Page 2,641«..1020..2,6402,6412,6422,643..2,6502,660..»

A DNS outage just took down a large chunk of the internet – TechCrunch

A large chunk of the internet dropped offline on Thursday. Some of the most popular sites, apps and services on the internet were down, including UPS and FedEx (which have since come back online), Airbnb, Fidelity, and others are reporting Steam, LastPass, and the PlayStation Network are all experiencing downtime.

Many other websites around the world are also affected, including media outlets in Europe.

What appears to be the cause is an outage at Akamai, an internet security giant that provides networking and content delivery services to companies. At around 11 a.m. ET, Akamai reported an issue with its Edge DNS, a service thats designed to keep websites, apps and services running smoothly and securely.

DNS services are critically important to how the internet works, but are known to have bugs and can be easily manipulated by malicious actors. Companies like Akamai have built their own DNS services that are meant to solve some of these problems for their customers. But when things go wrong or theres an outage, it can cause a knock-on effect to all of the customer websites and services that rely on it.

Akamai said it was actively investigating the issue, but when reached a spokesperson would not say if its outage was the cause of the disruption to other sites and services that are currently offline. A spokesperson for ThousandEyes, an internet monitoring company bought by Cisco in 2020, attributed the outage to Akamai.

Akamai would not say what caused the issue but that it was already in recovery.

We have implemented a fix for this issue, and based on current observations, the service is resuming normal operations. We will continue to monitor to ensure that the impact has been fully mitigated, Akamai told TechCrunch.

In a follow-up tweet, the company said it was not a result of a cyberattack.

Its not the first time weve seen an outage this big. Last year Cloudflare, which also provides networking services to companies around the world, had a similar outage following a bug that caused major sites to stop loading, including Shopify, Discord and Politico. In November, Amazons cloud service also stumbled, which prevented it from updating its own status page during the incident. Online workspace startup Notion also had a high-profile outage this year, forcing the company to turn to Twitter to ask for help.

Read more here:
A DNS outage just took down a large chunk of the internet - TechCrunch

Read More..

Meet the UAB students training to stop ransomware and other digital threats – UAB News

UABs cybersecurity masters program is preparing a new workforce for a booming field with ever-increasing demand and a shortage of skills. The program has a unique focus on both cyber defense and cyber investigations.

Lindsey Sandlin Photo by: Andrea MabryJust weeks before Colonial Pipeline was devastated by the most high-profile infrastructure cyberattack in United States history in May, the company posted an ad on LinkedIn for Manager, Cyber Security. Colonial was searching for a masters-trained professional who could create and maintain an incident response plan and processes to address potential threats, according to Bloomberg News.

Colonials position, like many others in the hot cybersecurity job market, went unfilled, resulting in a catastrophic shutdown, global headlines and long lines at pumps across the eastern United States.

The stakes are not always this high; but according to the 2021 State of the CIO survey from the publication CIO, cybersecurity jobs are the most challenging IT jobs to fill right now, surpassing AI/machine learning and data science/analytics. The U.S. Bureau of Labor Statistics projects that jobs in the information security analyst category will grow 31 percent (adding more than 40,000 jobs) by 2029, much faster than the average. The pay is attractive as well; the median salary in 2020 was $103,590 per year.

All of this is not news to Nitesh Saxena, Ph.D., professor in the Department of Computer Science and co-director of the Master of Science in Cyber-Security program at the University of Alabama at Birmingham, a joint program of the computer science department and the Department of Criminal Justice.

This is a very popular area with ever-increasing demand and a shortage of skilled applicants, Saxena said. Most of our students go straight into jobs in industry with private companies and government organizations.

Ransomware is clearly an important threat, Saxena said. But our program actually focuses on much broader issues. Our goal is for our students to have holistic experience in cyberattack prevention, detection, forensics and recovery. We graduate lifelong learners who can adapt to address the new challenges that will always appear in this ever-changing area.

Despite the soaring media coverage, ransomware is one of the lower entries on the FBIs 2020 Internet Crime Report. Business Email Compromise, the leading category, totaled $1.8 billion in reported losses in 2020. (Ransomware totaled just over $29 million, although the FBI notes that this number does not include estimate of lost business, time, wages, files or equipment.) More than 30 separate categories of attack are detailed in the Internet Crime Report, from confidence fraud and identity theft to credit card fraud, extortion and corporate data breaches. Overall, internet crime complaints rose 70 percent in 2020 over 2019, with reported losses exceeding $4.2 billion.

Graduates of UABs masters program are trained to make an impact on these staggering figures. One key differentiating factor of UABs program is that it is run jointly with the criminal justice department, Saxena said. It has a typical Cyber Defense track, but also a Cyber Crime Investigations track, which is unique across the entire nation and worldwide.

The Cyber Crime Investigations track enables students to move beyond simply responding to an attack and into determining where it came from and who was behind it, says Jeffery Walker, Ph.D., professor and chair of the Department of Criminal Justice and co-director of the Cyber-Security masters program. This can aid in stopping the attackers before they strike again. Students in the program also have the opportunity to work in the Computer Forensic Research lab at UAB, Walker said: Here they work directly on large-scale cybersecurity projects for financial institutions, corporations and the federal government. This gives them an added advantage when they graduate because they have real-world experience.

