Random Acts of Technology

18
Nov
2019

Minecraft Hour of Code 2019: For Everyone but Chromebook Users

Microsoft made an interesting decision this year to not support the hour of code event on Chromebooks. While sure, that seems like a non-event, most people don’t use Chromebooks… except for schools and students. As a parent of a student in a district that uses Chromebooks for their classroom work, this is disappointing to say the least. The whole point of the hour of code event is to get kids involved in coding and to learn. To do that the event has to be inclusive and support the platforms that students have access to. Chromebooks are incredibly common in education where schools need to provide a computing platform that is easy to manage and relatively inexpensive. To exclude a platform such as this is to make the hour of code an event exclusive to those who can afford more expensive platforms which violates the entire principle of the event.

You can be better than this Microsoft, time to make the hour of code accessible to all kids.

17
Nov
2019

Surprise! John Legere Won’t Be WeWork CEO

Engadget is reporting that John Legere, while once a possibility floated as the next WeWork CEO, is no longer in the running. Sure the convenient excuse for this is that Softbank is the majority owner in both WeWork and Sprint which T-Mobile is merging with so there is a conflict of interest. I get it, and it is a completely reasonable explanation for why Mr. Legere will not be the next WeWork CEO.

However, I would speculate that he also wants nothing to do with the dumpster fire that is WeWork currently. He would go from the savior of T-Mobile to the CEO of a company that is despised and mired in turmoil. I don’t care how much of a turnaround CEO you are, willfully walking into a company like WeWork right now is not the note you want your career to go out on. Much better to be the person who successfully merges and T-Mobile and Sprint than to be the one that goes down on the WeWork ship.

13
Nov
2019

The End is Nigh! Time to Ditch Windows 7 Now

ITWorld has a very interesting long running series of articles chronicling the slow but steady demise of Windows 7 and the slow but stead rise of Windows 10 in terms of market share. Come January 14th 2020, Windows 7 support will officially end (unless you want to keep paying Microsoft for security updates on a per PC basis) and you will no longer get all of those critical updates needed to keep your organization secure.

What amazes me about the whole process is the prediction by Net Applications that Windows 7 may retain 10+ percent market share well into 2022, long after support has ended and almost every known flaw will be easily exploitable. Don’t get me wrong, I know first hand how painful it can be to update and replace thousands of physical PCs to get rid of an old OS but as hard as that may be, it is well worth it. In my own experience, the reduction in vulnerabilities just from going to a fully patched version of Windows 7 to a fully patched version of Windows 10 will make a world of difference on your audit scorecards.

Please do you and your organization a favor and move to Windows 10 now. You will be happy you did and it will allow you to sleep better at night.

12
Nov
2019

Robotic Process Automation Goes Open Source

If you have had your eyes and ears open at all for the past year or so, you know the new hotness is Robotic Process Automation (RPA) in enterprise IT. Basically that is a really fancy name for a system that mimics a user’s actions on another system so that a person doesn’t have to do it. Truth be told, there have been scheduling and automation platforms around for a long time that have done a lot of what modern RPA solutions are doing. The biggest difference is that the focus is now more about interacting with a GUI versus just focusing on what could already be done through scripting like moving files around.

This week Robocorp and the Robot Framework have been starting to make a splash within the industry as the first organizations looking to take the RPA movement into the open source space and make it more accessible to organizations that don’t want to buy into a major commercial platform or that want to do something more custom with their current tool set.

As a user of commercial RPA technologies currently, the idea of an open source framework and a company looking to make that more accessible to the masses is very exciting. The cost of current RPA solutions is a significant barrier to entry for many smaller organizations and Robocorp has the chance to increase the user base for RPA significantly by making it more cost effective for these smaller organizations. Just knowing that this is coming in the future makes me want to spin up a virtual machine with the Robot Framework running to start playing around. Then when Robocorp has a product ready, I can be primed to pick up and start using their solution.

After all, as their site says:

If you can document it, you can automate it. Never send a human to do a machine’s job.

https://careers.robocorp.com/

That is music to my programming ears 🙂

11
Nov
2019

Python Overtakes Java

InfoWorld has an article about the Python programming language overtaking Java in terms of popularity on GitHub. 15 years ago I was taking computer science classes primarily focused on Java development and now Java, what was touted as the programming language to end all languages for cross platform application development, has been eclipsed. I’m not particularly sad to see it get knocked down a notch. Java has always been notoriously buggy and full of vulnerabilities. It has been the bane of IT managers worldwide since its inception, causing audit findings because older versions are required to run certain applications, because there are new zero day vulnerabilities, and because vendors’ Java coding practices have been less than optimal. Throw Tomcat into the mix and you have the recipe to be the next Equifax.

Vulnerabilities aside, the news about Java being overtaken in popularity is a reminder to programmers everywhere that they must keep their skills current and not be afraid to learn new things. Yes, I know COBOL and Fortran are still around, but do you really want to be the last dinosaur standing or would you rather be able to evolve and avoid extinction? I would suggest the latter.

