The morning of Election Day, Joseph R. Biden Jr prayed during Mass at the Catholic parish near his home in Delaware. Late that night, when it became clear that no […]
September 22, 2020 – 20:51 BSTFrancesca Shillcock The 7.39 and Becoming Mum star recently welcomed her first child with partner Jamie – meet her partner here… Sheridan Smith is back […]
View full post on National Cyber Security
Since Wonder Woman 1984 isn’t coming to theaters in October anymore, you’re gonna want to find some new stuff to watch at home. Thankfully, Disney+ and Hulu have a wave […]
View full post on National Cyber Security
Blue-stalling: When two people are dating and acting like a couple, but one person in the partnership states they’re unready for any sort of label or commitment (despite acting in […]
View full post on National Cyber Security
Medical record requests by payors are commonplace for health care providers. Typically, these requests are received by a front desk employee who responds to the inquiry in short order. Yet, not all requests should be treated the same. When a request for documentation is propounded by the “Special Investigation Unit” (S.I.U.) of an insurance company, special care should be exercised and provider involvement is required.
What is a S.I.U. anyway? Over the past two decades, campaigns have intensified to curb fraud and abuse in health care. On the government side, False Claims prosecutions have markedly increased and in the private sector, insurance companies have created specific departments to combat fraud. The S.I.U. is a department within an insurance company with a targeted focus on recovering payments from medical providers that appear to be the product of fraud. Individuals employed by a S.I.U. include former law enforcement personnel, claims adjusters and fraud analysts, among others, who receive specific training and credentialing in fraud detection. These investigators utilize data analytics and other methods to flag providers for claims that fall outside of the “normal range” for the type of health care provider under review.
S.I.U. “audits” or requests for information about the practice should be taken seriously and taken to the top of your organization. In many cases, special investigators receive incentives from the insurance company for recovering payments from providers. They often attempt to “strong arm” a resolution by threatening a fraud claim, which in a number of states includes the prospect of treble (triple) damages, punitive damages, and attorneys’ fees. In some cases, medical records produced by the provider (or the absence thereof) will assist the fraud allegation. In others, the records will assist in supporting a defense to the same.
Here are 5 tips for your practice:
Instruct staff that all audit requests should be forwarded to the owner of the practice and the provider whose records are being requested.
If the audit is deemed routine (not S.I.U. generated), instruct staff to make a copy of the records requested and the cover letter that attaches the records so that you can memorialize exactly what was provided and when.
If you receive a letter from the S.I.U., reach out to an attorney who has experience in dealing with the S.I.U. to assist you through the process.
If an investigator from the S.I.U. appears at your office, ask for a business card and do not let him/her disrupt patient care. You can call them later (or your attorney can).
Do not provide access to your electronic records or files to anyone — including anyone employed by a payor.
A vulnerability in a third-party library component has had a knock-on effect on software packages that rely on it, including the Drupal content management system.
The issue involves a cross-site scripting (XSS) bug in CKEditor, a rich text editor that comes bundled with various online applications.
An attacker might be able to exploit the XSS vulnerability to target users with access to CKEditor. This potentially includes site admins with privileged access.
Exploitation is far from straightforward and would involve tricking potential victims into copying maliciously crafted HTML code before pasting it into CKEditor in ‘WYSIWYG’ mode.
“Although this is an unlikely scenario, we recommend upgrading to the latest editor version,” developers of CKEditor explain in an advisory, issued earlier this month.
CKEditor 4.14 fixes this XSS vulnerability in the HTML data processor, discovered by Michał Bentkowski of Securitum, as well as offering featuring improvements and resolution for an unrelated XSS vulnerability in the third-party WebSpellChecker Dialog plugin.
An advisory from Drupal, issued on Wednesday, instructs users to update to a version of the CMS that feature the updated version of CKEditor in order to mitigate the vulnerability.
In practice, this means upgrading to either Drupal 8.8.4 or Drupal 8.7.12.
The security flaw is described as “moderately critical” by Drupal, even though attackers would need to be able to create or edit content in order to attempt exploitation.
READ MORE WordPress Terror: Researchers discover a massive 5,000 security flaws in buggy plugins
Did you know the TNW Conference has a track fully dedicated to exploring the latest work culture trends and the future of work this year? Check out the full program here.
The most exciting breakthroughs of the twenty-first century will not occur because of technology, but because of an expanding concept of what it means to be human. — John Naisbitt
Before we dive into why more women should lead AI teams, I want to share a fascinating story I heard from Tania Biland, a 3rd-year student of Lucerne University of Applied Sciences and Arts.
