• Search for:
    27Feb, 2023
    How to Use AI in Cybersecurity and Avoid Being Trapped

    The use of AI in cybersecurity is growing rapidly and is having a significant impact on threat detection, incident response, fraud detection, and vulnerability management. According to a report by Juniper Research, the use of AI for fraud detection and prevention is expected to save businesses $11 billion annually by 2023. But how to integrate AI into business cybersecurity infrastructure without being exposed to hackers?

    In terms of detecting and responding to security threats in a more efficient and effective manner, AI has been helping businesses in lots of ways.

    • Firstly, it can analyze large amounts of data and identify patterns or anomalies much faster and with greater accuracy than humans. AI detects and responds to security threats in real-time, reducing the time it takes to identify and remediate security incidents.
    • The algorithms can learn from past incidents and adapt to new threats as they emerge. With it, cybersecurity systems can become smarter and more effective over time, reducing the risk of future security incidents.
    • In addition to that, AI can automate many of the repetitive and time-consuming tasks associated with cybersecurity, such as threat monitoring and incident response. It frees up cybersecurity professionals to focus on more complex tasks that require human expertise, such as threat analysis and risk assessment.
    • AI can be used to scale cybersecurity operations to meet the growing demand for security services. It is particularly important as the number of devices and systems connected to the internet continues to grow.
    • Its algorithms can proactively identify vulnerabilities and potential security threats before they are exploited. It helps organizations to stay one step ahead of attackers and prevent security incidents before they occur.

    Artificial Intelligence is also widely used in web filtering to help organizations and individuals protect against malicious websites and content on the internet – just like SafeDNS does. Its AI algorithms analyze and classify web content in real-time, which allows web filtering software to quickly identify and block websites that contain harmful content, such as malware, phishing scams, and inappropriate material. These algorithms can also learn and adapt to new threats over time, making web filtering more effective and efficient.

    AI also helps personalize web filtering, allowing individuals and organizations to customize their web filtering settings based on their specific needs and preferences. For example, AI can be used to learn an individual’s browsing habits and preferences, and then adjust web filtering settings accordingly.

    However, deploying AI in business cybersecurity can be a complex and challenging process, and there are many potential pitfalls to avoid to ensure that AI is effectively integrated into your cybersecurity strategy. Here are some tips to make the process secure.

    Define clear goals and objectives#

    Before deploying AI in your cybersecurity strategy, it is important to clearly define your goals and objectives. This will help you to focus your efforts and ensure that your AI solution is aligned with your business needs.

    Understand the limitations of AI#

    While AI can be a powerful tool in cybersecurity, it is not a panacea. It is important to understand the limitations of AI and the potential risks associated with its use, such as bias and false positives.

    Invest in training and education#

    Deploying AI in cybersecurity requires a skilled workforce that understands how to work with AI and interpret its outputs. Invest in training and education for your cybersecurity team to ensure that they are equipped with the knowledge and skills needed to effectively deploy and manage AI solutions.

    Test and validate your AI solution #

    Before deploying your AI solution in a production environment, it is important to thoroughly test and validate it in a controlled environment. This will help to identify any issues or weaknesses and ensure that your AI solution is functioning as intended.

    What if there are no resources, both human, and financial, to ensure all these tips are followed? Lean on a trustful vendor.

    SafeDNS already uses AI in Threat Protection via web filtering. Special offer for The Hacker News readers: 10% off for business with promocode “Business_hackernews”. Insert it here & try out AI for your cybersecurity today.

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

    Resoruce : https://thehackernews.com/2023/02/how-to-use-ai-in-cybersecurity-and.html

    27Feb, 2023
    NIST Picks Ascon Algorithms to Protect Data on IoT, Small Electronic Devices

    The National Institute of Standards and Technology (NIST) has selected a group of cryptographic algorithms called Ascon as the lightweight cryptography standard to protect data flowing through IoT devices.

    Following a multi-year effort that included security code reviews, NIST announced the Ascon family of algorithms will soon be the standard to protect data created and transmitted by the Internet of Things (IoT), including its myriad tiny sensors and actuators. 

    The Ascon algorithms, developed in 2014 by a team of cryptographers from Graz University of Technology, Infineon Technologies, Lamarr Security Research and Radboud University, are designed for miniature technologies such as implanted medical devices, stress detectors inside roads and bridges, and keyless entry fobs for vehicles. 

    According to NIST, these tiny devices need “lightweight cryptography” — protection that uses the limited amount of electronic resources they possess

    The Ascon family was selected in 2019 as the primary choice for lightweight authenticated encryption in the final portfolio of the CAESAR competition, a sign that Ascon had withstood years of examination by cryptographers, NIST said in a note announcing the choice.

    “The world is moving toward using small devices for lots of tasks ranging from sensing to identification to machine control, and because these small devices have limited resources, they need security that has a compact implementation,” said NIST computer scientist Kerry McKay.  “These algorithms should cover most devices that have these sorts of resource constraints.”

    The standards body expects Ascon to power two of the most important tasks in lightweight cryptography: authenticated encryption with associated data (AEAD) and hashing. 

    The Institute made it clear that the new algorithms are not intended to be used for post-quantum encryption.  

    “One of the Ascon variants offers a measure of resistance to the sort of attack a powerful quantum computer might mount. However, that’s not the main goal here,” McKay said. “Post-quantum encryption is primarily important for long-term secrets that need to be protected for years. Generally, lightweight cryptography is important for more ephemeral secrets.” 

    Resource : https://www.securityweek.com/nist-picks-ascon-algorithms-to-protect-data-on-iot-small-electronic-devices/

    25Feb, 2023
    What is Computer Security?

    Technology is growing every day, and as it grows, it transforms our digital world. Internet use is increasing exponentially, making us correspondingly more vulnerable to cyber-attacks. By learning how cybercriminals attack and how to secure our systems and data against those attacks, you will be able to minimize the risk of data breaches and the devastation they bring with them.

