and patterns have emerged over the years that BI professionals can leverage. A net-new BI solution or migration of an existing on-prem BI solution into the cloud creates a different set of challenges to be addressed. What I wanted to do was to try to come up with a top 5 list that may help you in considerations for your cloud BI project planning. I've been focused on building analytics, BI and Big Data solutions in the cloud in Azure for the past 2 years, so I'm going to share a few of my findings for you here.


Blockchain The Chain of Trust and its Potential to Transform Insurance Industry

In the longer term, the potential disruption to the insurance industry from blockchain technology is staggering. Blockchain technologies will enable the creation of assets in a new, distributed form — such as documents, credentials, assessments and transactions— that span the entire insurance value chain. These distributed assets will challenge the traditional insurance business model. IBM is helping Insurers across the globe to determine what use cases are best suited for blockchain, and how to make it easier to innovate on top this middleware fabric. During our discussions, it has come out clearly that a majority of the Insurance CIO’s are keen to understand how they can potentially leverage Blockchain to overcome the challenges they are facing today in the Insurance Industry.


What’s your risk appetite? Your robo-adviser has the answer

The wealth management industry has been transitioning its focus on mere product sales to higher value-added service-based offerings over the past few years, a result of the segmentation of different products and their underlying volatility based on financial advisers’ feedback of what investors want, according to Barry Freeman. He said Xuanji, a robo-adviser platform launched by Pintec last year, was able to make suggestions on asset allocation in a full portfolio of mutual funds based on investment target and risk tolerance levels derived from a set of questions answered by the investors, powered by big data, quantitative modelling and machine learning. As the robo-advisory platform owns data of 80 per cent of mutual funds in China through partnership with all the fund houses, algorithms based on the data and performances of different funds will be able to segment different opportunities, making it a better performer compared with a human stock broker, Freeman said.


Bitcoin Crashes as Chain-Split Risks Increase

We tried to speak to Jeff Garzik, the lead maintainer of the new segwit2x client, to gain some clarity on the relationship between segwit2x and Bitcoin Core, but have received no response at the time of writing. Segwit2x implements segwit largely unchanged, but there are suggestions after the activation the client may only accept segwit blocks, while Bitcoin Core would accept both segwit and non-segwit blocks, which may lead to a split. However, as some 90% of miners seem to be supporting segwit2x, it appears unlikely any miner would produce non-segwit blocks, so they would probably remain in consensus. On the bigger blocks side, there is Bitcoin Unlimited and BitcoinABC, which largely follows the approach of Bitcoin Unlimited but goes further in implementing a User Activated Hard-Fork that will chain-split regardless of miners support.


A pervasive security solution that makes practical sense

First, the SDSN platform’s automated threat remediation capability enforces security all the way down to the network layer, including end clients or data centers populated with switches and wi-fi access points from different vendors. With the SDSN platform, you can still quarantine or block infected hosts in a multivendor environment, without swapping out your existing infrastructure. Imagine not having to write off the thousands or even millions of dollars in equipment investments while taking your security game to the next level. ... The decision to migrate workloads to clouds, or determining what applications run on which cloud, should not break your network’s security posture. SDSN goes one step further, not only enforcing consistent policies in all the deployments but also interoperating with native cloud technologies to maintain the same level of enforcement granularity available in physical networks.


5 Steps to Migrate Unisys Mainframes to AWS

The most effective method to exploit the value of Unisys mainframe applications and data is a transformative migration to modern systems frameworks in AWS, reusing as much of the original application source as possible. A least-change approach like this reduces project cost and risk (compared to rewrites or package replacements) and reaps the benefits of integration with new technologies to exploit new markets — all while leveraging a 20- or 30-year investment. The best part is that once migrated, the application will resemble its old self enough for existing staff to maintain its modern incarnation; they have years of valuable knowledge they can also reuse and pass on to new developers. The problem is most Unisys shops, having been mainframe focused for a very long time, don’t know where to start or how to begin. But don’t let that stop you. The rest of this article will give you some guidance.