Students in the program also have the opportunity to work in the Computer Forensic Research lab at UAB: Here they work directly on large-scale cybersecurity projects for financial institutions, corporations and the federal government. This gives them an added advantage when they graduate because they have real-world experience.

The Cyber Crime Investigations track was particularly appealing to current student Lindsey Sandlin, who has an undergraduate degree in criminal justice with a minor in cyber criminology. The masters program at UAB is ideal for a student like me who wants a combination of both specialties, she said. Sandlin has taken a special interest in digital forensics courses that have trained her in everything from investigating email spam to learning how to examine encrypted phones.

Sandlin also was attracted by UABs designation as a site for the National Science Foundation Cybercorps Scholarship for Service program, which offers stipends of $34,000 per year, covers expenses including education-related fees, professional development and books, and even includes a health insurance reimbursement allowance. In return, students complete an internship with a federal, state, local or tribal government organization in a position related to cybersecurity and work in such an organization after graduation for a period equal to the length of their scholarship.

The NSF pays scholarships for bright students to pursue degrees in cybersecurity, and these students then work for the government in cybersecurity fields, Saxena said. It is a win-win for both students and the government.

Sandlin has already received a job offer and will be moving to Washington, D.C., after graduation in August 2021. I plan on continuing employment within the government working in digital forensics for the long term, she said.

Payton Walker, who earned his masters degree at UAB in 2019, is now pursuing a doctoral degree with Saxena as his mentor. When I started reading about the cybersecurity field, I immediately became interested, Walker said. The idea of working to improve national security was very appealing.

Walker researched UABs masters program and thought it was a good fit. He also was intrigued by the studies going on in Saxenas SPIES (Security and Privacy in Emerging computing and networking Systems) research group. They were working on some very interesting projects that sparked my curiosity about conducting research, including an analysis of how smartphone motion sensors can be used to eavesdrop on private conversations, Walker said. I was able to shadow and work under the lead student on this project, Abhishek Anand, and later expanded on this research area for my Ph.D. work.

Walker, like Sandlin, has earned an NSF CyberCorps scholarship. I chose to pursue a Ph.D. mainly for additional training for the workforce, he said. I would like to work for a federal agency or federally funded research center as a research scientist. Walkers one-year work commitment is deferred while he is finishing his doctorate, but afterward I will be expected to work for a federal agency or other institute that is federally funded, he said. But this is exactly what he wanted, Walker explains. I am most interested in working for the federal government and conducting research to aid national security, he said. Ideally, I would like to work for a federal agency like the Department of Energy in one of their cybersecurity research laboratories and participate in the cutting-edge research that they do.

Walker already has considerable experience in groundbreaking cybersecurity investigations and is a co-author on four publications so far thanks to his work with the SPIES lab. My research focuses on side-channel speech attacks in the vibration domain as well as speech attacks against modern voice-controllable Internet of Things systems, such as smart speakers from companies such as Google and Amazon, he said.

Our students get the chance to contribute to research that is pushing the boundaries of cybersecurity, and they present their work at major conferences and meetings, Saxena said. This is invaluable experience, no matter where they choose to work, whether in industry or in government.

Read more from the original source:
Meet the UAB students training to stop ransomware and other digital threats - UAB News

Read More..

Connecticut pushes cybersecurity with offers of punitive damage protection – GCN.com

Connecticut pushes cybersecurity with offers of punitive damage protection

Connecticut Gov. Ned Lamontsigned a bill designed to encourage businesses in the state to beef up their cybersecurity.

An Act Incentivizing the Adoption of Cybersecurity Standards for Businesses will protect businesses from punitive damages resulting from a breach of personal data if they have adopted and adhere to industry-standard cybersecurity measures.

The new law requires businesses to secure individuals names, Social Security numbers, taxpayer ID numbers, driver's license numbers or other government identifiers; financial account numbers and passwords; medical or health insurance information; biometric information; and names or email address that are used in combination with a password or security to access online accounts.

To be exempt from damages, an organization must conform to the current version of any recognized security framework such as the National Institute of Standards and Technologys Framework for Improving Critical Infrastructure Cybersecurity; Special Publications 800-171, 800-53 and 800-53a; the Federal Risk and Authorization Management Program's FedRAMP Security Assessment Framework; the Center for Internet Security's Critical Security Controls for Effective Cyber Defense; or the ISO/IEC 27000 series.

Organizations already regulated by the state or federal government must keep their compliance with the Health Insurance Portability and Accountability Act, the Federal Information Security Modernization Act and the Health Information Technology for Economic and Clinical Health Act in order to avoid paying punitive damages.

Businesses must also comply with the current version of the Payment Card Industry Data Security Standard.

When any of the relied-upon cybersecurity standards are updated, businesses have six months to comply.

The legislation is the latest of Connecticuts efforts to better secure its assets. Earlier this year, Lamontannouncedthe centralization of state IT resources and named Jeff Brown as the states first chief information security officer.