    Computer security deals with the protection of computer systems and information from harm, theft, and unauthorized use. The main reason users get attacked frequently is that they lack adequate defenses to keep out intruders, and cybercriminals are quick to exploit such weaknesses. Computer security ensures the confidentiality, integrity, and availability of your computers and their stored data.

    The following topics will be covered in this computer security article:

    1. Why do users get attacked?
    2. Types of attacks
    3. What to secure?
    4. How do you secure your computer?

    Before we learn about computer security, let us understand why users get attacked.

    Why Do Users Get Attacked?

    Before getting into how to secure data from breaches, we must try to understand the motives behind these attacks. By knowing the motives behind the attacks, it’s easy for cybersecurity professionals to secure the systems. The main motives for attacking an organization’s or individual’s computer are: 

    1. Disrupting a business’ continuity: If a business is disrupted, it causes great harm to the organization in the form of lost profits, fraud, and damage to its reputation.
    2. Information theft and manipulating data: Hackers take confidential information that they steal from organizations and sell it to individuals or groups on the black market.
    3. Creating chaos and fear by disrupting critical infrastructure: Cyber terrorists attack a company or a government body to disrupt their services, doing damage that can potentially affect an entire nation.
    4. Financial loss to the target: Hackers attack an organization or business and disrupt their services in such a way that the target has to allocate substantial funds to repair the damage.
    5. Achieving a state’s military objectives: Rival nations continuously keep an eye on each other and sometimes employ cybercriminal tactics to steal military secrets. 
    6. Demanding ransom: The hackers employ ransomware to block a website or servers, releasing control only after a ransom is paid.
    7. Damaging the reputation of target: The hacker may have personal reasons to attack an organization or individual so that their reputation suffers.
    8. Propagating religious or political beliefs: Hackers may infiltrate websites to promote religious dogma or a certain political agenda, usually to sway voters to vote a certain way.

    Also Read: How to Become a Cybersecurity Engineer?

    We will next look at the types of attacks before understanding all about computer security.

    Types of Attacks

    There are many kinds of attacks available to the dedicated hacker. These are among the most famous and frequent types of attacks.

    1. Denial of service (DDoS):

    This is an attack used to restrict the user’s access to the system resources by flooding the server with useless traffic. The botmaster commands all the bots to access a resource at the same time so that the resource gets hopelessly jammed up. Then, if a legitimate user wants to access that same resource, they will not be able to do so. This is illustrated below:

    2. Malware attack:

    This is a malicious program that disrupts or damages the computer. There are four main types of malware:

    • Keylogger: Keylogger records all the hits on the targeted keyboard. Most hackers use it to get passwords and account details.
    • Virus: A computer virus is a malicious code that replicates by copying itself to another program or document and changes how a computer works. The virus, such as the Melissa virus, requires someone to knowingly or unknowingly spread the infection without the knowledge or permission of a user or system administrator. 
    • Worms: This is a standalone program that runs independently and infects the system. One of the more popular examples is W32.Alcra.F. The worm propagates itself through network share devices.
    • Trojan horse: This is a malicious code that takes over your computer. This code can damage or steal information from your computer.

    3. Man in the middle:

    Say, for example, you want to do an online transaction. You connect to your bank and conduct the payment. Simple, right? This is illustrated in the below image:

    Now, while you are doing a transaction, you have to enter the details of your card and the PIN. The cyber attacker spoofs you and monitors your transaction. As soon as you enter your details, he will have access to all of that information, as shown in the below image:

    4. Phishing:

    The attacker sends bait, often in the form of an email. It encourages people to share their details. For example, you get an email like this:

    If someone is a customer of ABC bank, he would probably open the link and enter the details. But these kinds of emails are always phishing. Banks do not send emails like this.

    5. Eavesdropping:

    Attacker observes traffic on your system and the work you are doing. The attacker can monitor you in three ways: 

    • Email monitoring
    • Which websites you visit
    • What items you download

    6. SQL injection:

    As the name suggests, an SQL injection vulnerability allows an attacker to inject malicious input into a SQL statement. This type of attack happens only on websites. The best example would be www.facebook.com. There is a database stored on the Facebook website. The hackers get into that database and sign in using someone else’s username and password.

    7. Password attack:

    To crack a password or find a password, hackers employ the following techniques:

    • Dictionary attack: In this method, they handle every password that is possible through the dictionary
    • Brute force: It is a trial and error method used to decode the password or data. This attack takes the most amount of time.
    • Keylogger: As the name suggests, keylogger records all the hits on the keyboard. Most people use it to get passwords and account details
    • Shoulder surfing: The attackers observe the user’s keyboard by looking over the user’s shoulder.
    • Rainbow table: There are rainbow tables that contain precomputed hash values. Attackers use this table to find the user’s password.

    8. Social engineering:

    Attackers create social situations that encourage you to share your password. For example, let’s say that you are out of your office, and you get a call. The person says that he is from the IT department and they have found out that your system has been compromised. He asks you to share your password. You might believe him and share your password. However, the caller was, in fact, a hacker, and how he has your password. Now that he has access, he can compromise your organization’s data. The best way to avoid the effects of social engineering is to learn your organization’s protocol regarding password sharing.

    So now that we have the why’s and the how’s let’s explore the what’s – Of computer security.

    What to Secure?

    The security of any organization starts with three principles: confidentiality, integrity, and availability. This is called CIA (no relation to the American spy organization!). CIA has served as the industry standard for computer security since the advent of the first mainframes.  

    • Confidentiality: The principles of confidentiality assert that information and functions can be accessed only by authorized parties. Example: military secrets.
    • Integrity: The principles of integrity assert that information and functions can be added, altered, or removed only by authorized people and means. Example: incorrect data entered by a user in the database.
    • Availability: The principles of availability assert that systems, functions, and data must be available on-demand according to agreed-upon parameters based on levels of service.

    We’ve covered the why’s, how’s, and what’s. Now let’s put that information into action and get a better understanding of computer security.

    How Do You Secure Your Computer?

    1. Two-way authentication

    Two-factor authentication adds a layer of security to the authentication process by making it harder for attackers to gain access to a person’s devices or online accounts. For example, when you make online payments, you first have to confirm your card’s cvv number, then you undergo a second confirmation by providing your mobile number.