Understanding the Basics of Biometrics

There is no one-size solution for the optimal biometric modality, however. Each has a specific set of strengths and weaknesses that must be considered when planning a system, based on the requirements and the application context. Certain deployments may even require multiple biometric modalities (commonly referred to as multimodal biometrics), often with fusion of the results, to ensure the highest levels of accuracy and protection. In addition to considering budget and performance, other factors in selecting the right biometric modalities include accuracy, risk of error, user acceptance, and hygiene. For example, DNA is among the most accurate biometric modalities if the sample isn’t degraded, but the option demands proximity to the person or actual DNA sample to touch and collect it—a requirement that isn’t possible in every scenario.



Quote for the day:


"Great leaders go forward without stopping, remain firm without tiring and remain enthusiastic while growing" -- Reed Markham


Daily Tech Digest - July 15, 2017

Grooming effective remote developers in the world of DevOps

"You really have to double down on being good at communication and being clear and building relationships and trust with people," Copeland said in an interview. "Because if you don't trust somebody they're going to think you're a talking head." Copeland noted that a base level of technology is required for remote developers to be effective. A chat system is required, he said, as well as a video conferencing system that supports multiple users and a good microphone for each user. Regarding synchronous communication, Copeland said, "I hope that we have holographic telepresence someday," but until then seeing each other on screens will have to do. Often, remote developers like Copeland are among an organization's top development assets.


Enterprise Software Fuels IT Spending As CIOs Become Builders Again

Gartner's predictions for 2017 IT spending have gone up and down over the last few quarters, but most of the tweaks to its forecasts were due to fluctuations in the value of the dollar. (In constant currency terms, Gartner predicts IT spending growth this year to be 3.3 percent.) Those fluctuations are not altering the fundamental trends in IT spending: As users hang on to their mobile phones for two, three or even four years, rather than refreshing them every year or so, the big driver for IT growth will be the digital transformation of businesses. Digital business trends include the use of IoT infrastructure in manufacturing and blockchain technology in financial services and other industries, as well as "smart machines" in retail, Lovelock said.


Physical Security Is Critical For Protecting Your Data

A good example of how this matters is the theft of physical devices. If someone can break through physical security then they can steal a server. Even if the data on that server is encrypted, once a thief has physical access to a device, they can take their time to break the encryption or work around it to access data. Once we start thinking about hacking physical security, we move quickly into the realm of IoT. Vizza says hacking these devices is relatively easy. "A lot of IoT devices have been, historically, set up on a completely different architecture. Unlike the seven-layer OSI model, the IoT is set up on a four-layer model and security was an afterthought at best. A lot of the original PLCs and other devices have security bolted on, if it's done at all".


Here's the brutal reality of online hate

Online abuse is as old as the internet. Being anonymous encourages people to say things they'd never say in public and push the boundaries of accepted behavior because they feel they won't be held accountable. Distance adds to the problem. It's a lot harder to pull out all the stops when you're looking someone in the eye. On the internet, you don't see your target or the emotional devastation you leave behind. Racial minorities often get the brunt of the abuse online. Black Lives Matter activists, including DeRay McKesson, have been harassed in tweets, emails and posts. And there's enough hatred out there to ensure feminists, Jews, Muslims and the LGBTQ community are constant targets. The internet amplifies the effect, organizing the haters into packs of digital attack dogs.


IoT: What You Need to Know About Risk and Responsibility

The Internet of Things (or, IoT) is a blanket term used to describe all of the technology that is being deployed in homes and businesses. That is, technology that isn’t normally considered part of traditional IT infrastructure -- things your IT staff already manage, like computers, mobile devices, network equipment, etc. These new devices connect to the public Internet and communicate in ways that make them “smarter”. They include security cameras, climate control, inventory logistics, power meters, and even “smart beds” in hospitals. While the improvements in efficiency and cost savings that IoT devices can bring to a business cannot be ignored, it’s important to understand the risks associated with “smart” devices.