Across the globe, cybersecurity risks continue to rise,Brown said. Connecticut is investing in cybersecurity and technology in new ways to protect our residents and businesses. We are bringing our statewide information technology team together into one, collaborative organization that will help us identify and deter cybersecurity incidents faster, bring everyone onto streamlined platforms, and ultimately protect more private information.

The measure goes into effect on Oct. 1, 2021.

About the Author

Connect with the GCN staff on Twitter @GCNtech.

The rest is here:
Connecticut pushes cybersecurity with offers of punitive damage protection - GCN.com

Read More..

DesignRush Reveals the Best Technology Experts to Hire in 2021 [Q2 Rankings] – Yahoo Finance

DesignRush issued the second quarterly list of top technology companies specialized in various fields ranging from software development, internet security and artificial intelligence, among others.

NEW YORK, July 23, 2021 /PRNewswire-PRWeb/ -- Experts predict that there will be 75 billion interconnected devices worldwide by 2025. From productivity to entertainment, software and hardware solutions are evolving to support the growing market needs and demand.

Whether looking to build custom solutions or leverage a portfolio of commercial software, businesses need reliable technology partners.

DesignRush, a B2B marketplace that connects brands with agencies, has released the second quarterly (Q2) list of the top technology experts to hire. The list features experts in:

The top technology expert companies in Q2, according to DesignRush's Q2 list, are:

Apiumhub - apiumhub.com

Archer Software - archer-soft.co

BiharApps - biharapps.com

CodeStringers - codestringers.com

Codete - codete.com

CrustLab - crustlab.com

Daxx - daxx.com

Digilite - digilite.ca

Digimid - digimid.com

Digital Skynet - digitalskynet.com

Dividato - sf.dividato.com

EDISON Software Development Centre - edsd.com

Emergent Software - emergentsoftware.net

Emorphis Technologies - emorphis.com

Enlab Software - enlabsoftware.com

Exposit - exposit.com

fram^ - wearefram.com

4ire Labs - 4irelabs.com

iFour Technolab Pvt Ltd - ifourtechnolab.com

ISHIR - ishir.com

KindGeek - kindgeek.com

Leobit - leobit.com

mindworks GmbH - mindworks.de

Moblers - moblers.com

Noltic - noltic.com

Onex Software - onexyazilim.com

PanonIT - panonit.com

Prompt Softech - promptsoftech.com

Semaphore Mobile - semaphoremobile.com

SF AppWorks - sfappworks.com

Smazee - smazee.com

Spire Digital - spiredigital.com

Sunrise Software Solutions Corporation - s3corp.com.vn

Synebo - synebo.io

System Logic Solution - systemlogicsolution.com

The Custom Packaging - thecustompackaging.com

The Gnar Company - thegnar.co

Unmetered Technologies - unmeteredtechnologies.com

WaveAccess - wave-access.com

Webspaceteam - webspaceteam.com

Wirefox Design Agency - wirefox.co.uk

Zesium - zesium.com

Zfort Group - zfort.com

Brands can explore the top technology companies by location, size, average hourly rate and portfolio on DesignRush.

Story continues

About DesignRush:

DesignRush.com is a B2B marketplace connecting brands with agencies. DesignRush features the top agencies around the world, including the best Digital Agencies, Logo Design, Branding, Digital Marketing, Website Design, eCommerce Web Design Companies, and more.

Media Contact

Srdjan Rokvic, DesignRush, 8008565417, srdjan@designrush.com

Twitter

SOURCE DesignRush

View original post here:
DesignRush Reveals the Best Technology Experts to Hire in 2021 [Q2 Rankings] - Yahoo Finance

Read More..

Avast and RiskIQ announce threat intelligence partnership – ChannelLife Australia

Digital security and privacy company Avast, and RiskIQ, an internet security intelligence company, have announced a threat intelligence partnership. Under the agreement, the companies will use their specific areas of expertise to develop combined threat intelligence for their customer bases to enhance security practices.

At Avast, we recognise that no one provider can see the whole picture, says Avast senior VP, partner business, Nick Viney.

Thats why we partner broadly to improve the threat intelligence available to companies and also to improve our ability to protect our customers. Our global threat intelligence will contribute to RiskIQs understanding of the worldwide threat landscape.

"Avast will leverage RiskIQs intelligence to enrich our data and further scale our threat hunting and response capabilities for companies and consumers alike," he adds.

Avasts threat intelligence platform covers hundreds of millions of endpoints from internet threats, powered by threat intelligence from Avasts global network, one of the worlds largest and most geographically diverse threat detection networks. Avast says advanced analytics enable insight into thousands of malware families, including how they are detectable before customers are impacted, and how those threats evolve as bad actors attempt to evade detection.

RiskIQ aggregates and collects data and intelligence from the whole internet to identify threats and attacker infrastructure, and leverages machine learning to scale threat hunting and incident response. Its Illuminate Internet Intelligence Platform provides content on attackers, including their tools and systems, and indicators of compromise across the global attack surface.

RiskIQ and Avast share a mission to protect people and businesses on the internet, and as partners, we can both be more effective, says RiskIQ CEO, Lou Manousos.

Avast helps us enrich our understanding of the global threat landscape, and we welcome them to our Interlock Partner Program. RiskIQs Interlock Partner Program is a next-generation program supporting deep, bi-directional integrations that meaningfully advance the capabilities and value for customers and both solutions.