The story as narrated by Tania:
Last semester, our class got split into three different groups in order to develop a safety technology solution for Swiss or German brands:
Group 1:Only women (my group)
Group 2:Only men
Group 3:Four women and one man
After 4 weeks of work, each team had to present their work.
Group 1, composed of only women, developed a safety solution for women in the dark. As the jury was only male we decided to tell a story using a persona, music, and videos in order to make them feel what women are experiencing on a daily basis. We also put emphasis on the fact that everyone has a mother, sister, or wife in their life and that they probably don’t want her/them to suffer. In the end, our solution was rather simple, technologically: using light to provide safety but connected to the audience emotionally.
Group 2, mostly composed of men, presented a more high-tech solution using AI, GPS, and video conferences. They based their arguments on facts and numbers and pointed out their competitive advantages.
In Group 3,with 4 women and 1 man, the outcome didn’t seem finished. The only man in the group could not agree to be led by women and they, therefore, spend too much time discussing group dynamics instead of working.
The groups not only had different outputs but also approached the problem differently. My group (group 1) decided to start by defining each other’s work preferences and styles in order to distribute some responsibilities and keeping a hierarchy as flat as possible.
On the other hand, the two other groups elected a leader for the team. It turned out that these “leaders” were more perceived as dictators, which lead to heavy conflicts where the teams spent hours discussing and arguing while our group was just working and productive.
What science tells us about gender differences
The science landscape with regards to gender differences and effects on behavior is still evolving and has not come up with a clear set of scientific explanations for different behaviors yet. By compiling most of the research, there are two main factors that influence behaviors:
Potential physiological differences between men and women
Social norms and pressures forming different behaviors
In the above story, as told by Tania, women developed the solution in a Collaborative Leadership Style (adhocracy culture),adapting the leading position based on the tasks with an almost flat hierarchy. They derived their argumentation by involving all stakeholders (in this case the mothers and wives = users), showing empathy for their problems. They saw the bigger picture and also built a simpler solution that was actually finished.
Through the story, I was able to connect the dots on why most AI projects never end up moving out from the prototype phase to a real-world application.
Why AI products are not adopted?
Based on my experience, there are three main reasons why most AI and Machine Learning (ML) solutions do not move from the prototyping phase to the real-world:
Lack of trust:One of the biggest difficulty for AI or ML products is lack of trust. Millions of dollars have been spent on prototyping but with very little success in the real-world launches. Essentially, one of the most fundamental values of doing business and providing value to customers is trust, and Artificial Intelligence is the most-heavily debated technology when it comes to ethical concerns and related trust issues. Trust comes from involving different options and parties in the entire development phase, which is not done in the prototype phase.
The complexity of a launch:Building a prototype is easy, but there are tens of other external entities that need to be considered when moving into the real world. Besides technical challenges, there are other areas of focus that need to be integrated with the prototyping (such as marketing, design, and sales).
AI products often do not take into account all stakeholders:I heard the story that Alexa and Google Home are being used by men to lock out their spouses in instances of domestic violence. They are turning up the music really loud, or they are locking them out of their homes. It is possible that in an environment with mostly male engineers building these products, no one is thinking about these kinds of scenarios. Additionally, there are many instances about how artificial intelligence and data sensors can be biased, sexist and racist [1].
Interestingly, none of the three points relate to the technical challenges, and all of them can be overcome by creating the right team.
How to make AI more successfully adopted?
In order to solve the above challenges and build more successful AI products, we need to focus on a more collaborative and community-driven approach.
This takes into account opinions from different stakeholders, especially those who are under-represented. Below are steps to achieve that:
Step 1. Involve different groups esp. women from the middle of the talent pyramid
In technology, most companies focus on hiring people at the top of the talent pyramid, where for primarily historical reasons, are fewer women. For example, most Computer Science classes have less than 10 percent of women. However, many talented women are hidden in the middle of the pyramid, educating themselves through online courses but lack opportunities and encouragement.
Talent Pyramid
To give an example, I was talking with the president of Geek Girls Carrot, which is an organization promoting women in tech. They are organizing an AI workshop where over 125 women applied but they had only 25 seats, so naturally, they have to leave behind more than 100 talented women.
Imagine, if we can involve most of the other 100 women instead of only at the top. This would give a lot more women the opportunity to work in new technologies like AI.
Step 2. Build a communal and collaborative bottom-up team with different stakeholders
Next, we need more collaboration between men and women as well as different stakeholders to launch products successfully in the real market. This can be achieved through forming inclusive project communities that build AI products based on common values, beliefs, and often a bigger vision.