Which Spark machine learning API should you use?

Consider if a car manufacturer replaces the seat in a car and surveys customers on how comfortable it is. At one end the shorter customers may say the seat is much more comfortable. At the other end, taller customers will say it is really uncomfortable to the point that they wouldn’t buy the car and the people in the middle balance out the difference. On average the new seat might be slightly more comfortable but if no one over 6 feet tall buys the car anymore, we’ve failed somehow. Spark’s hypothesis testing allows you to do a Pearson chi-squared or a Kolmogorov–Smirnov test to see how well something “fits” or whether the distribution of values is “normal.” This can be used most anywhere we have two series of data.


Why mobile hardware security is fundamentally broken

Recent exploits show that our devices are not as secure as we are led to believe. For instance, hacker Jan Krissler published a high-profile hack of Samsung’s Galaxy S8 iris scanning feature, using a consumer grade camera and contact lenses. In Singapore, ethical hackers from the Whitehat Society at the Singapore Management University (SMU) showed that it was possible to take over a user’s device using only their phone number, and then use the device’s camera and audio equipment to spy on the user. Even the smartcard chip, which provides tamper-proof security for phones and cumbersome hardware tokens, offers practically no protection against misuse. Smartcard chips don’t authenticate the user, and are unable to decipher the intent of the person using it, be it for the owner or a person with malicious goals.


Beyond user interface testing: Here's what you need to know

The most common way to look beyond user interface testing is by examining and verifying database values. Software applications update data constantly. Changes in the UI can trigger ongoing or multiple database value updates, kick off triggers and be managed through indexes, just to name a few possibilities. Tracking and verifying data value changes triggered from UI actions provides valuable testing data. For example, many QA testers use SQL to create a repository of tests for verifying database values and then execute them before user interface testing. Defects not visible in the UI can frequently be evident in the database, and testing within the database can find defects before user interface testing occurs.


A View from the Trenches: the C-Suite’s Role in Organizational Transformation

Transformations in tech-focused companies impact not just the development team, but the entire organization. Transformations represent a fundamental shift in how an organization as a whole thinks, acts, and produces. They are collaborative, self-organizing, open, and efficient, but changing the way an entire organization operates - from the way teams are organized to how they interact with clients - takes time and a willingness to trudge through the initial discomfort and uncertainty of change. Recent data from the State of Agile survey shows that three of the top four reasons why Agile projects fail fall under the category of culture. Culture at "odds with agile values" accounted for 46% of answers, while both "lack of management support" and "lack of support for cultural transition" accounted for 38% of answers each.


A.I. innovation finds a home on mobile devices

Innovative mobile apps married to increasingly powerful artificial intelligence (A.I.) are rapidly getting smarter -- making them even more helpful for users. These kinds of apps, showcased at VentureBeat's two-day MobileBeat conference here this week, are designed to anticipate user needs. Who knew, for example, that you can use your smartphone to simplify the process of getting a green card to enter the United States or to streamline corporate travel? During a "Startup Showcase" session, Visabot showcased its appropriately-named Green Card app. The program is based on a bot that walks users through a series of simple questions that, when answered, generates a package of documents you can file with U.S. Citizenship and Immigration Services to complete the application process.



Quote for the day:


"Never be ashamed of your past. It’s all part of what made you the amazing person you are today." --Yehuda Berg


Daily Tech Digest - July 02, 2017

What makes identity-driven security the new age firewall

Using a proprietary algorithm, Microsoft Advanced Threat Analytics works round the clock, continually grasping behaviour of organizational entities, such as users, devices, and resources, and helps customers adapt to the changing nature of cybersecurity attacks. In addition to this, the technology enhances threat and anomaly detection with the Microsoft Intelligent Security Graph, which is propelled by enormous amounts of datasets and machine learning in the cloud. “Identity is the new firewall. If you are taking a traditional end point/device protection approach then you are short changing your organization goals. It is critical to understand that the perimeter of IT includes users, apps across cloud and on premise, and most importantly data. Identity is what can help secure this perimeter,” says Rajiv Sodhi


