StepSecurity

stepsecurity

Let's learn about via these 47 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Enterprise Technology /Learn Repo 1. How Technology Is Changing Trust in the Online Merchant World In this article, we'll discuss the ways by which customers can be sure that their information is being kept safe, and they can track their purchases. 2. Why Micro Frontends Are the Future of Frontend Development Microservices have helped the backend world to divide backends into smaller, more manageable, and more efficient pieces. 3. Good Company Interview with Alexei Dulub, PixelPlex's Founder Alexei Dulub, CEO & Founder of PixelPlex, discusses consulting & custom development, power of value-driven teams, blockchain's prospects, and unattainable goals 4. Startup Interview with Gabriel Dymowski, DoxyChain Co-founder & CEO New enterprise-ready blockchain revolutionising document management space. DoxyChain brings new online contracting standards to European Union. 5. Startup Interview with Erik Norgaard, HOLLYFY Founder / CEO Built for the creator economy. Empowering small businesses. Expanding spheres of influence. Erik Norgaard shares the origin story of Hollyfy. 6. How Digital Transformation Impacts Your Company Culture The successful implementation of digital transformation in the enterprise depends largely on the willingness of the corporate culture to change. 7. Dollar Devaluation Drives Enterprises to Cryptocurrency Bitcoin was born as a solution to the damage created by money printing. With the decentralised nature of cryptocurrencies, we can solve this problem. 8. The Benefits Cloud ERP Solutions Bring to Modern Enterprise With over 70% of companies undergoing complete digitization, it might be your company’s chance to reap the benefits of using sales ERP software. 9. Digital Identities: The Value of Automation In Enterprise Security Digital identities are of crucial importance for cybersecurity of modern enterprises. Let's find out what changes can be expected in the domain of web security. 10. 5 Reasons Why Enterprises Need Zero Trust Security The notion of “Zero Trust” has been around since the 90s. But, the Zero Trust security model was first coined by John Kindervag to describe stricter access control management and cybersecurity programs, in 2010. Meaning that infinite trust is diminished from all computing infrastructure, and Zero Trust is grounded on the idea “trust none, verify all”. 11. Enterprise AI Has Been Failing, Here’s How It Can Recover Over the last decade, AI has evolved into an all-purpose term for any accomplishments of computer algorithms that formerly required human reasoning and thought 12. The Importance of Upskilling in Today's Digital Landscape: A Look at the Latest Trends This is making it increasingly important for individuals to develop these skills if they want to remain competitive in the job market. 13. All you Need to Know About Building a B2B Product (Example Case Study Included) Learn how B2B and SaaS product managers solve business users problems by building features for enterprise solutions 14. Computer Vision Is Solving Problems That Weren't Even On Our List Replicating human interaction and behavior is what artificial intelligence has always been about. In recent times, the peak of technology has well and truly surpassed what was initially thought possible, with countless examples of the prolific nature of AI and other technologies solving problems around the world. 15. Introducing Conversation.ai This post has been authored by Aakrit Vaish, Co-Founder & CEO of Haptik 16. Why More Diversity in Competitive AI Roles Requires the Reinvention of the Internship Pipeline AI is everywhere and we should start to intentionally recruit more diverse teams to design and build it. 17. The Importance of a Single Source of Truth for Enterprises A single source of truth (SSOT) enables that synchronization. A company with SSOT relies on one and only one point of reference for the latest, aggregated info. 18. Data-Driven Approach for Software Engineering: How to Avoid Common Problems In today’s digital world, data is constantly being generated, evaluated, and updated. It also plays an important role in the work of software engineers by providing accurate, actionable feedback that helps engineers understand where and how to make improvements to a product or process. 19. The Long and Winding Road to Kubernetes A look at why enterprises are slow in moving to Kubernetes. 20. How Automation in Contract Management Can Optimize Business Negotiations Contract management software for small businesses optimizes negotiations so you can spend more time expanding your brand. 21. oVice Raises 100 Million Yen to Provide Innovative Virtual Office Spaces At oVice, you can virtually walk by moving your avatar and easily join in and out of conversations by bringing your avatar either closer or away from the other. 22. Migrating From Oracle Forms to APEX? I’ve Done it and Here’s Why I Think You Should Too What is the matter with Forms’ support? Why migrate to APEX? What are the benefits? In this article, I’ll provide you with answers to these questions. 23. 3 Things To Change About Your Approach To Digital Transformation The barriers to digital transformation, personal experience of its implementation, and the lessons learned during the evolution of a composable enterprise. 24. 5 Proven Use Cases of Intelligent Document Processing for Enterprises Let us go through 5 proven use cases of intelligent document processing for enterprises. 25. What Makes a Cloud Enterprise Technology Stand Out This article covers the top eight factors you should consider when choosing a cloud enterprise technology. 26. Slack's Connect DM Feature Has A Security Flaw Slack recently rolled out its "Connect DM” feature that turned out to be a blunder. Know more about it here. 27. You’ve Been Thinking of Serverless All Wrong! Serverless in enterprise success stories. Why should enterprise move to serverless? What's important to enterprise in serverless. 28. Securitize Launches Tokenized Fund on Avalanche, Unblocking Broader Access to Alternative Investment The new Securitize tokenized fund (the “Fund”) marks the first time exposure to one of KKR’s alternative investment strategies. 29. Improving Observability Through Service Level Metrics 30. A Helpful Guide to Enterprise Mobile App Development Here's a step-by-step guide for enterprise mobile app development. It is a good read for enterprise executives who don't know where to start. 31. Without Digital Adoption, Your Enterprise will Struggle It’s clear to everyone that we’re living in a digital age. In a time when people expect to run their lives through their smartphones, competitive enterprises have no choice but to adopt digital tools. 32. Unveiling Crowdin Enterprise. New Technology to Build Multilingual Software It’s pretty amazing how many tech products expand globally. Reaching new markets and looking for new business opportunities. Even despite today’s economic challenges. What’s much less pleasurable to observe is the amount of effort localization can take if done without proper technology. 33. Prioritising Security Vulnerabilities with CVSS 3.1 [An Overview] With thousands of security vulnerabilities reported each month in products ranging from hardware devices to firmware to popular software apps, how does one prioritise what needs the most attention? From a business and project management perspective, it makes sense to, first and foremost, allocate engineering and/or risk assessment resources to the most severe vulnerabilities that need immediate patching. 34. What Are the Advantages of Utilizing Cloud-Based Linux Systems? These days, a lot of businesses are concentrating on integrating a cloud-based system into their IT infrastructure because they are more dependable, and strong. 35. An Analysis of Key Players in the Software Defined Storage (SDS) Market for 2022 This blog examines the top Software-Defined-Storage (SDS) market players for 2022 and highlights the importance of each one as an enterprise solution. 36. 10 Important Use Cases of ERP For Businesses Wondering why your business needs a dedicated ERP system? Read to explore some important use cases of ERP for business growth and profitability. 37. AI-driven Features with the Highest Potential for Enterprise Development Enterprise players across all industries are eager for optimization and improvement of their business processes: administration, customer service, marketing, sales, recruiting, and others. Today AI-driven software can cover the most common Enterprise needs like data security, data processing, resource optimization, and brand awareness. Forrester has reported that AI is also able to improve customer service and quality of existing products, increase revenue streams, and customer lifetime value. 38. An Intro to Real-Time Data Anchoring and Legacy ERP Systems Comprehensive data visibility is still a big challenge in enterprise resource planning. 39. Is "Society 5.0" Supplementing AI as Technology's Latest and Greatest Snake Oil? Photo Credit, Jeremy Weate 40. Corporate YouTube: Helping You Manage Growing Enterprise Video Data Learn how corporate YouTube automates video content management helping you meet end-to-end enterprise video needs 41. Lowering TCO of Enterprise IT Systems during COVID-19 As an eternal optimist, I've always wanted to live through an economic recession as a working professional and finally, the time might be here. 42. Migrating from DC/OS to Kubernetes: The Challenges You May Face This blog will discuss DC/OS and Kubernetes and what challenges you might face when migrating between these container platforms. 43. Employee Wellness 101 Businesses have been overlooking employee wellness for a long time. As organizations started re-opening, they must have actionable employee well-being. 44. Enterprise Mobile Applications: Are they a Trend or a Necessity? Mobile devices have redefined the way we interact with digital technology, and enterprise mobile applications are probably the most interesting example of this shift. While they hold considerable potential for improving business operations, you’ll be right to wonder whether they can really fulfill all the trendy promises seen in the media. Below is a detailed analysis of what these apps can really do and how to harness their potential while avoiding the risks. 45. Why Building Enterprise Products Is Awesome While consumer products get all the hype, B2B products are a quiet gem 46. Best IDEs for .NET Development The .NET Core platform makes it possible for businesses to develop applications for just about any platform—from Windows, macOS, Linux, and even mobile operating systems. This isn’t just a time saver, but a means to cut back on your budget. You will be able to develop across all platforms, and you won't have to hire developers for each ecosystem. Instead, you can hire one developer or a team of .NET developers to make it all happen. 47. Configure MongoDB with Kerberos Authentication The MongoDB database administrators in a large enterprise may need to configure MongoDB to support Kerberos Authentication. The configuration of MongoDB with Kerberos authentication is very simple, provided you have some Kerberos knowledge. The MongoDB documentation article, Configure MongoDB with Kerberos Authentication on Linux, is pretty extensive on this topic. However, the article states — “Setting up and configuring a Kerberos deployment is beyond the scope of this document”, resulting in some of the starters/enthusiasts with limited knowledge in Kerberos not proceed any further. This article is geared more towards bridging that gap and to help you understand Thank you for checking out the 47 most read stories about Enterprise Technology on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