Proving the point, in the past six months, we brought together a group of more than 50 male and female students to build an ML model. Within a short time, members started collaborating and helping each other to build the models. Four subgroups got formed, and one of them was driven by two women and supported by two men (data taggers). The other groups were all men. In 4 months, the group with the two women and two male built the most accurate model. From the beginning, the women were much more willing to collaborate than men. However, more interestingly, I saw that men in the group also ended up behaving more collaboratively because of the other women in the group. This was fascinating!!
Step 3. Create the right Organizational Structure for collaboration
What if we could create organizational structures and practices that don’t need empowerment because, by design, everybody is powerful and no one powerless? I have seen that this can be achieved by connecting intrinsic and extrinsic motivations (which is not related to money) and creating an incentive structure that is not competitive.
In my case, I built the community where the mentor was at the top of the pyramid, followed by the community manager, then engineers working on building models and finally data taggers. Members from each team were striving to move up the ladder to reach the next level, which created an extrinsic motivation. However, the monetary compensation for people on the same level was the same. This fostered collaboration.
In this context, the role of a leader is not to be a boss but to foster Collaborative Leadership. Such an organizational structure will decrease the need to control people and will give opportunities to learn and grow together[2].
Why women should lead AI teams
In the story from the beginning, the female group followed a more Collaborative Leadership Style by showing more customer empathy and willingness to collaborate.
Considering the limited experiment in the solar project, we saw that the approach to use the community to build products helped as well to foster collaboration and build trust among community members.
While none of the mentioned qualities can be generalized, the following graphic aims to summarize some of the reasons why many women are a great fit for Collaborative Leadership.
In conclusion, I am arguing that we should think more holistically and do our best to create the right environment where we look beyond gender, race, and cultural background and focus on how we can collaborate as humans to build a better future.
This article was originally published on Towards Data Science by Rudradeb Mitra. He started his career as an AI researcher and published 10 research papers. After graduating from University of Cambridge, he was part of building various startups in US, UK, Belgium, and Poland. His current focus is driving innovation bottom-up and solving various social problems around the world using AI through global collaboration of changemakers from over 75 countries. He also wrote a book on AI and have been invited to speak at over 100 events. Besides that he has no phone, meditates a couple of hours a day, and lives life with no goals in life and in a state of Wu wei.’
The Cyberspace Solarium Commission will recommend that the Department of State establish a bureau focused on international cybersecurity efforts and emerging technologies as part of its forthcoming report, commissioners said March 3 at the Carnegie Endowment for International Peace.
The suggestion from the commission, made up of government and non-government cybersecurity experts developing cyber policy recommendations, comes as part of a broader belief in the group that the State Department needs to be more involved on cybersecurity issues.
Among the report’s 75 recommendations, set for release March 11, will be the proposal for a new State Department office called the “Bureau for Cyberspace Security and Emerging Technologies,” in addition to a new assistant secretary of state position to coordinate international outreach for cyber issues and emerging tech.
The new position would report to the deputy secretary of state or undersecretary of political affairs, according to Rep. Jim Langevin, D-R.I., a member of the commission. The goal of the new office is to take cybersecurity issues at the department and “raising its level of importance and stature … to reinforce that this is an international approach that we need to and want to take,” Langevin said.
In its fiscal 2021 budget request, released in February, the State Department asked Congress for $6 million in new funding for establish an “Cyberspace Security and Emerging Technologies” office. According to the budget request, the office would “allow the Department of State to ensure the development of long-term, comprehensive expertise in order to fully support U.S. foreign policy and diplomatic initiatives needed to meet the national security challenges posed by cyberspace and emerging technologies.”
Right now, the top cybersecurity official at the State Department is Robert Strayer, who has headed 5G policy and international outreach for that issue. That effort has centered on convincing allies not to use hardware from the China-based Huawei company in their 5G networks — an effort that has had limited success.
For example, Great Britain announced last month that it would allow Chinese tech in non-critical portions of its 5G network. Germany is also reportedly expected to make a decision soon. Chris Inglis, former deputy director of the NSA and current Solarium commissioner, said that the United States may have had limited success on the issue because U.S. policymakers were “late to the game” and there wasn’t an agency charged with that role. That’s a gap the suggested bureau would fill.
The commission is needed “so that in the future hopefully 6G, 7G, 10G will be the responsibility of somebody at least in terms of the international portfolio,” Inglis said.
Sign up for our Daily Brief
Get the top Cyber headlines in your inbox every weekday morning.