Enabling IoT Ecosystems through Platform Interoperability

To enable interoperability for IoT platforms on the cloud, fog, or device level, the BIG IoT API offers a well-defined set of functionalities. Seven functionalities are crucial. The first is identity management to enable resource registration. The second is discovery of resources according to user-defined search criteria. The third is access to metadata and data (data pull as well as publish-and-subscribe for datastreams). The fourth is tasking to forward commands to things. The fifth is vocabulary management for semantic descriptions of concepts. The sixth is security management, including authentication, authorization, and key management. The seventh is charging that allows the monetization of assets through billing and payment mechanisms.


Artificial Neural Networks (ANN) Introduction

We recognize images and objects instantly, even if these images are presented in a form that is different from what we have seen before. We do this with the 80 billion neurons in our brain working together to transmit information. This remarkable system of neurons is also the inspiration behind a widely-used machine learning technique called Artificial Neural Networks (ANN). Some computers using this technique have even out-performed humans in recognizing images. ... An ANN model is trained by giving it examples of 10,000 handwritten digits, together with the correct digits they represent. This allows the ANN model to understand how the handwriting translates into actual digits. After the ANN model is trained, we can test how well the model performs by giving it 1,000 new handwritten digits without the correct answer.


Alibaba: Building a retail ecosystem on data science, machine learning, and cloud

The war in retail has long ago gone technological. Amazon is the poster child of this transition, paving the way first by taking its business online, then embracing the cloud and offering ever more advanced services for compute and storage to thirrd parties via Amazon Web Services (AWS). Amazon may be the undisputed leader both in terms of its market share in retail and its cloud offering, but that does not mean the competition just sits around watching. Alibaba, which some see as a Chinese counterpart of Amazon, is inspired by Amazon's success. However, its strategy both in retail and in cloud is diversified, with the two converging on one focal point: data science and machine learning (ML).


The Future is Imminent: 9 Design Trends for 2018

For those uneducated graphic designers in the audience, the term synesthesia refers to the perceptual condition of mixed sensation; a stimulus in one sensory modality (like hearing) involuntarily elicits a sensation or experience in another sensory modality (like smell). A person with synesthesia might hear a bird chirping and all of a sudden smell the scent of popcorn, or taste the flavor of mint, or feel the sensation of floating. ... A progress spectrum is a far more natural way of measuring “progress.” Instead of breaking up the user experience into unnatural, linear, paginated steps, a progress spectrum reflects the true experience of the user, one in which progress is experienced along a broad and continuous spectrum, where one event seamlessly flows into the next.


The Cyber-frauds

A mobile wallet works like an electronic prepaid card and can be used to pay for things ranging from grocery to rail tickets without the need to swipe the debit/credit card. All you have to do is to key in the username and password for logging in. The app can be loaded with money either through debit/credit card or net banking. The flip side is that these wallets mostly rely on the phone's locking system for security and don't ask for any PIN or password while the payment is being made. ... Rahul Gochhwal, co-founder of Trupay, says, "The biggest security issue is lack of second factor of authentication (password) while transacting. This makes them vulnerable to system-level breaches as transactions can be system generated by a hacker without a password. Thus, technically, a hacker can make thousands of fraudulent transactions simultaneously."


What every CIO Needs to Know About Cyber Resilience

Bohmayr & Türk, from the Boston Consulting Group, write that “cyber-resilience in an organization must extend beyond the technical IT domain to the domains of people, culture and processes. A company’s protective strategies and practices should apply to everything the company does — to every process on every level, across departments, units and borders, in order to foster an appropriately security-conscious culture.” ... The issue of board responsibility and oversight of cyber risks isn’t new. In 2015, the Cybersecurity Disclosure Act of 2015 bill was introduced in the US Senate. The bill would have required “public companies to disclose whether any board member has experience or expertise in cybersecurity, and to describe the nature of that background” and should no board director have cybersecurity expertise, to justify why such expertise was unnecessary.