It enables members to rapidly deploy RiskIQ attack surface visibility and internet security intelligence across their enterprise security ecosystem (or infrastructure) for automated and informed threat detection, investigations, and prevention, he says.

Avast has 435 million online users and offers products under Avast and AVG to protect from threats on the internet and the evolving IoT threat landscape. While RiskIQ specialises in digital attack surface management, discovery, intelligence, and mitigation of threats associated with an organisations digital presence. Based in San Francisco, the company is backed by Summit Partners, Battery Ventures, Georgian Partners, NationalGrid Partners, and MassMutual Ventures.

Read the original post:
Avast and RiskIQ announce threat intelligence partnership - ChannelLife Australia

Read More..

Internet of Things in desperate need of more robust identity and access management – SecurityBrief Asia

The future of identity and access management in the Internet of Things will escape the confines of user-focused identity and transition toward a more inclusive model, according to a new analysis research report by ABI Research.

The new multi-faced approach will include machine and system identity along with IoT device and platform management operations.

"IAM is yet another identity and security framework that poses significant challenges when crossing from the IT realm onto the IoT," says Dimitrios Pavlakis, senior cyber security and IoT analyst at ABI Research.

"Most cloud providers regard IAM as a purely user-focused term while other IoT device management and platform providers make references to IAM in device access control," he says.

"IAM in traditional IT environment is used to streamline user digital identities and to enhance the security of user-facing front-end operations using a variety of management tools, privilege management software and automated workflows to create a user-focused authorisation framework."

Pavlakis says the explosion of IoT technologies has significantly increased the sheer volume and complexity or interconnected devices, users, systems, and platforms making traditional IT IAM insufficient, if not problematic in some cases.

"Insufficient access control options, legacy infrastructure and proprietary protocol dependencies, traditionally closed networks, the fervent increase in digitisation, albeit with lackluster security operations, are some of the most prominent challenges for IAM in IoT," he explains.

"Regardless of which IAM terminology is used, these challenges along with the highly complex IoT identity value chain point toward a more competent model of IAM, which touches upon various technologies and security protocols to be considered under the IAM umbrella including: user privilege management and on-prem access control, edge-to-cloud integration, cloud directory-as-a-service, system and machine ID, data security and governance, API management, IoT device identity, authentication and access control."

Pavlakis says the justifiable lack of a unified IoT security standardisation framework, the fact that organisations are always on a reactive approach versus proactive, the emergence of the new cyber-threat horizon and ever-present budget restrictions also forces implementers to create an approximation of IAM protocols by examining IoT applications on a case by case basis.

"No matter how you slice it, IAM in Industrial IoT obviously ought to be significantly different than IAM protocols in finance settings and further blurs the lines between access control for system, machine and user ID," he says.

Prominent IT IAM vendors include Cisco, IBM, Microsoft, Oracle, RSA, ForgeRock, Giesecke and Devrient, Ping Identity, Idaptive, Micro Focus, Okta and Ubisecure while new vendor categories under the IoT IAM umbrella can include telcos, IoT device, gateway management or platform providers including Entrust, Globalsign, Pelion, Sierra Wireless, Cradlepoint, Kerlink, and Advantech.

See the article here:
Internet of Things in desperate need of more robust identity and access management - SecurityBrief Asia

Read More..

Serial Swatter Who Caused Death Gets Five Years in Prison Krebs on Security – Krebs on Security

A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that led to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today.

60-year-old Mark Herring died of a heart attack after police surrounded his home in response to a swatting attack.

Shane Sonderman, of Lauderdale County, Tenn. admitted to conspiring with a group of criminals thats been swatting and harassing people for months in a bid to coerce targets into giving up their valuable Twitter and Instagram usernames.

At Sondermans sentencing hearing today, prosecutors told the court the defendant and his co-conspirators would text and call targets and their families, posting their personal information online and sending them pizzas and other deliveries of food as a harassment technique.

Other victims of the group told prosecutors their tormentors further harassed them by making false reports of child abuse to social services local to the targets area, and false reports in the targets name to local suicide prevention hotlines.

Eventually, when subjects of their harassment refused to sell or give up their Twitter and Instagram usernames, Sonderman and others would swat their targets or make a false report to authorities in the targets name with the intention of sending a heavily armed police response to that persons address.

For weeks throughout March and April 2020, 60-year-old Mark Herring of Bethpage, Tenn. was inundated with text messages asking him to give up his @Tennessee Twitter handle. When he ignored the requests, Sonderman and his buddies began having food delivered to Herrings home via cash on delivery.

At one point, Sonderman posted Herrings home address in a Discord chat room used by the group, and a minor in the United Kingdom quickly followed up by directing a swatting attack on Herrings home.

Ann Billings was dating Mr. Herring and was present when the police surrounded his home. She recalled for the Tennessee court today how her friend died shortly thereafter of a heart attack.

Billings said she first learned of the swatting when a neighbor called and asked why the street was lined with police cars. When Mr. Herring stepped out on the back porch to investigate, police told him to put his hands up and to come to the street.

Unable to disengage a lock on his back fence, Herring was instructed to somehow climb over the fence with his hands up.

