December 12, 2023

The SEC action against SolarWinds highlights how tough it can get for CISOs

The SEC has accused Brown of misleading investors by not disclosing "known risks" and not accurately representing the company’s cybersecurity measures during and before the 2020 Sunburst cyberattack that affected thousands of customers in government agencies and companies globally. ... The claimed failures, including not abiding by the statements that the company made on its website regarding their patterns and practices for developing their software as well as password policies internal to the company. The SEC complains in its filings that the company did not disclose cybersecurity risks independently from other risks, given SolarWinds' role and industry, nor pay extra risk attention to targeted attacks and the disclosure needs surrounding them. ... The SEC also indicated that SolarWinds did not limit administrative access to those who needed access. Too often in developer networks administrative rights are used too widely and not limited. Internal staff expressed concerns that user access would lead to losses of organizational assets and personal data.

Deriving Actionable Insights and ROI from AI

To increase the ROI of AI, large language models (LLMs) must ingest clean and high-quality data for accurate, meaningful insights. This is only possible by investing in data discovery and data classification solutions and processes. Organizations will also face growing AI-related security challenges in 2024. This will lead them to set up guardrails that protect corporate and customer data. Businesses must also consider that company-specific or proprietary data ingested by LLMs could put organizations at risk if company financials or other private information are replicated to a public AI engine and exposed. ... There are many opportunities for businesses to benefit from AI; however, there also needs to be a rapid evolution of data classification and data life cycle management before businesses will be able to derive the value they expect from AI. This is especially important if companies are trying to justify ROI from their AI investment. Sustainability took a back seat during the pandemic and long after the worst of it passed, as organizations made major adjustments to operations and tried to find their new (or old) normal.

Startup Oxide Computer puts the ‘cloud’ back in on-prem private clouds

Oxide's main mission is to put the "cloud" back in private cloud computing. The company is built on the premise that you should be able to choose to rent or own cloud capacity, depending on the workload, not losing the benefits of cloud computing like elasticity when you choose the latter. To accomplish this, the Oxide team set out to build an entirely new cloud hardware rack that would deliver all of the advantages public cloud vendors enjoy, without sacrificing on control, efficiency, and flexibility. Another issue that limits private clouds is that many enterprises attempt to build their private clouds on Kubernetes. The problem is that Kubernetes was not designed for multitenancy, and, thus, it does not offer a true cloud experience. That's not a knock on Kubernetes, but the container orchestration software is typically deployed on top of bloated layers of software, adding complexity and making it difficult to manage at scale. ... According to Oxide, this design allows enterprises to be fully deployed within a few hours of unboxing the system, versus what typically takes weeks or months using the "kit car" build of OEM hardware.

There is a possibility that artificial intelligence will become conscious

We’re in a truly important phase of change due to the impact of artificial intelligence. In fact, I believe people have been quite amazed at how good it is. Even industry professionals have been quite surprised at how powerful it is. But it comes with dangers, and I think that’s the important point I talked about a few years ago and still find very important today; you really need to understand how this works to use it effectively, because you still have to understand that it works statistically, in the sense that it understands what the most probable words are to follow the paragraphs it has already seen. ... I think we will have to ask the question of whether we are developing a new species, whether this is an evolution of what we are doing, or whether we are going to have to consider a new hybrid species, which is probably the perspective of integrating artificial intelligence into our own species. Elon Musk is considering the idea with Neuralink. His response to the existential threat of artificial intelligence is that no, we must become it, we must integrate artificial intelligence and humans, which will generate new philosophical, social, and legal dilemmas in the future.

Quantum-Computing Approach Uses Single Molecules As Qubits For First Time

Some of the first demonstrations of the basic principles of quantum computing, in the late 1990s, used large numbers of molecules manipulated in a solution inside a nuclear magnetic resonance machine. Since then, researchers have developed a variety of other platforms for quantum computing, including superconducting circuits and individual ions held in a vacuum. Each of these objects is used as the fundamental unit of quantum information, or qubit?—?the quantum equivalent of the bits in classical computers. In the past few years, another strong contender has emerged, in which the qubits are made of neutral atoms?—?as opposed to ions?—?trapped with highly focused laser-beam ‘tweezers’. Now, two separate teams have made early progress towards using this approach with molecules instead of atoms. “Molecules have a bit more complexity, which means they offer new ways to both encode quantum information, and also new ways in which they can interact,” says Lawrence Cheuk

DevOps and Automation

Continuous Integration (CI) and Continuous Deployment (CD) are critical components of DevOps software development. CI is the practice of automating the integration of code changes from multiple contributors into a single software project. It is typically implemented in such a way that it triggers an automated build with testing, with the goals of quickly detecting and fixing bugs, improving software quality, and reducing release time. After the build stage, CD extends CI by automatically deploying all code changes to a testing and/or production environment. This means that, in addition to automated testing, the release process is also automated, allowing for a more efficient and streamlined path to delivering new features and updates to users. Docker and Kubernetes are frequently used to improve efficiency and consistency in CI/CD workflows. The code is first built into a Docker container, which is then pushed to a registry in the CI stage. During the CD stage, Kubernetes retrieves the Docker container from the registry and deploys it to the appropriate environment, whether testing, staging, or production.?

Read more here ...