By giving us your email, you are opting in to the Daily Brief.
Two weeks ago, the State Department was a key part of an international effort attributing a 2019 cyberattack on the country of Georgia to Russian military intelligence. Langevin wants to see more.
“They need more resources, more people, more expertise within the State Department to raise the profile and also to be able to be proactive in being involved with international …. groups that are involved in setting international cyber norms,” he said.
Cybersecurity is the set of practices, processes and systems for protecting Information Technologies (IT), which consists of computers, networks, software and stored information, from digital attack. Cybersecurity has become a preoccupation for the government, private sector, institutions and individuals. Billions are spent annually to defend governmental, corporate, and personal IT from cyber intrusion. Innovative companies have developed new ways of providing security.
A major aspect of cybersecurity is the protection of critical infrastructure. The Department of Homeland Security defines critical infrastructure as “the physical and cyber systems and assets that are so vital to the United States that their incapacity or destruction would have a debilitating impact on our physical or economic security or public health or safety.” There are 16 critical infrastructure sectors, including energy, communications, food and agriculture, transportation, water and wastewater, nuclear power and materials, major manufacturing, and defense industries.
All these sectors are dependent on IT, not merely for communications or billing, but for the operation of major physical systems. Most of them employ IT-based supervisory control and data acquisition (SCADA) systems to monitor and operate a wide variety of hardware. For example, the energy sector is critically dependent on SCADA technology to manage the flow of power, direct the operation of production and storage facilities, and monitor the state of energy usage.
The threat to these large, complex systems, essential to not only the way we live but our very lives, is quite severe. The same IT and SCADA systems that allow for the efficient management and operation of critical infrastructure sectors also create enormous vulnerabilities that adversaries will seek out to exploit. The cyber threat to our energy sector, perhaps the most critical of all, has been growing for years. According to a report by the Idaho National Laboratory prepared for the Department of Energy: “Cybersecurity for energy delivery systems has emerged as one of the Nation’s most serious grid modernization and infrastructure protection issues.”
The dominant focus of infrastructure security is on protecting computers and networks from the introduction of malware. When it comes to critical infrastructure, hackers look for ways of entering the networks and then wend their way to the software programs that control operations. Often, the hackers will look for easy entry points, such as electronic billing systems or supply chain communications, from which they can then launch attacks against SCADA systems or other IT-based means of monitoring and directing operations within a sector.
It is becoming harder to protect entire networks from hacking. The explosive growth in the use of IT for personal and business purposes, and the move to a world where the so-called Internet of Things is ubiquitous, has resulted in a massive increase in potential entry points for hackers. Recently, it was discovered that IT-enabled baby monitors could be hacked. Moreover, hackers keep finding new network vulnerabilities and investing in ever-more sophisticated malware.
Protecting critical infrastructure is a never-ending problem. Operating systems must be constantly patched as vulnerabilities are uncovered. Computer systems and networks are routinely needing upgrades as new malware is developed. The expense of that is significant. Some experts have characterized IT security spending as a “black hole.” Any new approach that does not have to be constantly enhanced would significantly reduce future costs of cyber defense.
An alternative approach to establishing a high level of infrastructure security at an affordable cost is by focusing on operational technologies or OT. OT consists of hardware, such as valves, pumps, generators and SCADA-enabled machinery, all of which are critical to the operation of networks that deliver power, water, and oil and gas.
By focusing appropriate critical infrastructure protection on keeping OT secure, utility companies and others in critical infrastructure sectors can simplify their cybersecurity requirements and significantly reduce costs. The key is to focus on protecting IT-directed OT, rather than an entire network. This can be done by placing a device that only allows pre-defined, legitimate signals to be sent to the OT on a network. No non-specified commands could pass through a protective device. Even if a hacker could penetrate an electric utility’s network, no malware intended to cause OT malfunction could penetrate a device or machine.
Such a system, called Binary Armor, already exists. It could revolutionize the protection of OT. Essentially, it places an in-line barrier to cyber intrusion on a network in front of the OT device. The Binary Armor unit monitors all communications to a piece of OT. Only legitimate commands within the defined operating parameters of the OT can pass through. A command that would cause the OT to behave improperly, or self-destructively, could not pass, regardless of how cleverly the malware was written. This system also will prevent accidentally sending the wrong command to the OT, which is what happened in the Chernobyl disaster.
