Networks today are subject to many threats including ransomware, cryptocurrency-miner threats, or state-sponsored hackers.

In line with other security industry pros, Microsoft has confirmed in its 24th annual security intelligence report that ransomware has taken a backseat to pesky cryptocurrency miners. 

But the company also warns that supply-chain attacks are on the rise. These are where an attacker uses a supplier or business partner to spread an infection. 

Past examples include the NotPetya not-ransomware outbreakthat caused over a billion dollars in losses for global firms and the Dofoil BitTorrent attacks. 
    
"Supply-chain attacks are insidious because they take advantage of the trust that users and IT departments place in the software they use," Microsoft warns in the report. 

"The compromised software is often signed and certified by the vendor, and may give no indication that anything is wrong, which makes it significantly more difficult to detect the infection. They can damage the relationship between supply chains and their customers, whether the latter are corporate or home users.

"By poisoning software and undermining delivery or update infrastructures, supply-chain attacks can affect the integrity and security of goods and services that organizations provide."

While attacks are changing and Windows 10 built-in security is improving, the company's advice to customers remains the same. However, there are conflicting data about the best approach to staying secure.  
Microsoft recommends only using software from trusted sources, though this 'security hygiene' measure could be undermined in a supply-chain attack. 

The company also recommends "rapidly applying the latest updates to your operating systems and applications, and immediately deploying critical security updates for OS, browsers, and email."

Deploying patches quickly is generally a good idea. However, Microsoft recently revealed that vulnerabilities in its software are most likely to be exploited as a zero-daybefore the company has even had a chance to release a patch. 

However, its other tips don't present obvious security conflicts.  

"Deploy a secure email gateway that has advanced threat protection capabilities for defending against modern phishing variants," Microsoft warns, adding that businesses should "Enable host anti-malware and network defenses to get near real-time blocking responses from the cloud (if available in your solution)." 

The other important measures organizations should take include implementing access controls, and teaching employees to be suspect of messages that ask them to divulge sensitive information. 

Microsoft also recommends keeping "destruction-resistant backups of your critical systems and data" and using cloud storage services for online backups. 
​
"For data that is on premises, regularly back up important data using the 3-2-1 rule. Keep three backups of your data, on two different storage types, and at least one backup offsite," says Microsoft.

Artificial intelligence has the potential to bring a select set of advanced techniques to the table when it comes to cyber offense, researchers say.

Last week, researchers from Darktracesaid that the current threat landscape is full of everything from opportunistic attacks from teen hackers to advanced, state-sponsored assaults, and in the latter sense, attacks continue to evolve.

However, for each sophisticated attack currently in use, there is the potential for further development through the future use of AI.

Within the report, the cybersecurity firm documented three active threats in the wild which have been detected within the past 12 months. Analysis of these attacks – and a little imagination – has led the team to create scenarios using AI which could one day become reality.

"We expect AI-driven malware to start mimicking behavior that is usually attributed to human operators by leveraging contextualization," said Max Heinemeyer, Director of Threat Hunting at Darktrace. "But we also anticipate the opposite; advanced human attacker groups utilizing AI-driven implants to improve their attacks and enable them to scale better."

Trickbot. The first attack relates to an employee at a law firm who fell victim to a phishing campaign leading to a Trickbot infection.

Trickbot is a financial Trojan which uses the Windows vulnerability EternalBluein order to target banks and other institutions. The malware continues to evolve and is currently equipped with injectors, obfuscation, data-stealing modules, and locking mechanisms.

In this example, Trickbot was able to infect a further 20 devices on the network, leading to a costly clean-up process. Empire Powershell modules were also uncovered which are typically used in remote, keyboard-based infiltration post-infection.

AI's Future Role.Darktrace believes that in the future, malware bolstered through artificial intelligence will be able to self-propagate and use every vulnerability on offer to compromise a network.

"Imagine a worm-style attack, like WannaCry, which, instead of relying on one form of lateral movement (e.g., the EternalBlue exploit), could understand the target environment and choose lateral movement techniques accordingly," the company says.