    2. Secure passwords

    Create strong passwords so that no one will be able to hack or guess your password. The best passwords include:

    • At least 15 characters.
    • Capital letters.
    • Special characters. Example: @#$%.
    • Numbers.

    3. Regular updates

    Always keep your system and all its software updated. Many updates contain additional defenses against cyber attacks.

    4. Antivirus

    Antivirus is a computer program used to prevent, detect, and remove malware. Examples of antivirus include Norton, Quickheal, and McAfee.

    5. Firewalls

    Firewalls prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets.

    6. Anti-Phishing Tactics

    When you get an email that looks suspicious or has no relation to you, then do the following:

    • Do not click on the link in the email.
    • Do not provide any personal details if asked.
    • Do not open the attached files.

    7. Encryption

    This is the process of converting ordinary plain text into unintelligible text and vice-versa. Encryption is used in many applications like: 

    • Banking transactions.
    • Computer passwords.
    • E-commerce transactions.

    Unfortunately, cybercrime is increasing daily, so it’s imperative to have a solid grasp of the best cybersecurity practices. While the internet is transforming and improving our lives, the vast network and its associated technologies have become a lucrative hunting ground for a growing number of cybercriminals, agents from which individuals and businesses must protect themselves.

    The consequences of these attacks can range from the ruin of a business to the crashing of a national economy. Confidential or sensitive data can be lost, privacy violated, and reputations ruined. Your computer could even be used by a hacker to attack other computers, which in turn could send the authorities looking for you!

    If you’d like to learn more about cybersecurity, check out Simplilearn’s Introduction to cybersecurity Course for cybersecurity Beginners. The course is designed to give you a foundational look at today’s cybersecurity landscape and provide you with the tools to evaluate and manage security protocols in information processing systems.

    If you’re already proficient with the basics, consider Simplilearn’s Advanced Executive Program In Cybersecurity or the Cybersecurity Expert Master’s program. This program will equip you with the skills needed to become an expert in this rapidly growing domain. You will learn comprehensive approaches to protecting your infrastructure, including securing data and information, running risk analysis and mitigation, architecting cloud-based security, achieving compliance, and much more with this best-in-class program.

    Not only do these courses empower you with greater cybersecurity skills, but they can also be the foundation for a whole new career! Check out Simplilearn today, and get started.

    Resource : https://www.simplilearn.com/what-is-computer-security-article

    25Feb, 2023
    Top SaaS cyber security threats in 2023

    This year will bring new challenges and new opportunities in relation to SaaS security. As we move into the year, it’s becoming increasingly clear that SaaS organizations will need to take great care in implementing the processes, policies, tools and best practices that will prevent next-generation threats from disrupting the flow of business. In this article, we’ll discuss prominent issues related to SaaS security, explaining what they are and how to more effectively protect your business data.

    1. Web application weaknesses. Web applications are at the center of the SaaS business model, and play a profound role in determining how an enterprise operates. Web applications commonly store customer data and other valuable business information.

    Because SaaS applications are commonly multi-tenanted, applications need to be secure from the kinds of attacks where one customer attempts to break into the systems of another customer. Such attacks tend to rely on logic flaws, injection flaws or access control weaknesses.

    Design and build secure web applications by using an automated vulnerability scanner in combination with routine pentesting. This can assist you in catching vulnerabilities as they’re introduced through the development cycle.

    2. Misconfiguration mistakes. Glitches, gaps and errors can accidentally expose your cloud environment to risk. Engineers are typically tasked with ensuring that every setting, user role and permission complies with industry and company policy. However, misconfigurations can occur – and they’re also extremely difficult to detect and to manually remediate.

    Mitigate risk by ensuring that you monitor external networks and pentest cloud infrastructure. This will help reveal issues related to misconfigured S3 buckets, permissive firewalls within VPCs, and overly permissive cloud accounts.

    A vulnerability scanner can help reduce and monitor your attack surface by ensuring that only the services that need exposure to the internet are accessible.

    3. Vulnerable software and patching. Although it may sound obvious, vulnerable software and patching are major issues that companies continue to contend with. If you’re self-hosting an application, ensure that the operating system and library security patches are applied shortly after they are rolled out. Vulnerability fixes and patching are continuous processes, as security vulnerabilities in operating systems and libraries are constantly being identified and solved for.

    Use DevOps best practices and ephemeral infrastructure to make sure that your systems are always up-to-date with each patch release. In addition, be sure to monitor for new weaknesses that could be uncovered between patch releases.

    One alternative to self-hosting is free (and paid) Serverless and Platform-as-a-Service (PaaS) offerings that operate your application in a container. This takes care of operation system patching. However, the onus is on you to ensure that the libraries used by your service are kept up-to-date with security patches.

    4. Weak internal security policies and practices. SaaS companies are often small, strategic and well-positioned for growth. Consequently, in the spirit of moving fast and breaking things, the security posture can prove poor. SaaS businesses are particularly vulnerable to cyber attacks.

    Simple measures like two-factor authentication and cyber security awareness training for employees can significantly increase security.

    Organizations should take care to enable two-factor or multi-factor authentication (2FA/MFA) wherever possible. Further, ensure that your teams understand how to recognize and avoid phishing emails.

    Resource : https://www.cybertalk.org/top-saas-cyber-security-threats-in-2023/

    24Feb, 2023
    Will GitOps Change Software Development Forever?

    Development pipelines, applications, and configuration of all possible applications for GitOps.

    Using Git as a single point of truth, GitOps is a method for deploying in software development and managing applications and infrastructure. The desired state of an application or infrastructure is stored and versioned using Git, and automation tools are used to ensure that the actual state matches the desired state. This makes it simple to collaborate, do rollbacks, audit, and manage changes by using standard Git workflows. GitOps is a cloud-native technologies tool. DevOps and GitOps are two well-known approaches to software development that aim to increase development efficiency.

    Software development will be altered in three ways by GitOps.