Security in a silo – breaking down the barrier between CISOs & C-Suite

If you’ve been in the security industry for any length of time, and as a CISO I assume you have been, you’ve probably already seen and read such articles… but if you are still reading this, it probably means that you don’t feel like this is yet a reality within your organisation. So, with the shared understanding that we are both in agreement that this shift is past due, we can start to talk about building your strategy to make it happen. Before doing so, however, we need to acknowledge a sobering truth: People don’t care about security for the sake of security alone. What they care about is the result that a sound security strategy can provide and the impacts/risks associated with the lack of a sound security strategy. We’ll use this understanding to inform the methods that we use to engage the organisation and our board.


The Hard-Dollar Benefits of GRC Consolidation

The intention of implementing a single platform architecture must come from an IT vision for rationalizing applications in use across the company. Instead of supporting potentially hundreds of applications that each do only one thing, the GRC infrastructure, in time, should comprise one cohesive platform that supports many functions. GRC applications tend to span activities and departments within organizations. Groups across the company often independently manage activities such as risk assessments, audits, controls testing and third-party assessments. To do this, they make use of many individual solutions – some of which do the same thing, just in different organizational silos. For secure business management, this colossal set of single-use applications has to be visible, managed, supported and maintained. This is something that is both costly and time inefficient.


The Computest Story: The Transformation to an Agile Enterprise

Inspired by Henrik Kniberg & Anders Ivarsson's famous article on how Spotify scaled their development organization we decided to put multidisciplinary teams in the center, supported by a group of people outside the teams focusing on coaching and fulfilling company-wide responsibilities. As Figure 2 indicates, the major difference in the first transformation step was to integrate as many central functions in interdisciplinary teams as possible, to structure them by industries and to differentiate the leadership group in 'captains' and 'coaches'. Whereas the captains took over social leadership for the teams as well as responsibility for resource and account management, the coaches formed a group of thought leaders with a broad variety of subject matter expertise, responsible for both policies and solutions.



Quote for the day:


"Thinking is the hardest work there is, which is probably the reason so few engage in it." -- Henry Ford


Daily Tech Digest - June 29, 2017

On-premise or In the cloud? Most suitable location for apps in a hybrid environment

If the application, or the data it processes, is subject to regulatory oversight under compliance regimes such as HIPAA or PCI, then there is a clear need to understand the security compliance status of that application, and if moving it to the cloud will risk a compliance violation. For example, HIPAA requires accountability practices on all Local Area Networks, Wide Area Networks, and for users accessing the network remotely through a Virtual Private Network (VPN). If the application needs to be compliant with PCI, you will need to have a firewall at each Internet connection the application uses, and between any network demilitarised zone and the internal network zone. Applications under this regulation, and others, are not ideal candidates for migration to the cloud.


Building AI: 3 theorems you need to know

Combined with the no-free-lunch-theorem, we realize this is the only way to create an effective learner: change its inductive biases so it can become effective for something else, namely, our data. Inductive biases also have to do with the problem of overfitting. In machine learning, overfitting occurs when your model performs well on training data, but the performance becomes horrible when switched to test data. Overfitting happens when you apply incorrect inductive biases in a model. If the equations of the model truly reflect the data (for example, a linear model applied to data generated by a linear process), then any fit will be a correct fit for test data. In a way, the model – in its very architecture – contains knowledge about the data. Such a model can learn very fast; with only a few data points, it can begin generating accurate predictions.