If chosen vulnerabilities are patched, for example, the malware could then switch to brute-force attacks, keylogging, and other techniques which have proven to be successful in the past in similar target environments.

As the AI could sit, learn, and 'decide' on an attack technique, no traditional command-and-control (C2) servers would be necessary.

AI's Future Role.It is possible that AI could be used to further adapt to its environment. In the same manner, as before, contextualization can be used to blend in, but AI could also be used to mimic trusted system elements, improving stealth.

"Instead of guessing during which times normal business operations are conducted, it will learn it," the report suggests. "Rather than guessing if an environment is using mostly Windows machines or Linux machines, or if Twitter or Instagram would be a better channel, it will be able to gain an understanding of what communication is dominant in the target's network and blend in with it."

Take It Slow. In the final example, Darktrace uncovered malware from a medical technology company. What made the findings special was that data was being stolen at such a slow pace and in tiny packages that it avoided triggering data volume thresholds in security tools.

Multiple connections were made to an external IP address, but each connection contained less than 1MB. Despite the small packets, it did not take long before over 15GB of information was stolen.

By fading into the background of daily network activity, the attackers behind the data breach were able to steal patient names, addresses, and medical histories.

AI's Future Role. AI could not only provide a conduit for incredibly fast attacks but also "low and slow" assaults. It can also be used as a tool to learn what data transfer rates would flag suspicion to security solutions.

Instead of relying on a hard-coded threshold, for example, AI-driven malware would be able to dynamically adapt data theft rates and times to exfiltrate information without detection.
​
"Defensive cyber AI is the only chance to prepare for the next paradigm shift in the threat landscape when AI-driven malware becomes a reality," the company added. "Once the genie is out of the bottle, it cannot be put back in again."

Forget stumbling through a customer-support page – the future of commerce won't be found by surfing the World Wide Web. 

Soon many of the tasks we now do via websites and brand-specific apps will be handled through messaging and voice platforms like iMessage, WhatsApp, and Amazon's Alexa, according to Alex Spinelli, the chief technology officer at LivePerson.

Today, companies like Home Depot, T-Mobile, and Discover manage customer-service chats with LivePerson. Though chat technology is seeing a resurgence thanks to the proliferation of smartphones, LivePerson was founded in 1995 as a web-chat alternative to 1-800 numbers and call centers. 

LivePerson's new vision means no more awkward drop-down menus, no more shopping carts, and definitely no more URLs. 

"Our thesis is that conversation is a more natural way of interacting with brand services," Spinelli said. "It will become the dominant way that people interact in their digital lives."

It may seem like a big leap from the present day, but Spinelli envisions a world five years from now in which there are no websites and very few apps. 

"The whole app catastrophe that lives on your phone is overwhelming," Spinelli said. "On my iPhone, I have 127 apps that need updating. You can't keep up." 

Meanwhile, people will continue to interact with screens. In Spinelli's vision, the e-commerce shopping experience of the future starts when a carousel of items pops up at the bottom of the screen. The shopper browses the carousel, clicks the item they want, and instantly pays through a system like Apple Pay. All of that happens within a chat window. 

And that vision isn't too far off from what's already on the market today. 

Apple and Google are prepared for this future.  Earlier this month, LivePerson announced a new offering called LiveEngage for Voice Assistants, which lets customers start interacting with a brand through a voice assistant like Alexa while hanging out at home and then move that conversation over to chat on a mobile device when they leave the house. 

The big idea behind LiveEngage is that customers can have one continuous conversation across multiple modes of communication – something that dovetails with the bigger vision of LivePerson. 

Spinelli joined LivePerson in March after five years at Amazon — first as director of Amazon Search, and later as global head of Alexa OS, the operating system behind Amazon's famed voice assistant. 

When he learned that both Apple and Google added conversational commerce products directly into their smartphone operating systems, he decided to make the move to LivePerson, where he could embrace the trend head-on. 

Apple Business Chatlaunched in beta mode with select brands last year. It's designed to let customers find brands on iMessage and interact with them using dynamic features that manage everything from scheduling an appointment to making a purchase. 
​
Google's Android has a similar option with its business-focused Rich Communication Services, currently in beta.