    1. The shift to immutability means that a commit or file in a Git repository cannot be changed after it is added. There are several advantages to this immutability, including:
    • Audience: Because Git is immutable, it is simple to keep track of changes and comprehend who, when, and why they were made. This makes it easier for teams to audit their codebase, and find and fix problems.
    • Continuity: Viewing a repository or file’s entire history is simple with Git. This makes it simple to comprehend the evolution of a particular application or file over time, which can be useful for debugging issues or determining the root cause of a problem.
    • Repeatability: Git commits are immutable, so developers don’t have to worry about breaking the application or losing data when rolling back to an earlier version of the codebase. This ensures that the application is always in a known, working state and allows teams to quickly recover from issues.
    • Working together: Because of its immutability, Git makes it simple for multiple developers to collaborate on the same codebase without worrying about data loss or conflicts. Teams can work together on changes and make sure that only changes that have been approved are put into production by using tools like branches, pull requests, and others that are built on Git.
    1. When utilizing GitOps, developers can suggest modifications to the application or infrastructure in the following ways:
    • Create a branch for features: In the Git repository, developers can make changes to a new branch, then submit a pull request to have them reviewed and merged. This lets teams work together on changes and makes sure that only changes that have been approved are put into production.
    • Employ pull requests: A pull request, which developers can use to submit their changes, can be reviewed and approved by other team members before being merged into the main branch. Before the changes are put into production, this gives teams a chance to look over them and talk about any potential problems.
    • Use the ‘issue following’ feature: In the Git repository, developers can report bugs or make changes by opening an issue. This makes it simple to see the status of a particular issue or pull request and allows teams to track and discuss changes in a single location.
    • Use tools for code review: Code review tools let developers automatically look for errors and security holes in the code. This helps to ensure that the main branch only contains high-quality code.
    • Keep an eye out for: The application’s and infrastructure’s status can be monitored by developers, who can be notified of any problems; this assists in quickly identifying and responding to any issues and ensuring that the application and infrastructure are operating as expected.

    Developers can suggest changes and report problems using these techniques in a controlled and effective manner, assisting in the rapid and secure deployment of changes.

    It is essential to keep in mind that the specific procedure for suggesting changes may differ based on the procedures and tools utilized by the organization. However, the above methods provide a general idea of how GitOps can be used to suggest changes.

    1. GitOps uses Git as the single source of truth for both application and infrastructure code. Git captures all environment information. Teams can easily view the entire history of the codebase and comprehend how it has developed over time because Git tracks all changes. An audit trail can be used for the following:
    • Enhance traceability: Teams can view a file or repository’s entire history with Git, making it simple to comprehend how a particular application or file has developed over time. Debugging issues or determining the root cause of a problem can be made easier with this.
    • Guarantee compliance: The immutability of Git ensures that every change is recorded and tracked, which can be useful for complying with regulations. The Git history can be used by auditors to see precisely what changes were made and which can be used to show that the company complies with industry regulations.

    Resource : https://www.analyticsinsight.net/will-gitops-change-software-development-forever/

    24Feb, 2023
    Top 5 Dominating Blockchain Industry Trends to Know in 2023

    The top trends dominating the Blockchain industry in 2023 that disrupt and influence the technology

    Blockchain Industry is still in its nascent stage, but it has shown enormous promise in recent years. A growing number of startups and businesses are embracing blockchain technology. With this advancement, there will be trends dominating Blockchain industry that will yield productivity and security benefits.

    A blockchain is a decentralised, distributed, and public digital ledger that is used to record transactions across many computers in such a way that the record cannot be changed retroactively without affecting all subsequent blocks requiring network consensus. The ability of blockchain technology to revolutionize various industries through secure and transparent data, asset storage, and transfer is widely recognized. It is used in a variety of applications, including finance, supply chain management, healthcare, and government. Because of its robust security measures and privacy-enhancing capabilities, some top blockchain trends help aid companies and organizations to its full potential.

    In 2023, the following 5 trends will dominate blockchain industry:

    1. Increased adoption of blockchain by enterprises

    A variety of factors, such as funding from venture capitalists, value chain creation to clients via a variety of use cases, and the growing need to simplify processes by creating transparency, reducing operational costs, and transforming customer experience, are driving large scale adoption of blockchain among enterprises. Blockchain is quickly becoming an essential component of business operations. And this will only become more prominent in 2023. Businesses are becoming more aware of the potential benefits that blockchain technology can offer. Improved security is one of these advantages. Furthermore, blockchain provides transparency in transactions, which can be viewed publicly on the blockchain network. Blockchain’s decentralized nature makes it highly secure against cyber attacks.

    1. Blockchain with AI

    Better development will result from the integration of AI with blockchain technology. This integration will demonstrate a level of advancement in blockchain technology with a sufficient number of applications. Furthermore, blockchain can make AI more coherent and understandable, and we can trace and determine why decisions in machine learning are made. Blockchain and its ledger can record all data and variables that go through a machine learning decision.

    AI can improve blockchain efficiency far more effectively than humans or even traditional computing. Smart Computing Power, Creating Diverse Data Sets, Data Protection, Data Monetization, and Trusting AI Decision Making are some examples of AI applications in Blockchain.

    1. Decentralized Finance (DeFi) and Regenerative Finance (ReFi) will continue to gain steam

    DeFi is a blockchain-based financial service that eliminates the need for users to go through traditional intermediaries such as banks or other financial institutions. Instead, they can use the blockchain network to directly access lending, borrowing, and investment services. Cred Protocol, a DeFi-based startup, has created a credit scoring system for these types of transactions. ReFi in cryptocurrency, on the other hand, aims to use blockchain technology to spread positive impact and solve systemic problems such as climate change. This is still a new and developing concept, but we can expect it to grow as blockchain technology advances. These two technologies have recently gained popularity, and we expect them to gain even more traction in 2023.

    1. Economy and Finance will lead Blockchain Applications

    Unlike other traditional businesses, the banking and finance industries do not require radical changes to their processes in order to adopt blockchain technology. Financial institutions began seriously considering blockchain adoption for traditional banking operations after it was successfully applied for cryptocurrency. Banks will be able to reduce excessive bureaucracy, conduct faster transactions at lower costs, and improve their secrecy with the help of blockchain technology. Furthermore, blockchain can be used to launch new cryptocurrencies that are governed or influenced by monetary policy. Banks hope to achieve greater control over their monetary policy by reducing the competitive advantage of standalone cryptocurrencies.