This Cell Phone Can Make Calls Even Without A Battery

There is still a long way to go before that happens. The phone has a basic touch-sensitive number pad and its only display is a tiny red LED that glows briefly when a key is pressed. A large touchscreen would require around 400 milliwatts—over one hundred thousand times as much as power as Talla's phone currently needs. Most importantly, voice calls are still awkward. You have to press a button, walky-talky style, to switch between listening and talking, and sustaining a conversation through clouds of static is near impossible. Talla promises better call quality and an E-Ink display for text messages on the next generation device, possibly along with a camera to snap selfies. Smith says that even as the prototype stands, built from off-the-shelf components, it is much cheaper than a normal phone.


The Internet of Things is Revolutionizing Tracking and Receiving Packages

In a perfect world, pressing a button in your bathroom when you are out of toilet paper only to have a drone drop it on your doorstep hours later is the height of convenience. You don't even have to make a shopping list or tie a string around your finger in order to remember this often-forgotten necessity. But when you have to worry about someone driving by and seeing the toilet paper on your doorstep, realizing they are also out of toilet paper, and taking it for themselves, this stops being a convenience and instead becomes another burden of daily life. Going to the store on your way home is certainly preferable. The Internet of Things has come up with a number of solutions to stolen packages. So far the doorbell camera seems to be one of the most popular choices, followed by sitting at home waiting for your package to arrive.


Rise of the Machines

Move over R2D2 – robots are no longer just the stuff of sci-fi. They’re already here, and whether it’s through advancing drug design or charting the oceans, UK technology is transforming the impact that robots are having on our lives. At STFC, we’re helping to develop robots that can combat world hunger and explore the universe. Our research is driving forward the field and bushing the boundaries of what robots can do. Meanwhile, a whole variety of other UK-funded research is developing robots for use in medicine, disaster relief, deep sea exploration and so much more. Robots are helping us to achieve incredible things, and they’re changing the world around us in ways that nobody – not even George Lucas himself – could have predicted.


Can Design Thinking Unleash Organizational Innovation?

Design thinking’s ability to uncover customers’ unarticulated needs and its processes for testing potential success with small inexpensive experiments provided the framework they needed. The team ultimately focused on three core design principles: “customer empathy,” “go broad before narrow” and “rapid experimentation.” I love the phrase: “Uncover customers’ unarticulated needs.” The heart to any organization looking to become more innovative and creative in their thinking is to “uncover customers’ unarticulated needs.” It is likely the biggest operationalization challenge when it comes to integrating data science into an organization’s business models; to help organizations to become more effective at leveraging data and analytics to uncover their customers’ unarticulated needs.


Microsoft Cognitive Services brings cloud AI to the enterprise

The learning curve for Microsoft Cognitive Services is minimal for developers already familiar with building cloud applications, and those who are unfamiliar can integrate Cognitive Services with Azure Logic Apps with minimal coding. Still, these services aren't without their challenges. For example, it can be difficult to connect cloud-based applications with internal data sources, whether they reside on central databases or are distributed across remote systems and sensors. Implement a hybrid network and data integration strategy before you deploy production AI applications. Developers should also use Microsoft's free service tier to become familiar with the AI services, APIs and SDKs and to build and test applications.


‘Separating IT and cyber security: A necessity not a nice to do’

Cyber security and IT responsibilities must be separated in order to provide adequate checks and balances and ensure that existing cybersecurity measures are effective in protecting the business against a variety of malware and ransomware. In most organisations, IT departments are responsible for configuring and maintaining on-premises network infrastructures and cloud based systems, so they cannot also be responsible for verifying the security of these networks. This situation would be akin to asking a payroll professional to audit their own entries – in short, it’s simply not appropriate. When a business reaches a certain size, it will almost certainly engage with two separate accountancy firms, one to file its taxes, and another to complete its annual audit. The two very rarely interact, and it is unlikely that businesses would entrust the same firm with both responsibilities.