He was starting to get more upset, Billings recalled. He said, Im a 60-year-old fat man and I cant do that.'

Billings said Mr. Herring then offered to crawl under a gap in the fence, but when he did so and stood up, he collapsed of a heart attack. Herring died at a nearby hospital soon after.

Mary Frances Herring, who was married to Mr. Herring for 28 years, said her late husband was something of a computer whiz in his early years who securedthe @Tennessee Twitter handle shortly after Twitter came online. Internet archivist Jason Scott says Herring was the creator of the successful software products Sparkware and QWIKMail; Scott has 2 hours worth of interviews with Herring from 20 years ago here.

Perhaps the most poignant testimony today came when Ms. Herring said her husband who was killed by people who wanted to steal his account had a habit of registering new Instagram usernames as presents for friends and family members whod just had children.

If someone was having a baby, he would ask them, What are your naming the baby?, Ms. Herring said. And he would get them that Instagram name and give it to them as a gift.

Valerie Dozono also was an early adopter of Instagram, securing the two-letter username VD for her initials. When Dozono ignored multiple unsolicited offers to buy the account, she and many family and friends started getting unrequested pizza deliveries at all hours.

When Dozono continued to ignore her tormentors, Sonderman and others targeted her with a SIM-swapping attack, a scheme in which fraudsters trick or bribe employees at wireless phone companies into redirecting the targets text messages and phone calls to a device they control. From there, the attackers can reset the password for any online account that allows password resets via SMS.

But it wasnt the subsequent bomb threat that Sonderman and friends called in to her home that bothered Dozono most. It was the home invasion that was ordered at her address using strangers on social media.

Dozono said Sonderman created an account on Grindr the location-based social networking and dating app for gay, bi, trans and queer people and set up a rendezvous at her address with an unsuspecting Grindr user who was instructed to waltz into her home as if he was invited.

This gentleman was sent to my home thinking someone was there, and he was given instructions to walk into my home, Dozono said.

The court heard from multiple other victims targeted by Sonderman and friends over a two-year period. Including Shane Glass, who started getting harassed in 2019 over his @Shane Instagram handle. Glass told the court that endless pizza deliveries, as well as SIM swapping and swatting attacks left him paranoid for months that his assailant could be someone stalking him nearby.

Judge Mark Norris said Sondermans agreement to plead to one count of extortion by threat of serious injury or damage carries with it a recommended sentence of 27 to 33 months in prison. However, the judge said other actions by the defendant warranted up to 60 months (5 years) in prison.

Sonderman might have been eligible to knock a few months off his sentence had he cooperated with investigators and refrained from committing further crimes while out on bond.

But prosecutors said that shortly after his release, Sonderman went right back to doing what he was doing when he got caught. Investigators who subpoenaed his online communications found hed logged into the Instagram account FreeTheSoldiers, which was known to have been used by the group to harass people for their social media handles.

Sonderman was promptly re-arrested for violating the terms of his release, and prosecutors played for the court today a recording of a phone call Sonderman made from jail in which he brags to a female acquaintance that he wiped his mobile phone two days before investigators served another search warrant on his home.

Sonderman himself read a lengthy statement in which he apologized for his actions, blaming his addiction on several psychiatric conditions including bipolar disorder. While his recitation was initially monotone and practically devoid of emotion, Sonderman eventually broke down in tears that made the rest of his statement difficult to hear over the phone-based conference system the court made available to reporters.

The bipolar diagnoses was confirmed by his mother, who sobbed as she simultaneously begged the court for mercy while saying her son didnt deserve any.

Judge Norris said he was giving Sonderman the maximum sentenced allowed by law under the statute 60 months in prison followed by three years of supervised release, but implied that his sentence would be far harsher if the law permitted.

Although it may seem inadequate, the law is the law, Norris said. The harm it caused, the death and destruction.its almost unspeakable. This is not like cases we frequently have that involve guns and carjacking and drugs. This is a whole different level of insidious criminal behavior here.

Sondermans sentence pales in comparison to the 20-year prison time handed down in 2019 to serial swatter Tyler Barriss, a California man who admitted making a phony emergency call to police in late 2017 that led to the shooting death of an innocent Kansas resident.

Go here to read the rest:
Serial Swatter Who Caused Death Gets Five Years in Prison Krebs on Security - Krebs on Security

Read More..

Why the Bank of England has its head in the cloud over data security – The Guardian

The Bank of England is at risk of moving too slow, according to experts, who say it needs to get a grip on the financial sectors plans to outsource customer data storage to a handful of unregulated US tech giants.

Last week, the central bank raised fresh concerns about the use of cloud services, where data is held on remote servers run by another company. It said the fact the services were dominated by just a few companies such as Google, Amazon and Microsoft posed a potential threat to financial stability.

Cloud service providers are an increasingly integral part of the infrastructure of the financial system, the Bank governor, Andrew Bailey, said. And there are many good reasons for that: its a model that works.

But the fact that a growing list of financial firms rely on just three tech companies to run their day-to-day services has increased the risk that multiple banks could be affected by cybersecurity risks, hacking and outages aimed at a single provider. Their dominance also means they can dictate the prices and terms of their services, and potentially withhold key information about risks from clients and regulators.