    1. Blockchain Integration into Government Agencies

    A digital government based on blockchain can protect data, streamline processes, and reduce fraud, waste, and abuse while also increasing trust and accountability. Individuals, businesses, and governments share resources via a distributed ledger secured with cryptography in a blockchain-based government model. This structure eliminates a single point of failure and protects sensitive citizen and government data from the start.

    A blockchain-based government has the potential to alleviate legacy pain points while also enabling the following benefits: Secure data storage for the government, citizens, and reduced labor-intensive processes, excessive costs associated with managing accountability must be reduced, Reduced risk of corruption and abuse, Trust in government and online civil systems has grown. The distributed ledger format can be leveraged to support an array of government and public sector applications, including digital currency/payments, land registration, identity management, supply chain traceability, health care, corporate registration, taxation, voting (elections and proxy), and legal entity management.

    Resource : https://www.analyticsinsight.net/top-5-dominating-blockchain-industry-trends-to-know-in-2023/

    22Feb, 2023
    AI Chatbots Are Coming to Search Engines. Can You Trust Them?

    Google, Microsoft and Baidu are using tools similar to ChatGPT to turn Internet searches into a conversation. How will this change humanity’s relationship with machines?

    Months after the chatbot ChatGPT wowed the world with its uncanny ability to write essays and answer questions like a human, artificial intelligence (AI) is coming to Internet search.

    Three of the world’s biggest search engines — Google, Bing and Baidu — last week said they will be integrating ChatGPT or similar technology into their search products, allowing people to get direct answers or engage in a conversation, rather than merely receiving a list of links after typing in a word or question. How will this change the way people relate to search engines? Are there risks to this form of human–machine interaction?

    Microsoft’s Bing uses the same technology as ChatGPT, which was developed by OpenAI of San Francisco, California. But all three companies are using large language models (LLMs). LLMs create convincing sentences by echoing the statistical patterns of text they encounter in a large database. Google’s AI-powered search engine, Bard, announced on 6 February, is currently in use by a small group of testers. Microsoft’s version is widely available now, although there is a waiting list for unfettered access. Baidu’s ERNIE Bot will be available in March.

    Before these announcements, a few smaller companies had already released AI-powered search engines. “Search engines are evolving into this new state, where you can actually start talking to them, and converse with them like you would talk to a friend,” says Aravind Srinivas, a computer scientist in San Francisco who last August co-founded Perplexity — an LLM-based search engine that provides answers in conversational English.

    CHANGING TRUST

    The intensely personal nature of a conversation — compared with a classic Internet search — might help to sway perceptions of search results. People might inherently trust the answers from a chatbot that engages in conversation more than those from a detached search engine, says Aleksandra Urman, a computational social scientist at the University of Zurich in Switzerland.

    A 2022 study1 by a team based at the University of Florida in Gainesville found that for participants interacting with chatbots used by companies such as Amazon and Best Buy, the more they perceived the conversation to be human-like, the more they trusted the organization.

    That could be beneficial, making searching faster and smoother. But an enhanced sense of trust could be problematic given that AI chatbots make mistakes. Google’s Bard flubbed a question about the James Webb Space Telescope in its own tech demo, confidently answering incorrectly. And ChatGPT has a tendency to create fictional answers to questions to which it doesn’t know the answer — known by those in the field as hallucinating.

    A Google spokesperson said Bard’s error “highlights the importance of a rigorous testing process, something that we’re kicking off this week with our trusted-tester programme”. But some speculate that, rather than increasing trust, such errors, assuming they are discovered, could cause users to lose confidence in chat-based search. “Early perception can have a very large impact,” says Sridhar Ramaswamy, a computer scientists based in Mountain View, California and chief executive of Neeva, an LLM-powered search engine launched in January. The mistake wiped $100 billion from Google’s value as investors worried about the future and sold stock.

    LACK OF TRANSPARENCY

    Compounding the problem of inaccuracy is a comparative lack of transparency. Typically, search engines present users with their sources — a list of links — and leave them to decide what they trust. By contrast, it’s rarely known what data an LLM trained on — is it Encyclopaedia Britannica or a gossip blog?

    “It’s completely untransparent how [AI-powered search] is going to work, which might have major implications if the language model misfires, hallucinates or spreads misinformation,” says Urman.

    If search bots make enough errors, then, rather than increasing trust with their conversational ability, they have the potential to unseat users’ perceptions of search engines as impartial arbiters of truth, Urman says.

    She has conducted as-yet unpublished research that suggests current trust is high. She examined how people perceive existing features that Google uses to enhance the search experience, known as ‘featured snippets’, in which an extract from a page that is deemed particularly relevant to the search appears above the link, and ‘knowledge panels’ — summaries that Google automatically generates in response to searches about, for example, a person or organization. Almost 80% of people Urman surveyed deemed these features accurate, and around 70% thought they were objective.

    Chatbot-powered search blurs the distinction between machines and humans, says Giada Pistilli, principal ethicist at Hugging Face, a data-science platform in Paris that promotes the responsible use of AI. She worries about how quickly companies are adopting AI advances: “We always have these new technologies thrown at us without any control or an educational framework to know how to use them.”

    Resource : https://www.scientificamerican.com/article/ai-chatbots-are-coming-to-search-engines-can-you-trust-them/

    22Feb, 2023
    How Scientists Are Using AI to Talk to Animals

    Portable sensors and artificial intelligence are helping researchers decode animal communication—and begin to talk back to nonhumans

    In the 1970s a young gorilla known as Koko drew worldwide attention with her ability to use human sign language. But skeptics maintain that Koko and other animals that “learned” to speak (including chimpanzees and dolphins) could not truly understand what they were “saying”—and that trying to make other species use human language, in which symbols represent things that may not be physically present, is futile.