Security in a cloud-native environment

If you are architecting a cloud solution that can scale to support large volume, can run across different data center instances, and can be provisioned semi or fully automatically, you need to consider security as one of the core building blocks of your architecture. Cloud-native microservices are growing in numbers exponentially, and the rise of IoT is making ways to create more and more interfaces and service endpoints—this makes it more critical to secure application endpoints based on role-based authentication. Every incoming request knows the caller and its role with respect to the called application endpoint. These roles essentially determine if the calling client has enough privileges to perform the requested operation on the called application.


Life As An IT Contractor

Jerry McKune, an independent IT contractor based in the St. Louis area, said he appreciates the variability of IT contracting and the opportunity to keep learning new skills. “I love variety. I cannot stand to do the same thing over and over and over again. There’s a lot of variety in the contract world.” The challenge of variety, however, is that each new assignment means a new learning curve. “Education takes time,” McKune said. “If you’re on a six-month contract, and there’s a four- to five-month learning curve, there’s only going to be a short period of time at the end of it where you really know what you’re doing and you’re capable of performing the tasks assigned to you without help from somebody else.” Learning to rely on other people and not being afraid to say you don’t know something are essential traits.



Quote for the day:


"The only person you should try to be better than, is the person you were yesterday." -- Tim Fargo


Daily Tech Digest - May 05, 2017

Backdoors: When Good Intentions Go Bad

If technology can hide communications, can't technology be used in a legal and safe way to reveal critical information when people's lives are at stake? Unfortunately, the answer is that these requests for access to encrypted information creates "backdoors" that can make all citizens vulnerable to attack. A backdoor in security is a way for an entity (like the government) to access encrypted information. Protecting data using encryption involves creating an encryption key, which is the equivalent of the key to the lock on the front door of one's house. The idea of a backdoor is to provide another key so that law enforcement can enter the house if necessary. Just as the backdoor to the house will open for anyone – friend or foe – with the correct key, an encryption backdoor can make users' information accessible for both good and bad purposes.


How YouTube plans to dominate your living room

YouTube is making a bigger push and investment in the living room because it believes it can improve on-demand services, make TV more personalized and include social components that are typically missing from other providers. “The idea there is we combine the best of cable and broadcast television with YouTube,” Mohan said. “We think there’s great content out there, but we wanted to build a television experience that was truly built for this century.” YouTube's foray into the living room is also boosted by what Mohan and many others are calling “the golden age” of video content. Massive investments are being made to produce videos across multiple platforms and the choices available to viewers has grown profoundly from the three major networks that dominated television as recently as three decades ago.


Third parties leave your network open to attacks

Markus Jakobsson, chief scientist at Agari, said the one big disadvantage to working with third-party vendors is the loss of control over security. "Not only does each vendor create a new entry point into an organization’s network for cyber criminals to exploit, but it also means every employee for that vendor is now a potential target to breach your brand. ... But in today’s digital world, this isn’t a reality." Mike McKee, CEO of ObserveIT, said the lack of visibility into what users at third-party providers are doing – accidentally or intentionally – is a huge security risk. “Every organization must ensure it has identified the outside parties with access to systems and data and have secure procedures in place, strict policies for these users to follow, and effective technology in place to monitor and detect if the third parties are putting their organization at risk," he said.


Why emotional intelligence is key for project success

"Unlike IQ, EQ can evolve and can scale depending on stressors, or even positive emotional states. So it's important someone understands their emotional intelligence so they can counteract whatever might sabotage not only their progress but their teams", said Caroline Stokes, founder of Forward, a team of senior search headhunters and certified executive coaches for global innovation leaders. At Forward, emotional intelligence quotient assessments, like EQ-i 2.0, are used with talent placements and leadership and career development coaches. "We get to work on their EQ within a few weeks of starting their new role to provide awareness and strategies to drive their goals forward," said Stokes. When it comes to the process of merging two companies during an acquisition, EQ can play a vital role.