We dont want people publishing how this thing works in great detail so that hackers have a guidebook, so we have to balance that, the governor explained. But as regulators we have to get more assurance that they are meeting the levels of resilience that we need.

The regulator is now trying to secure those assurances before it has its own cloud-based data breach to deal with. The big problem here is technology is moving faster than regulators, said Sarah Kocianski, the head of research at the fintech consultancy 11:FS.

Like most companies, banks have been using cloud services for day-to-day operations such as email, admin and HR for years. Their use has since expanded to run chat bots and fraud detection programmes that can flag up irregular spending automatically.

But the rapid digitalisation of banking services, which has pushed more people towards apps and online banking and away from their local branches, has meant major banks including Lloyds, NatWest, HSBC and Barclays are planning to shift core customer-related data to cloud services run by the worlds largest tech giants if they havent already.

HSBC, which already had agreements with Google and Microsoft, announced last June it had struck a multi-year deal with Amazon Web Services to help run new services for its wealth and personal banking business a division that serves millions of customers worldwide as part of its digital transformation plan. Meanwhile, Lloyds has launched a dedicated Cloud Centre of Excellence tasked with ensuring the safe adoption of cloud services, provided by Microsoft and Google, across the entire organisation.

Those projects have been accelerated by the pandemic, which put pressure on banks to provide new services online much quicker than planned. Banks have suddenly realised: Oh, we dont have five years to do this, we have five months and I think that has, necessarily, pushed them to look at third parties that can help them along the way, Kocianski said.

Most banks are not capable of building this stuff themselves. They dont have the talent, they dont have the time, they dont have the expertise. And quite frankly, why would you build it if you could buy it?

Brexit has also played a role, forcing banks to use the cloud to store EU customer information that they did not have the capacity, or security, to properly hold in the UK due to strict data privacy rules.

The Bank of England, which is understood to be speaking to cloud providers on a monthly basis, said last week it was working with the Financial Conduct Authority and the Treasury to try to address the potential risks, but could only go so far without international cooperation given that most of those cloud service providers were headquartered overseas.

Sign up to the daily Business Todayemail

It puts further pressure on cross-border regulators such as the Financial Stability Board and the Bank for International Settlements to set global standards, and fast.

But David Richards, the chief executive and co-founder of WANdisco, a company that shifts company information to cloud platforms, warned that financial regulators could end up behind the curve if they did not act quickly enough.

You have to regulate now, he said. Trying to implement rules in five years, when the amount of cloud-based data was potentially 100 times bigger, will be too hard.

Amazon and Microsoft declined to comment. Google did not respond to requests for comment.

See the rest here:
Why the Bank of England has its head in the cloud over data security - The Guardian

Read More..

Fungible can solve the public cloud Hotel California problem Blocks and Files – Blocks and Files

DPU startup Fungible recently briefed Blocks & Files on its views regarding Intels Infrastructure Processing Unit. Co-founder and CEO Pradeep Sindhu said it was inadequate as a data centre cost saver, lacked imagination, and couldnt help solve the public clouds trillion-dollar paradox, also known as the Hotel California problem.

Intel launched its data processing unit (DPU) line recently, differentiating itself from DPU suppliers such as Fungible and Pensando, by calling its product an Infrastructure Processing Unit (IPU). While Fungible would agree processing infrastructure-centric instructions is the key need, it thinks Intels DPU vision is painfully inadequate and provides much smaller TCO benefits.

The basic difference between the Intel and Fungible approaches, in Blocks & Filess view, is that Intel is focussed on incremental improvements using Smart NICs such as Nvidias BlueField where Fungible is looking for up to 12x improvement.

Intel says it is the DPU market leader by virtue of its sales to hyperscaler data centre operators. Such operators have thousands of servers and switches, and tens of thousands of storage drives. They sell compute cycles, so any percentage gain in compute cycle capacity is worthwhile. A ten to 20 per cent improvement obtained by offloading network, security and storage functions to a SmartNIC means a significant increase in server utilisation, and hence revenues.

Sindhu mentioned Amazons Annapurna approach, in which Amazon took infrastructure processes that were running on X86 and put them on Arm. The Arm CPUs were not as powerful as X86 processors but, at $5/core, were much lower cost than X86 which cost $40/core an 8x improvement. By making that switch, AWS freed up X86 compute cycles, which it could sell to customers.

But Fungible wants more. Sindhu told us that he believes the infrastructure server processing burden is becoming a much bigger component of overall server CPU cycle utilisation. As application server populations in data centres increase and as non-server processing resources such as GPUs increase as well the amount of internal-to-the-data-centre infrastructure processing skyrockets. Sindhu said there is much more east-west data movement in such data centres than north-south data movement.

That means more and more network, storage and security processing tasks are the result of such data movement within and across the infrastructure. It is, he thinks, pointless for application servers to execute the myriad repetitive instructions needed for this work. Yes, it should be offloaded from the servers but not in a small-scale, incremental way with SmartNICs.

In our view, that is like putting lipstick on a pig.

Sindhu said The DPU concept is broader than Intels IPU concept, but he is happy to have Intel and Nvidia validating our vision.