    “There’s one set of researchers that’s keen on finding out whether animals can engage in symbolic communication and another set that says, ‘That is anthropomorphizing. We need to … understand nonhuman communication on its own terms,’” says Karen Bakker, a professor at the University of British Columbia and a fellow at the Harvard Radcliffe Institute for Advanced Study. Now scientists are using advanced sensors and artificial intelligence technology to observe and decode how a broad range of species, including plants, already share information with their own communication methods. This field of “digital bioacoustics” is the subject of Bakker’s new book The Sounds of Life: How Digital Technology Is Bringing Us Closer to the Worlds of Animals and Plants.

    Scientific American spoke with Bakker about how technology can help humans communicate with creatures such as bats and honeybees—and how these conversations are forcing us to rethink our relationship with other species.

    Can you give us a brief history of humans attempting to communicate with animals?

    There were numerous attempts in the mid-20th century to try to teach human language to nonhumans, primates such as Koko. And those efforts were somewhat controversial. Looking back, one view we have now (that may not have been so prevalent then) is that we were too anthropocentric in our approaches. The desire then was to assess nonhuman intelligence by teaching nonhumans to speak like we do—when in fact we should have been thinking about their abilities to engage in complex communication on their own terms, in their own embodied way, in their own worldview. One of the terms used in the book is the notion of umwelt, which is this notion of the lived experience of organisms. If we are attentive to the umwelt of another organism, we wouldn’t expect a honeybee to speak human language, but we would become very interested in the fascinating language of honeybees, which is vibrational and positional. It’s sensitive to nuances such as the polarization of sunlight that we can’t even begin to convey with our bodies. And that is where the science is today. The field of digital bioacoustics—which is accelerating exponentially and unveiling fascinating findings about communication across the tree of life—is now approaching these animals and not asking, “Can they speak like humans?” but “Can they communicate complex information to one another? How are they doing so? What is significant to them?” And I would say that’s a more biocentric approach or at the very least it’s less anthropocentric.

    Taking a bigger view, I think it’s also important to acknowledge that listening to nature, “deep listening,” has a long and venerable tradition. It’s an ancient art that is still practiced in an unmediated form. There are long-standing Indigenous traditions of deep listening that are deeply attuned to nonhuman sounds. So if we combine digital listening—which is opening up vast new worlds of nonhuman sound and decoding that sound with artificial intelligence—with deep listening, I believe that we are on the brink of two important discoveries. The first is language in nonhumans. And that’s a very controversial statement, which we can dig into. And the second is: I believe we’re at the brink of interspecies communication.

    What sort of technology is enabling these breakthroughs?

    Digital bioacoustics relies on very small, portable, lightweight digital recorders, which are like miniature microphones that scientists are installing everywhere from the Arctic to the Amazon. You can put these microphones on the backs of turtles or whales. You can put them deep in the ocean, [put them] on the highest mountaintop, attach them to birds. And they can record sound continuously, 24/7, in remote places where scientists cannot easily reach, even in the dark and without the disruption that comes from introducing human observers in an ecosystem.

    That instrumentation creates a data deluge, and that is where artificial intelligence comes in—because the same natural language processing algorithms that we are using to such great effect in tools such as Google Translate can also be used to detect patterns in nonhuman communication.

    What’s an example of these communication patterns?

    In the bat chapter where I discuss the research of Yossi Yovel, there’s a particular study in which he monitored [nearly two] dozen Egyptian fruit bats for two and a half months and recorded … [their] vocalizations. His team then adapted a voice recognition program to analyze [15,000 of] the sounds, and the algorithm correlated specific sounds with specific social interactions captured via videos—such as when two bats fought over food. Using this, the researchers were able to classify the majority of bats’ sounds. That is how Yovel and other researchers such as Gerry Carter have been able to determine that bats have much more complex language than we previously understood. Bats argue over food; they actually distinguish between genders when they communicate with one another; they have individual names, or “signature calls.” Mother bats speak to their babies in an equivalent of “motherese.” But whereas human mothers raise the pitch of their voices when talking to babies, mother bats lower the pitch—which elicits a babble response in the babies that learn to “speak” specific words or referential signals as they grow up. So bats engage in vocal learning.

    That’s a great example of how deep learning is able to derive these patterns from [this] instrumentation, all of these sensors and microphones, and reveal to us something that we could not access with the naked human ear. Because most of bat communication is in the ultrasonic, above our hearing range, and because bats speak much faster than we do, we have to slow it down to listen to it, as well as reduce the frequency. So we cannot listen like a bat, but our computers can. And the next insight is, of course, that our computers can also speak back to the bat. [The software produces] specific patterns and uses those to communicate back to the bat colony or to the beehive, and that is what researchers are now doing.

    How are researchers talking to bees?

    The honeybee research is fascinating. A [researcher] named Tim Landgraf studies bee communication, which, as I mentioned earlier, is vibrational and positional. When honeybees “speak” to one another, it’s their body movements, as well as the sounds, that matter. Now computers, and particularly deep-learning algorithms, are able to follow this because you can use computer vision, combined with natural language processing. They have now perfected these algorithms to the point where they’re actually able to track individual bees, and they’re able to determine what impact the communication of an individual might have on another bee. From that emerges the ability to decode honeybee language. We found that they have specific signals. [Researchers have given these signals] funny names. [Bees] toot; they quack. There’s a “hush” or “stop” signal, a whooping “danger” signal. They’ve got piping [signals related to swarming] and begging and shaking signals, and those all direct collective and individual behavior.