It's quickly becoming apparent that blockchain technology is about far more than just Bitcoin. Across finance, healthcare, media, and other sectors, innovative uses are appearing every day.

Here are some examples of blockchain in use today. While some may fail to live up to their promises, others could go on to become household names if blockchain proves itself to be as revolutionary as many are predicting.

Cybersecurity. Guardtime – This company is creating “keyless” signature systems using blockchain which is currently used to secure the health records of one million Estonian citizens.
REMME is a decentralized authentication system which aims to replace logins and passwords with SSL certificates stored on a blockchain.

Healthcare. Gem – This startup is working with the Center for Disease Control to put disease outbreak data onto a blockchain which it says will increase the effectiveness of disaster relief and response.

SimplyVital Health – Has two health-related blockchain products in development, ConnectingCare which tracks the progress of patients after they leave the hospital, and Health Nexus, which aims to provide decentralized blockchain patient records.

MedRec – An MIT project involving blockchain electronic medical records designed to manage authentication, confidentiality and data sharing.

Financial Services. ABRA – A cryptocurrency wallet which uses the Bitcoin blockchain to hold and track balances stored in different currencies.

Barclays – Barclays has launched several blockchain initiatives involving tracking financial transactions, compliance and combating fraud. It states that “Our belief ...is that blockchain is a fundamental part of the new operating system for the planet.”

Maersk – The shipping and transport consortium has unveiled plans for a blockchain solution for streamlining marine insurance.

Aeternity – Allows the creation of smart contracts which become active when network consensus agrees that conditions have been met – allowing for automated payments to be made when parties agree that conditions have been met.

Manufacturing and Industrial. Provenance – This project aims to provide a blockchain-based provenance record of transparency within supply chains.

Hijro, previously known as Fluent, aims to create a blockchain framework for collaborating on prototyping and proof-of-concept.

SKUChain – Another blockchain system for allowing tracking and tracing of goods as they pass through a supply chain.

Blockverify -  A blockchain platform which focuses on anti-counterfeit measures, with initial use cases in the diamond, pharmaceuticals and luxury goods markets.

Transactivgrid – A business-led community project based in Brooklyn allowing members to locally produce and cell energy, with the goal of reducing costs involved in energy distribution.

Charity. Bitgive – This service aims to provide greater transparency to charity donations and clearer links between giving and project outcomes. It is working with established charities including Save The Children, The Water Project and Medic Mobile.

Retail. OpenBazaar is an attempt to build a decentralized market where goods and services can be traded with no middle-man.

Blockpoint.io – Allows retailers to build payment systems around blockchain currencies such as Bitcoin, as well as blockchain derived gift cards and loyalty schemes.
​
Media. Ujomusic – Founded by singer-songwriter Imogen Heap to record and track royalties for musicians, as well as allowing them to create a record of ownership of their work.
It is exciting to see all these developments. Not all of these will make it into successful long-term ventures but if they indicate one thing, it’s that blockchain is presenting a vast potential to many industries.

"The world is rapidly running out of computing capacity", Satya Nadella said at the World Economic Forum in Davos. The head of tech giant Microsoft warned that superfast quantum computers were needed to solve some of the most difficult problems.

Mr. Nadella cited the quest to create a catalyst that can absorb carbon, in order to help tackle climate change.

This, he cautioned, would likely not be achieved without an increase in computer processing power.

"Moore's Law is kinda running out of steam," Mr. Nadella told assembled delegates, referring to the maxim that the power of computer chips doubles every two years.

The Microsoft chief executive also took aim at so-called "re-skilling programs", calling them "one of the greatest wastes of money".

Such schemes, which are designed to retrain those whose professions have been lost to globalization or automation, are often "done without a true understanding of where the labor market is going," Mr. Nadella argued.

Instead, the India-born chief executive, who took over at the helm of Microsoft in 2014, said that reforming school curriculums was of paramount importance.

"We can, with some certainty, say that we will need more people graduating from our schools who will need to be comfortable with these augmented realities," he predicted.

"The fact that most curricula in schools still don't recognize computer science like they do math or physics is just crazy."