11
Nov
2019

Your People Are Your Biggest Threat

The Hacker News has an article posted from November 7th about a rogue TrendMicro employee stealing customer data and selling it to a tech support scammer. This goes to show, once again, that your people are always your biggest threat. Whether they are clicking on malicious links in from that prince who sent them an email or actively stealing data to sell on the black market, they are likely going to do something to cause you serious pain. Many companies don’t know how to combat these threats or are completely oblivious to what their people may be doing. Here are some ideas to help protect your organization:

  1. Invest in training – Train, train, train, and then train your staff again to be vigilant and know how to recognize a malicious email, phone call, or text message before they divulge any information. If they fall for one, deliver on-the-spot training to help them learn from their mistake.
  2. Invest in more than your average anti-virus software – Advanced Persistent Threats (APTs) are the buzzword of the decade. While you don’t need to listen to all the marketing hype, you should have a host based security solution on your PCs and servers that does more than just look for known signatures. It needs to identify unknown threats as well as known threats, block ransomware, stop data being transferred to removable storage, and more.
  3. Adopt a policy of least privilege – Does that receptionist really need local administrative privileges on their PC? Does that staff trainer really need access to the marketing database? I don’t think so. If people don’t need access to data, make sure they can’t get to it.
  4. Classify your data – What is in that random word document on the accounting shared drive? Is it something that shouldn’t leave the building? If it is, make sure you are tagging the document and putting restrictions in place on your firewalls to stop it from leaving. Do this for all of your data and put rules in place to protect it where it is stored.
  5. Invest in Data Loss Prevention (DLP) tools – Make sure data isn’t leaving your organization. Have tools that can observe data movement, alert, and stop it from happening if needed.
  6. Protect your data from and in the Cloud – Invest in Cloud Access Security Brokers (CASBs) if you allow your staff to store data and work in the cloud. You don’t want data stored improperly in services like Slack, Office 365, Dropbox, Gmail, or somewhere else.

There are many other things you could do as well, but I would argue if you have these tools in place and configured properly, you just might avoid ending up like TrendMicro.

10
Nov
2019

The Best Defense is a Good Offense

Krebs on Security has an article published on October 16th from this year (I know I am behind) detailing the attack of a known black market card fraud site BriansClub. What is interesting about this whole hack is that it is not some vigilante group going after the site to save consumers, but rather it is a rival black market operation trying to sabotage the operations of one of their competitors. In essence, this was a business decision made by one of BriansClub’s competitors to try and take them out of business. It’s similar two warring cartels attacking each other until the other doesn’t have the resources or the people to continue operations.

This does beg the question though, why not make offensive operations against these kinds of sites the norm, not the outlier? In the financial services industry we have a number of cybersecurity information sharing organizations, maybe it is time to establish an offensive cyber operations organization that doesn’t just share information about known threats but actively seeks them out and attempts to disrupt illegal operations. Of course there are potential pitfalls with this type of setup. The efforts of this type of group would have to be carefully watched by both the industry and law enforcement to ensure the operations were focused solely against illegal operations in the dark web. The last thing you would want would be to have a group that was supposed to protect consumers decide to go rogue.

Risks aside, it seems like it is time to open up and publicly establish more direct industry operations against these criminal elements. Sharing information will never prevent fraud, these sites have to be shown it isn’t worth operating because they will be taken down before they can ever make any money.

26
Aug
2019

Time To Unplug Your Smart Ovens

The Verge reports that owners of the June smart oven have been experiencing some seriously concerning incidents recently involving the oven’s preheating without their owner’s knowing. This continues to raise questions about just how much control you want to give smart devices over your house and its critical systems. While I am not sure what the true cause of the issue is, it should make everyone re-think connecting so called “smart” devices that can cause serious physical damage if something goes wrong. An oven is a perfect example of this kind of device.

Smart ovens, locks, etc. all sound great until they are hacked, poorly programmed, designed poorly, etc. When your smart device can let a malicious person into your home, cause your food to go bad, burn down your home, track your movements, etc. then it is time to rethink just how smart you want your home to be. I know smart devices are the way of the future, I have many of them myself, but I never hook them up to anything that could physically damage my home. There is too much risk to take given that the health of you and your family are at stake.

I urge anyone considering these devices to evaluate why they are needed and if you can live without them. After all, preheating your oven is great, but not burning down your house is even better.

11
Jun
2019

A Sad Day For Makers Everywhere

TechCrunch reports that three days ago, Maker Media, has been forced to halt all operations due to ongoing financial issues. As a reader of Make Magazine and a father who has actively pushed my young daughters to get involved in STEM activities this is heartbreaking. I know the business model was always going to be very difficult to sustain. There is likely some truth to the comments on the TechCrunch site that point out a business model designed to promote the sharing of ideas is going to inevitably drive people to circumvent the centralized community that Maker Media created.

Still, losing a major proponent of the STEM and maker revolution is a major blow to everyone that believed in Maker Media’s mission. I can only hope that they find a benefactor who can contribute the funds to reopen their operations and keep their mission alive.

08
Apr
2019

Roblox Hits 90 Million Users – Protect Your Child’s Account

TechCrunch reports that the virtual world game Roblox has surpassed 90 million active users. This is a major milestone for the platform that has been marketed primarily through word of mouth among children and their friends. As a parent whose children love to use this platform, this is both impressive and terrifying at the same time. There is significant risk to kids on this platform if the right steps are not taken to secure these kids’ accounts and filter their online experience.

For those of you who find themselves in the same boat as I do, I strongly encourage you to read through Roblox’s parents guide to securing their child’s account. Make sure you enable the parental controls to protect your kids.

Jonathan Cilley

Follow me on Twitter