    The next step for Landgraf was to encode this information into a robot that he called RoboBee. Eventually, after seven or eight prototypes, Landgraf came up with a “bee” that could enter the hive, and it would essentially emit commands that the honeybees would obey. So Landgraf’s honeybee robot can tell the other bees to stop, and they do. It can also do something more complicated, which is the very famous waggle dance—it’s the communication pattern they use to convey the location of a nectar source to other honeybees. This is a very easy experiment to run, in a way, because you put a nectar source in a place where no honeybees from the hive have visited, you then instruct the robot to tell the honeybees where the nectar source is, and then you check whether the bees fly there successfully. And indeed they do. This result only happened once, and scientists are not sure why it worked or how to replicate it. But it is still an astounding result.*

    This raises a lot of philosophical and ethical questions. You could imagine such a system being used to protect honeybees—you could tell honeybees to fly to safe nectar sources and not polluted ones that had, let’s say, high levels of pesticides. You could also imagine this could be a tool to domesticate a previously wild species that we have only imperfectly domesticated or to attempt to control the behavior of other wild species. And the insights about the level of sophistication and the degree of complex communication in nonhumans raises some very important philosophical questions about the uniqueness of language as a human capacity.

    What impact is this technology having on our understanding of the natural world?

    The invention of digital bioacoustics is analogous to the invention of the microscope. When [Dutch scientist Antonie] van Leeuwenhoek started looking through his microscopes, he discovered the microbial world…, and that laid the foundation for countless future breakthroughs. So the microscope enabled humans to see anew with both our eyes and our imaginations. The analogy here is that digital bioacoustics, combined with artificial intelligence, is like a planetary-scale hearing aid that enables us to listen anew with both our prosthetically enhanced ears and our imagination. This is slowly opening our minds not only to the wonderful sounds that nonhumans make but to a fundamental set of questions about the so-called divide between humans and nonhumans, our relationship to other species. And [it’s] also opening up new ways to think about conservation and our relationship to the planet. It’s pretty profound.

    Resource : https://www.scientificamerican.com/article/how-scientists-are-using-ai-to-talk-to-animals/?utm_source=pocket-newtab-intl-en

    20Feb, 2023
    API management (APIM): What It Is and Where It’s Going

    Analyzing the concept of API management (APIM), its benefits, and what it will look like as the API landscape continues to evolve.

    There are two fundamental truths in the API landscape.

    • First: APIs have become a strategic tool for companies to expand their digital reach, accelerate their businesses, and do more for their customers.
    • Second: because of the way they work and how they’ve been used so far, APIs are particularly vulnerable to attacks from bad actors. In fact, according to recent research, malicious API attack traffic surged 117% over the past year, indicating that the threat on APIs is far from abating.

    So, where does this leave businesses that want to leverage the power of APIs? For starters, they need to invest in an API security strategy that covers all their bases. A robust strategy will be held up by a number of different tools and methodologies, including API management (APIM).

    In this article, we’re taking a closer look at what APIM is, its benefits, and what it will look like as the API landscape continues to evolve.

    What Is APIM?

    APIM is the process of creating, distributing, monitoring, and analysing APIs that connect applications and data across the enterprise and clouds. Typically deployed as a scalable platform, APIM allows enterprises to share their API configurations while controlling access, monitoring and collecting usage data, and enforcing security policies related to APIs.

    In other words, APIM gives businesses the power to better leverage the API economy without compromising on security. There are also internal benefits: managing all APIs on one unified platform lets enterprises share API documentation and coding constructs between teams, ultimately making things easier (and faster) for developers.

    What Are the Components of APIM?

    To facilitate flexibility, quality, speed, and security for enterprise APIs, APIM platforms are usually comprised of five key elements, outlined below.

    API gateway: The API gateway acts as the portal through which all routing requests and protocol translations are handled. As APIs often have different structures and languages and are constantly changing, an API gateway facilitates communication, providing a single point of contact for internal and external parties to interact with APIs.

    API developer portal: The developer portal provides a self-service hub for developers that want to access and share API documentation. This contributes significantly to speeding up how developers work with APIs, streamlining the building and testing processes, and providing consistency across the team.

    API analytics: There’s a lot of value in understanding and evaluating a given API’s usage and operational metrics — and that’s where an API reporting and analytics function comes in. APIM platforms are often equipped with dashboards that provide this visibility and allow enterprise teams to make better decisions about how they use their APIs, such as whether it’s worth monetizing them. From an operational perspective, these dashboards help identify issues early so they can be addressed proactively.

    API lifecycle management: With APIs, one of the biggest challenges is that there isn’t visibility into the whole lifecycle — from design to implementation and retirement. The reason is that APIs are often created for small internal uses and then launched into bigger use cases without the proper vetting. Lifecycle management mitigates this, providing a sustainable solution for building, testing, and managing APIs with version control support.

    API policy manager: Each API should operate within a set of API policies that shape its evolution. API policy managers control the lifecycle of these policies and house broader policies that impact the entire API infrastructure.

    In an APIM platform, each of these tools comes together to give companies a more complete and comprehensive view into their APIs and the control to enhance security across the API ecosystem.

    What APIM is Not

    From a security perspective, while APIM platforms are key for creating unified visibility and control over a company’s API infrastructure — and for facilitating the implementation of API security features — it’s important to note that it’s only one pillar in a robust API security strategy. API management platforms are not, fundamentally, security platforms. They lack key API security elements organizations should enforce, including continuous authentication and authorization, access control, data validation, runtime security tailored to the OWASP API Top 10 attacks, and a testing plan for APIs both in production and pre-prod.

    It’s also important to note that APIM isn’t a one-size-fits-all solution. It’s essential to evaluate the company’s IT infrastructure and other resources to ensure that they are equipped to adopt and implement a new platform for its APIs. Do you have the right level of expertise on your team? Are you working with enough APIs to justify the adoption of an APIM platform? Do you have API security policies in place to enable your APIM tool to do its best work? These are all critical questions to ask as you evaluate this solution.

    What Are the Benefits of APIM?

    For many enterprises, APIs are the Wild West of their technical infrastructure. APIs often differ significantly from one another, making it challenging to create overarching measures to manage them. The landscape is constantly changing, so documentation quickly becomes outdated and irrelevant. This is part of what makes APIs such an appealing threat vector for cybercriminals. APIM remedies this while providing other benefits.

    APIM supports businesses by:

    • Centralising visibility to all API connections, lowering the risk of attacks, and giving teams the ability to identify gaps and duplicates
    • Facilitating data-driven decisions for the business, such as monetizing the API
    • Protecting the business from API-related threats
    • Enabling the creation of detailed API documentation
    • Creating better user experiences for API consumers
    • Improving developer experiences
    • Providing better insights into the current state of API security, allowing teams to create a better ecosystem

    What Does the Future of APIM Look Like?