Because the system is “pre-loaded” with the legitimate commands and operating parameters for that OT, it will rarely need to be upgraded, unlike typical cybersecurity systems. Moreover, Binary Armor would allow utilities and other critical infrastructure sectors to use commercial networks, rather than proprietary ones, further reducing cybersecurity costs. Finally, it would radically increase the problem and costs for the hacker, primarily because a Binary Armor unit must be physically accessed to be reprogrammed.
Currently, a Binary Armor unit must be installed on a network. This is not difficult. The current Binary Armor unit is a 3x2x2 inch box with two Ethernet access ports and a power source. It weighs about six pounds. But in the future, the basic technologies could be embedded into OT, simplifying the cybersecurity challenge.
Strong action needs to be taken now by all critical infrastructure sectors, particularly for energy, to enhance their cybersecurity protections. Public utilities would be remiss in not testing Binary Armor to understand its applicability for their networks.
Whenever we hear about major cyber security attacks such as data breaches, it’s typically larger enterprises that are the victims. That makes sense, considering those events can potentially impact a lot of people and therefore are more likely to grab headlines and garner attention.
But that doesn’t mean small and mid-sized companies (SMBs) are immune to such attacks. In fact, smaller organizations are frequent targets of cyber incidents, and they generally have far fewer resources with which to defend themselves.
A recent study by the Ponemon Institute, which conducts research on a variety of security-related topics, presents a clear picture of the cyber security challenges SMBs are facing. The report, “The 2019 Global State of Cybersecurity in SMBs,” states that for the third consecutive year small and medium-sized companies reported a significant increase in targeted cyber security breaches.
For its report, Ponemon conducted an online survey of 2,391 IT and IT security practitioners worldwide in August and September 2019, and found that attacks against U.S., U.K., and European businesses are growing in both frequency and sophistication.
Nearly half of the respondents (45%) described their organization’s IT posture as ineffective, with 39% reporting that they have no incident response plan in place.
Cyber criminals are continuing to evolve their attacks with more sophisticated tactics, and companies of all sizes are in their crosshairs, noted Larry Ponemon, chairman and founder of the Ponemon Institute. The report shows that cyber attacks are a global phenomenon, as is the lack of awareness and preparedness by businesses globally, he said.
Overall, cyber attacks are increasing dramatically, the report said. About three quarters of the U.S. companies surveyed (76%) were attacked within the previous 12 months, up from 55% in a 2016 survey. Globally, 66% of respondents reported attacks in the same timeframe.
Attacks that rely on user deception are on the rise, the study said. Overall, attacks are becoming more sophisticated, with phishing (57%), compromised or stolen devices (33%), and credential theft (30%) among the most common attacks waged against SMBs globally.
Data loss is among the most common impact of cyber security events. Worldwide, 63% of businesses reported an incident involving the loss of sensitive information about customers and employees in the previous year.
SMBs around the world increasingly are adopting emerging technologies such as mobile devices and apps, the Internet of Things (IoT), and biometrics, despite having a lack of confidence in their ability to protect their sensitive information.
Nearly half of the survey respondents (48%) access more than 50% of their business-critical applications from mobile devices, yet virtually the same portion of respondents said the use of mobile devices to access critical applications diminishes their organization’s security posture.
Furthermore, a large majority of respondents (80%) think it is likely that a security incident related to unsecured IoT devices could be catastrophic. Still, only 21% monitor the risk of IoT devices in the workplace.
The report also suggests that biometrics might finally be moving toward the mainstream. Three quarters of SMBs currently use biometrics to identify and authenticate users or have plans to do so soon.
Small and mid-sized companies can take several steps to bolster their cyber security programs. One is to educate users and managers throughout the organization about the importance of strong security and taking measures to keep data safe.
Because so many attacks begin with employees opening suspicious email attachments or clicking on links that lead to malware infestations or phishing, training users to identify these threats is vital. Companies can leverage a number of free training resources online to help spread the word about good security hygiene.
Smaller companies, particularly those will limited internal cyber security skills, can also consider hiring a managed security services provider (MSSP) to help build up a security program. Many of these firms are knowledgeable about in the latest threats, vulnerabilities, and tools, and can help SMBs quickly get up to speed from security standpoint.
And companies can deploy products and services that are specifically aimed at securing small businesses. Such tools provide protection for common IT environments such as Windows, macOS, Android, and iOS devices. They are designed to protects businesses against ransomware and other new and existing cyber threats, and prevent data breaches that can put personal and financial data at risk.
Some of these offerings can be installed in a matter of minutes with no cyber security or IT skills required, which is ideal for smaller companies with limited resources and a need to deploy stronger defenses quickly.
D5 Creation