Mr. Nadella added: "We need middle school teachers of computer science of the highest quality."
He also emphasized that artificial intelligence, on which Microsoft is increasingly focused, could be a part of the solution to joblessness, rather than merely its cause.

Earlier, Klaus Schwab, the man behind the World Economic Forum, called for leading tech executives to consider the disruption that their products may cause to economic, political and social life.
​
"If we act now," Mr. Schwab said, "we have the opportunity to ensure that technologies - such as artificial intelligence - sustainably and meaningfully improve the lives and prospects of as many people as possible."

Self-driving cars may be getting all the attention, but the significant impact of artificial intelligence and machine learning in the enterprise is in cybersecurity, and especially in securing data center networks. And given all the threats data centers are facing this year the help is much needed.

According to a recent survey of 400 security professionals by Wakefield Research and Webroot, 99% of US respondents believe AI overall could improve their organizations’ cybersecurity. And 87% report their teams are already using AI as part of their cybersecurity strategy. In fact, 74% of cybersecurity professionals in the US believe that within the next three years their companies will not be able to safeguard digital assets without AI.

AI and machine learning are being used to spot never before seen malware, recognize suspicious user behaviors, and detect anomalous network traffic.

According to the survey, 82% of US respondents said AI could spot threats that would otherwise be missed. But finding problems is just the first brick in the defensive wall. Intelligent systems can also detect indicators that pose the biggest threats, suggest actions such as re-imaging servers or isolating network segments, and even carry out remediation actions automatically.

AI can also:
          • Collect and analyze forensic data
          • Scan code and infrastructure for vulnerabilities, potential weaknesses, and configuration errors
          • Make security tools more powerful and easier to use
          • Learn from experience to adapt quickly to changing conditions.

All that has the potential to improve security and user experience dramatically said David Vergara, head of global product marketing at VASCO Data Security, which provides identity and authentication solutions to more than half of the world's top 100 banks and financial institutions.

Human Security Pros Overwhelmed by Data. There is hype around AI in data centers, Vergara said, but it’s based on real benefits. "It is centered on compelling use cases, ranging from improved situational awareness via trend analyses that drive recommended actions to predicting failures and spotting intrusions through anomalous pattern detection."

One of the biggest strengths of AI and machine learning is its ability to handle large volumes of data very quickly.

"The number of physical and virtual assets in the data center continues to grow," said Manoj Asnani, VP of product and design at Balbix. "Without AI, it is not possible for enterprises to be prepared for continuously evolving attack surfaces."

Humans cannot handle all the information fast enough or react with enough speed to address the risks, he said.

Take, for example, manually changing firewall rules when things change in a data center, said Josh Mayfield, director at cybersecurity vendor FireMon. With virtual machines, micro-segmentation, and on-demand computing, a data center's configuration can shift faster than humans can keep up.

"The Machine Learning and Artificial Intelligence capabilities do this on our behalf," he said. "They recognize compliance drifting in the data center, then adjust and write a new firewall rule to pull it back. They pick up a new application that needs to be secured under a set of conditions and automatically write the firewall rule needed to fortify the new app. Something moves from one data center to another – or within the same data center – [and] they write the new firewall rule."

Measuring Server Heat to Spot Trouble. Intelligent systems can also spot behaviors that are too subtle for humans, said Terry Ray, chief product strategist at cybersecurity vendor Imperva.

For example, AI and machine learning can be used to model hardware temperatures and compare them to typical activities or compare individual users' access times to their peers to spot suspicious anomalies.

The largest and most forward-looking companies will invest heavily in AI expertise to get an AI-powered advantage. But even smaller data center operators will benefit because most, if not all, of the top cybersecurity vendors, are adding AI to their products.

"If vendors have not yet adopted some form of machine learning into their offerings, they’re likely behind the curve of their peers," said Ray.
​
This is resulting in a rapid spread of embedded AI and machine learning in security technologies used by data centers. "The IT application of AI and machine learning is growing at a much faster rate than what we have seen previously," Ray said.

Office workers want their workplace to be flexible, adaptable and free from processes and systems that slow down productivity. But what do they expect for the future of the workplace?