    APIs aren’t going anywhere. Businesses are continuing to build applications that rely on hundreds, if not thousands, of APIs. With APIs exposed to multiple data centres, cloud providers, and customers, with different levels of access requirements and customization, the scale and complexity of the ecosystem are only going to get bigger. For enterprises that want to stay agile, organised, and secure, APIM will be crucial.

    APIM will continue to be an important driver for functions such as versioning, deployment processes, usage metrics, and interoperability. And from a security perspective, they will develop as API gateways become more mature, doing more in the rate limiting, data masking, and authentication spaces.

    Other changes will come within the interfaces themselves. There’s a growing shift in the developer tooling space with the emergence of tools that favour visual drag-and-drop functionalities instead of coding. This way, different teams can contribute to APIM within the bounds of their skill sets and still have a clear understanding of the workflows, API lifecycles, and API security policies.

    As APIM platforms continue to mature, they will become an even more strategic asset for businesses that want to make the most of the API landscape without compromising their security.

    About the Author: Ali Cameron is a content marketer that specializes in the cybersecurity and B2B SaaS space. Besides writing for Tripwire’s State of Security blog, she’s also written for brands including Okta, Salesforce, and Microsoft. Taking an unusual route into the world of content, Ali started her career as a management consultant at PwC where she sparked her interest in making complex concepts easy to understand. She blends this interest with a passion for storytelling, a combination that’s well suited for writing in the cybersecurity space. She is also a regular writer for Bora. 

    Resource : https://securityaffairs.com/141738/security/api-management-apim.html

    20Feb, 2023
    Top 5 API Lessons for Software Engineering Leaders

    It is important for software engineering leaders to balance the technical and business goals of their API strategy and practice by considering these top 5 aspects.

    Software engineering leaders around the world see application programming interfaces (APIs) as the best option to connect systems and applications to build impactful and composable software architectures. However, they overlook the business potential of APIs as digital products and focus largely on technical use cases. 

    To deliver meaningful business outcomes and gain the trust of stakeholders, organizations need a modern API strategy that is closely aligned to business goals, and which covers API security, governance, life cycle management, developer enablement and potential for monetization. 

    “Software engineering leaders responsible for API strategies shouldn’t focus only on the technical benefits of APIs. They must incorporate the business perspectives to avoid risking the support of business stakeholders,” says Shameen Pillai, Sr Director Analyst at Gartner.

    Here are the top five considerations for software engineering leaders to develop an effective API strategy and practice.

    No. 1. Don’t let API governance create bottlenecks

    For developing, managing and governing APIs without creating bureaucratic hurdles, software engineering leaders can implement an “adaptive governance” model. The idea is to create a federated API platform team (for example, having product managers from different business groups such as digital, commerce and logistic API teams) and manage the locally built APIs without undermining the overall API strategy.

    To support localized standards, tools and processes, ensure that API product teams do not create disjointed or overlapping standards and actively participate in federated API governance. The platform teams and product managers should have consistent communication to be aware of shared assets, policies and practices.

    No. 2. Treat APIs as products, even if you don’t plan to monetize them

    Looking at APIs as a way to achieve technical purposes isn’t enough in the postpandemic world. They are now essential in advancing digital business strategies and should be treated as products without prioritizing monetization. Although many organizations monetize APIs, the majority don’t. Many organizations use API products for internal consumption only.

    Regardless, the development, organization and management of APIs should be driven by a consumer-centric mindset that requires product managers to:

    • Prepare API roadmaps and measure business outcomes
    • Understand and cater to the needs of API consumers (for example, developers) to promote API products and improve developer relations (DevRel)

    No. 3. Discover your APIs before hackers do

    As APIs are the gateways to systems, applications and services, they are always vulnerable to security threats. This may result in the loss of private and sensitive information about millions of users.

    The security strategy for APIs should focus on threat protection, well-refined access control and data privacy. Software engineering leaders often protect the published APIs, but there can be shadow or unpublished APIs. API discovery is the key to ensuring that there are no blind spots and to track any malicious usage of APIs.  

    Software engineering leaders should adopt a DevSecOps strategy and institute a security governance policy across the organization. They should assess and enhance the capabilities of API security and management solutions to discover APIs and potential threats from hackers.

    No. 4.Manage the life cycle of APIs

    An API’s life cycle involves four stages:

    • Planning and initial design
    • Implementation and testing
    • Deploy and run
    • Versioning and retirement

    Software engineering leaders should build a consistent process around the four life cycle stages to develop a comprehensive API strategy and practice. For example, the “planning and initial design” stage should focus on an iterative process, consisting of a design approach, methodology and governance. Likewise, the “deploy and run” stage should focus on advanced security analytics to measure API business value.

    Leverage automation to sustain API quality, track issues and optimize the API’s life cycle based on actual performance.

    Align the development of APIs with the organization’s DevOps process for continuous integration and delivery. This way, software engineering leaders learn about other considerations when building, deploying, testing and implementing APIs in various environments. For example, as per API testing guidelines, certain functional, performance and security testing requirements can be mandatory.

    No. 5. Choose best-fit API technologies

    There are a variety of vendor solutions for developing and managing APIs available in the market today. However, the API market is evolving, with some vendors focusing on specific aspects of APIs like design, testing, monitoring, security, portals and ecosystem management. 

    Related webinar: How to Benefit From API Startups and New API Trends

    With so many different solutions to select from, software engineering leaders should have clarity regarding the needs of their organization and engineering groups. To make the selection more credible and collaborative, involve API product managers, API platform teams and security teams in the process. 

    It may be difficult to identify what differentiates different vendor solutions when it comes to potential, viability and maturity. Review critical capabilities for API life cycle management to understand the respective strengths and weaknesses of each solution and select the best possible fit.

    Resource: https://www.gartner.com/smarterwithgartner/top-5-api-lessons-for-software-engineering-leaders