He said Intels IPU concept lacks imaginative vision because Fungibles DPUs can do so much more than an Intel IPU. One example: legacy applications are compute-centric, so user-initiated computations should be executed close to where user data is stored. SQL primitives can be executed directly on DPUs (with SSDs plugged into them) with little data movement.

Sindhu talked about a second example: machine learning involves parameter-serving problems in which previous GPU results are put into Comma and the results distributed. These computations are best done in the network and on-the fly, he said. In other words, on the Fungible DPU.

What Intel actually has is an accelerator (crypto and others), not a DPU, plus a bunch of vanilla Atom cores. Just integrating them on the same die will not solve the problem.

DPU computations have four characteristics:

What is needed is a more or less complete offload of infrastructure-centric processing to dedicated processing chips, tailor-made with instructions and architecture specifically designed for IT infrastructure processing. Fungibles view is that its specialised CPU can process these infrastructure-centric computations far more efficiently than anything else out there.

In effect, an infrastructure-focussed data processing system, using DPUs, is deployed inside a data centre as a central hub with application CPUs using GPUs to carry out processing tasks that distract from their main purpose: running application code.

Sindhu said Nvidias Bluefield SmartNIC is a hardware implementation of NVMe-over Fabrics RoCE (RDMA over Converged Ethernet) protocol, with a ConnectX 5 chip (ROCE v2) and 8 and then 16 Arm cores. The issue he said, is that for RoCE its fine but for other computations its just another general purpose CPU. In short, its inefficient.

Intel and Nvidia are using 7nm designs, yet we beat the pants off them with our 16nm chip because we have a better architecture. Well move to 7nm and then on to 5nm, and no-one will be able to catch us.

Our FS1600 does close to 15 million IOPS. If you use two Xeons with the same SSDs youll get one million IOPS if youre lucky We can see our way 20 million IOPS with software improvements.

Fungible claims that hyperscalers and near-hyperscaler data centres can realise a 12x improvement in TCO by using its specialised chips and software. That consists of 4x improvement from eliminating resource silos and then 3x from improving efficiency.

A Fungible slide shows these two aspects of Fungibles TCO claim. The 3x efficiency improvement claim is shown by taking a nominal $100 of existing IT network, compute and storage infrastructure spend and claiming that the equivalent Fungible infrastructure spend spend with DPU column would be $36. Thats a 64 per cent reduction. Put another way, a $10M infrastructure spend without Fungible would be a $3.6M spend with Fungible a saving of $6.4M.

The slide includes a middle Spend Smart NIC column, which is where Intels IPU-based infrastructure would fit. It partially offloads the host server CPUs but doesnt affect the network and storage spend elements, resulting in a ten per cent TCO reduction a $1M saving in the case of the $10M infrastructure spend example above, with Fungible saving you $5.4M more..

The rather large storage spend saving with Fungible $40 down to $8 is from its data reduction and erasure coding, both meaning less capacity is needed for the same number of raw terabytes.

Sindhu says overall enterprise data centre IT equipment utilisation is less than eight per cent. AWSs data centre utilisation is 32 per cent. He says: Fungible can bring 10x better efficiency to enterprise data centres and 2 to 2.5x better efficiency than hyperscalers.

The Fungible marketing message is that its products let customers operate a data centre with higher efficiency than the hyperscalers themselves. That means tier-1 and tier-2 data centre operators are likely prospects for Fungible.

Equinix and other colocation centres are examples of potentially good targets for Fungible. But a lot of Equinix revenues comes from hyperscalers themselves, with systems such as direct connect brokerage. Equinix might not want to bite the hands that feed it.

Toby Owen, Fungibles VP for Product, said: I think a service provider (SP) would be a model for us that has a huge potential. A whole bunch of customers would rent AI/ML resources from SPs.

Sindhu referred to the Andreessen Horowitz Trillion Dollar Paradox article by Sarah Wang and Martin Lomax:

This said that cloud IT resources were cheap when companies started using them, but quite rapidly become high-cost after a few years. The chart above shows worldwide spending on on-premises data centres and the public cloud from 2010 to 2020, with the cloud growing past the on-premises spend.

Cloud spend puts so much pressure on a companys margins that its share price falls and its market capitalisation suffers. The article explains: Its becoming evident that while cloud clearly delivers on its promise early on in a companys journey, the pressure it puts on margins can start to outweigh the benefits, as a company scales and growth slows. Because this shift happens later in a companys life, it is difficult to reverse as its a result of years of development focused on new features, and not infrastructure optimisation.

Sindhu says that large public cloud customers end up in Hotel California:You can check out any time you like, but you can never leave!*

Wang and Casados conclusion is: We show (using relatively conservative assumptions) that across 50 of the top public software companies currently utilising cloud infrastructure, an estimated $100B of market value is being lost among them due to cloud impact on margins relative to running the infrastructure themselves.

Sindhus message is that a large business can save extensive amounts of money by repatriating public cloud IT infrastructure spend to its on-premises data centres, and equipping them with Fungibles DPU hardware and software. That way they get better than public cloud data centre efficiency and boost their market capitalisation even more.