In 2017, enterprise work and project management company Workfront surveyed of over 2000 workers across US companies to determine what the US office will look like in five years’ time.

It wanted to capture how workers felt about the challenges of today and the potential challenges of the future workplace.

Legacy Systems. Antiquated systems such as email get heavily criticized in the report. Over the past few years, poorly used meetings and email topped the list of things that prevent productivity amongst knowledge workers.

US workers say they have an average of 199 unopened emails in their inboxes at any given time. Of the 68 emails received per day by the average knowledge worker, 21 are junk mails, and only 27 demand some answer or action.

Email, although useful, seems to create issues. It is accused of stealing workers' time and preventing them from finding critical project information. For the majority of knowledge workers, the inability to convey or find essential information in email is a significant problem according to the report.

These tools and practices are supposed to improve worker productivity and collaboration. Unfortunately, wasteful meetings and excessive emails top the list of productivity killers, with 15% of the working day spent dealing with email.

20% of respondents answered that email would no longer be used as a primary collaboration tool in the future and 31% believe that collaboration software will eliminate most conference calls. A further 28% think that printers will become obsolete because everything will be available digitally.

The Casual Workplace. Workers are convinced that the way we work will change dramatically over the next five years. Almost half of the respondents (49%) believe that dress codes will become more relaxed and over a quarter (28%) feel certain that fixed desk space will become a thing of the past.

The New World of Work. So, what will the office of the next few years look like? Although 42% of workers do not have the opportunity to work from home, the average worker works from home one day per week.

Almost two-thirds of respondents (61%) said that video conference calls would enable remote working and half think that mobile phones will become the mobile office.

One in ten will not adopt flexible working due to negative perceptions. Almost a third (31%) believe that social media will become a significant work tool.
​
Although knowledge workers are optimistic about the future, they felt that technology will release employees to work wherever and whenever they want to. The challenge for enterprises is to find the systems and technology to make this a cost-effective reality.

Robots are taking our jobs, no doubt about it. Just in the past year, we’ve seen barista robots, fast-food robots, and even pizza delivery robots. But robots can’t replace journalists, right? The dogged reporters, members of the vaunted Fourth Estate, the men and women who bring us the news stories we read every day?

Think again. It’s happening, and the odds are that you’ve been reading stories created by artificial intelligence in local and world news already.

A year ago, the Washington Post introduced Heliograf, an in-house program that automatically generates short reports for their live blog. It was first used during the Rio Olympics to provide information such as the results of medal events for services like Alexa. At that time Sam Han, engineering director of data science, said, “The next challenge is to broaden the subjects covered, deepen the kind of analysis possible and identify potential stories for our newsroom.”

It looks like that day has arrived. Over the past year, the Post has published 850 stories from Heliograf, expanding its reach to include reporting on subjects like congressional races and high-school football games.
Other outlets like the Associated Press have also begun to rely on automated software to create content for readers. Executives are quick to point out that the AI is not meant to replace reporters, but instead allow them extra time to develop and relate more important and relevant stories. “Heliograf will free up Post reporters and editors to add analysis, color from the scene and real insight to stories in ways only they can,” said Jeremy Gilbert, director of strategic initiatives at the Post.

Not to mention the fact that machines don’t make typos and provide more accurate reporting. As Francesco Marconi, AP’s strategy manager put it, “In the case of automated financial news coverage by AP, the error rate in the copy decreased even as the volume of the output increased more than tenfold.”
​
What robotics means for the future of reporting is an open question. Many of today’s biggest names in journalism got their start covering local news or high school sports. In the end, it all comes down to ad revenue. Although the Post can appraise the clicks and pageviews Heliograf generates, evaluating how much it impacts the bottom line is a more difficult task. In any event, it seems like reporters and robots will be working side-by-side for the foreseeable future.

This year, I have covered Blockchain technology with four different articles (Issues 3-17, 3-24, 3-25, 3-31). Blockchain's claim to fame is its ability to fully encrypt personal data on the internet, allowing for the digital translation of assets and the elimination of need for a protective middle man. Essentially, this new crypto-technology enables secure-funds transactions and ensures that data cannot be hacked by outsiders.