Lib Dems decry surveillance plans exposed in leaked documents

The regulations state that companies could be forced to ‘modify’ their products in order to comply with government demands, the Open Rights Group points out, adding that the powers would also limit the ability of companies to develop stronger security and encryption. Although TCNs may be challenged on technical grounds and must be approved by Judicial Commissioners, the Open Rights Group said the criteria for making a sound judgement of risk to all parties are not set out in the Act or the draft regulations, and there is there a clear route of appeal. Liberal Democrat president Sal Brinton described the proposed regulations as “a full-frontal assault” on civil liberties and people’s privacy. “This lays bare the extreme mass surveillance this Conservative government is planning after the election.


Manage colocation costs to avoid billing surprises

The colocation market continues to grow, as organizations look to meet their growing needs for compute outside of their own on-premises data centers. An expansive marketplace of providers offers a plethora of colocation services, but a strong service-level agreement between providers and users -- and understanding colocation costs -- requires more than just a handshake. IT admins who oversee the transfer of systems and workloads from inside an organization to a colocation facility have a lot of moving parts to deal with. Security, service-language agreement (SLA) jargon and, of course, budget concerns can all be a major headache. Before making the move to colocation, consult with the business side to make sure it's a good financial decision. After the move, be sure to carefully monitor, manage and optimize colocation costs.


Google Docs Phishing Scam a Game Changer

The attack tricked victims into clicking a link that gave attackers access to their Google Drive through OAuth authentication connections commonly used by third-party applications. The attackers did so by sending victims lure messages claiming to contain links to a shared Google Doc. Instead of a legit document, the link actually initiates a process to give a phony app masquerading as "Google Docs" access to the user's Google account. If the user is already logged into Google, the connection routes that app into an OAuth permissions page asking the user to "Allow" access to the user's legitimate Google Drive. "You aren't giving your Google credentials directly to the attacker. Rather, OAuth gives the attacker permissions to act on behalf of your account. You're on the real Google permissions page. OAuth is a legitimate way to give third-party applications access to your account.


Don't fear the robots, embrace the potential

“Automation is creating a polar shift in how work gets done,” says ISG partner Craig Nelson. “While in the past humans have been supported by technology, we are now seeing a shift to technology being supported by humans to manage and operate business processes. This shift is eliminating much of the mundane cut-paste-and-compare work that humans manage in the cracks between enterprise systems.” The initial response to automation improvements is typically positive, says Nelson, as the technology takes over some of the dirty work employees are eager to offload. But then the anxiety can set in. The elimination of tasks can lead to the elimination of low-level roles, says Nelson. After all, the initial business case for automation was based on eliminating work and full-time employees.


Microsoft’s novel approach to securing IoT

Project Sopris has a sensibly secure IoT stack. It starts with a hardware root of trust, similar to the one developed by the Trusted Computing Group for its Trusted Platform Module. A separate, secured computing environment, this layer creates and manages the keys needed to cryptographically secure connections between devices and servers. It also stores and manages device firmware and software. Building software for Project Sopris devices is much like building code anywhere: What’s important is how the code is stored and managed. Compartmentalizing code so that a failure in one section doesn’t compromise the rest of your software helps prevent exploits from escalating, while building security tools in every layer can reduce the risk of attacks spreading throughout the device stack.


Surface Laptop: Everything you need to know

Microsoft is aiming the Surface Laptop at style-conscious, MacBook-Air-loving college students, though many non-student users are clearly intrigued by it. The Surface Laptop’s clamshell design adds another form factor to Microsoft’s premium line of Surface products, all of which boast beautiful displays and unique features. The Surface Book is the most expensive of the family: a premium 2-in-1 laptop with a striking Dynamic Fulcrum Hinge. The keyboard base is stuffed with extra battery and, in some configurations, a discrete GPU. The Surface Pro 4 is a 2-in-1 that leans more toward a tablet, with a kickstand and the option of a lightweight keyboard. Given the Surface Laptop’s pricing, the Surface Pro 4 is now the lowest-cost product in the family.



Quote for the day:


"You move totally away from reality when you believe that there is a legitimate reason to suffer." --
Byron Katie