* Hotel California lyrics Cass County Music, Red Cloud Music, Fingers Music. Songwriters: Don Henley, Glenn Frey, Don Felder. Source:Musixmatch

Read the original here:
Fungible can solve the public cloud Hotel California problem Blocks and Files - Blocks and Files

Read More..

AWS hosting: What is it, and how does it work? – Tom’s Guide

Whether youre planning your first website or are a seasoned veteran with dozens under your belt, every website owner faces the important question of which web hosting provider to choose. Finding and choosing one of the best web hosting services for your needs isnt easy, not least because you have a lot of different options to choose from. Learning about them all is overwhelming.

To help with that task, this article will outline one of the biggest players in the hosting space to consider: AWS hosting.

Amazon Web Services (AWS) hosting refers to the hosting services provided by the global ecommerce giant Amazon. AWS hosting is one service within the larger AWS platform, which provides an array of cloud-based products (over 200 altogether). In addition to web hosting, some of its top products are cloud storage and database services: read our AWS review to learn more about the cloud storage element.

AWS is the largest cloud platform there is, and was one of the earliest companies to provide cloud-based services, making them one of the most respected options for anyone interested in cloud hosting.

AWS hosting uses cloud hosting. With traditional hosting, a website is stored on a specific physical web server. Cloud hosting, by contrast, uses a network of connected serversboth virtual and physical. That means websites that use cloud hosting arent dependent on any one machine. One server in the network can go down without affecting the performance of any website being hosted on it, since there are plenty of others to fall back on.

AWS hosting is by no means the only option for cloud hosting, but it's one of the most well-known and popular of the best cloud hosting providers.

AWS offers a few different types of AWS hosting services for different levels of need.

If you do decide to use AWS for your hosting, then figuring out which service makes the most sense for your needs will play a role in what you pay and how satisfied you are with the experience.

Web hosting is a competitive market, but AWS is an established brand with some strong benefits to offer.

Security

A business built on ecommerce should know something about security, and Amazon extends that knowledge to its AWS services. The company promises infrastructure that was built to the standards of the most exacting industries, including the military and global banks.

Finding a secure web host is only one step in making sure your website is secure, but its an important one. AWS hosting is a solid choice in this regard, and you can learn more about site security in our feature, which spells out how to evaluate and improve your website security.

Performance

AWS has a huge infrastructure backing its hosting services, which translates into a strong performance (at least most of the time). For websites that use AWS hosting, that means you can typically count on fast loading times and near constant uptime (the term for how often your website is available).

Flexibility

One of the big benefits of cloud hosting in general, including AWS hosting, is that its easier to scale up and down as needed. If your websites needs arent consistentsay, your traffic surges during the holiday season, then slows down for months afterthen having a web hosting plan that can accommodate varying needs as they arise is useful. AWS hosting is a good choice for that.

Payment model

AWS hosting uses a pay-as-you-go model, which can be useful for some businesses. For months where you have fewer visitors and need less bandwidth, your costs will go down. And if you only need some of the services AWS makes available, youll pay less because of it. If you like the idea of knowing that youll only pay for what you need, AWS hosting makes that possible.

Global footprint

While many website owners dont think much about it, geography plays a role in the performance of your web host. If their servers are located on the opposite side of the world from where most of your visitors are, it can affect how fast your site loads and how well it works for them.

Regional hosting matters for your websites performance. AWS has servers all over the world, set up in availability zones. No matter where you or your visitors are located, they probably have a server nearby.

Compatibility

AWS hosting is compatible with all the main platforms, content management systems (CMSs), and programming languages you may use to build your website.

While the benefits AWS hosting offers are significant, its not a perfect service and its not for everyone.

Confusing pricing

The pay-as-you-go model is a plus for some website owners, but a minus for many others. It makes payment into a complicated process. Understanding what you owe and knowing what to expect each month becomes difficult. You may end up feeling like you have less control over your costs. You dont want to end up with a surprise bill thats much higher than your business budget for the month.

Many web hosting providers offer much more straightforward pricing. You pay a set amount per month or year, period. For companies or individuals on a strict budget, knowing exactly what youll owe can make a lot more sense than dealing with the possibility of change month to month.

Complexity

AWS hosting offers a ton of functionality, but the flipside to that is that its not intuitive for beginners. Figuring out how to get set up and use the hosting service can be confusing. A lot of other web hosting providers do a better job at providing ease of use for non-experts. If you dont want to deal with a steep learning curve, or dont have IT experts on staff to do the work for you, then AWS hosting may not be worth the effort.

Some vulnerability

AWS hosting can promise impressive security and high performance expectations, but you cant assume that means your website will face no issues. Websites that use AWS hosting have still faced data leaks and hacks, and the hosting service has dealt with the occasional outage in spite of its impressive infrastructure.

Choosing a reputable web hosting provider like AWS hosting makes a big difference when it comes to security and performance, but its not a guarantee that youll experience no issues.

AWS hosting may be a smart choice for you if you need a high level of security and performance, and like the idea of being able to scale as needed and only pay for what you use. For website owners that prefer a more straightforward payment structure and value ease of use over power and features, AWS hosting isnt your best choice.

More here:
AWS hosting: What is it, and how does it work? - Tom's Guide

Read More..