Epstein explained that blockchain is a "distributed ledger." It's not a database sitting in an office. It's a database that everyone can access.

"We're seeing decentralization and a paradigm shift of moving from institutions to ourselves. Power has been given back to the business owners, who no longer need to rely on the permission of banks and governments to send money electronically," says blockchain expert Jeremy Epstein.

When you use a bank as an intermediary to transfer funds to another person by check, each person involved in the transaction has a separate record. The bank doesn't know right away that the person writing the check has a balance to cover the amount written out--there is an element of trust, and things can go wrong.
"We've been built to have other organizations be custodians of our assets (like banks). However, there have been more and more violations of our data,” Epstein added.

Conversely, Blockchain allows for privacy in the combination of records and the elimination of any intermediaries. Both parties can view the encrypted ledger and see any mutual transactions, but no one party controls it. Rather, each transaction is a block that is added to a chain once all parties affirm the block is correct. The chain itself is protected by cryptography.

"With blockchain, everyone can clearly see who the owner of the asset is, but only the person with the right key can unlock the door of that asset.

Think about the title of the asset - it would be in your control. This is why people buy title insurance. Blockchain lets us buy and sell any asset without an intermediary. Additionally, the asset is programmable, so you can set up business rules and computational logic for each asset. For instance, you could put in place a rule that states, 'I can't sell this without others signing off.' Thus, the asset cannot be not sold unless business rules are met."

According to Harvard research, Blockchain also maximizes transparency and anonymity. Each transaction is seen by anyone who has access to the chain; however, since each node (or user) has a unique alphanumeric identifier, each user can decide whether to remain anonymous in the transaction between addresses. These transactions can also be programmed with algorithms that can automate transactions between users.

So, if blockchain is so good, why hasn’t it caught on yet? There are four reasons to that question.

• Trust Issues. Epstein emphasized the issue of believability and gaining trust of users. He said, "How will people get their head around this technology? Building trust and credibility will take time.
• Stigma. Harvard found that some industries may view blockchain as "disruptive" because it "can attach a traditional business model with a lower-cost solution and overtake incumbent firms quickly." However, they argue that blockchain is most importantly a foundational technology that can be used to create new business models and underpin business, economic, and social infrastructure.
• Novelty. It will take decades for blockchain to seep into our economic and social infrastructure. The process of adoption will be gradual and steady. Epstein agrees, saying that, "it is still very, very early. Think Internet circa 1993."
• Adoption. Epstein indicates that the financial services industry has implemented blockchain technology more than any other. They're looking to improve efficiencies with cross-border transactions. Bitcoin is the most well-known blockchain application.
  

Essentially, "Email is to the internet the way bitcoin is to blockchain. There are multiple apps, just like there are multiple blockchains," says Epstein.

Blockchain is still in its early stages, and new crypto-technology applications and advancements are regularly occurring. We expect big changes over the next few years, as over $1 billion has been invested into this tech by venture capitalists.

A new kind of attack is targeting unsecured Internet of Things devices by scrambling their software and rendering them useless.

Security firm Radware first spotted the newly-found "BrickerBot" malware last month after it started hitting its own devices, logging hundreds of infection attempts over a few days. When the malware connects to a device with their default usernames and passwords – often easily found on the internet – the malware corrupts the device's storage, leading to a state of permanent denial-of-service (PDoS) attack, known as "bricking."

In other words, this attack, "damages a system so badly that it requires replacement or reinstallation of hardware," said Radware.

Like the Mirai botnet, most famous for bringing down wide swathes of the US internet last year in a massive distributed denial-of-service (DDoS) attack, the BrickerBot also uses "the same exploit vector" by brute-forcing telnet accounts with lists of available usernames and passwords.

The researchers say that the attackers also have an affinity for targeting devices on Ubiquiti networks. Once inside, the malware runs a sequence of commands, which "try to remove the default gateway and disable TCP timestamps as well as limiting the max number of kernel threads to one," which would scramble the device's memory.
​
"Unfortunately, even after performing the factory reset, the camera device was not recovered and hence it was effectively bricked," said Radware.