47 Stories To Learn About Enterprise Technology

The Prologue 🎥 In late November 21, 2014 - Pictures Entertainment was by a group of hackers. They leaked confidential data from the film studio like personal information about Sony Pictures employees and their families, emails between employees, information about executive salaries at the company, copies of then-unreleased Sony films, plans for future Sony films, scripts for certain films, and other information. Sony hacked But, why hack Sony Pictures Entertainment? The group demanded that Sony/ withdraw its upcoming film - The Interview, A comedy about a plot to assassinate North Korean leader Kim Jong-un. The group threatened terrorist attacks at cinemas screening the film. After many major U.S. theater chains opted not to screen the film in response to these threats, Sony chose to cancel the film’s formal premiere. So this turned up like resistance against the release of this film and apparently, this made everyone think that the hacker group must have emerged from North Korea. After evaluating the software, techniques, and network sources used in the hack, United States intelligence officials alleged that the attack was sponsored by the government of North Korea, which has since denied all responsibility. But hackers and computer experts questioned the narrative - So there’s room for doubt! Is it really North Korea? A Fine Morning All this chaos started on a very fine morning when the Sony executives received an email from an unknown group so-called demanding or otherwise, . This email was treated as spam and was ignored by most of the executives. But the game was already played - malware got activated by that time of interaction with the email and it started to spread in every possible network connection stealthily. “God’sApstls” “monetary compensation” “Sony Pictures will be bombarded as a whole” All hell broke loose when a group calling themselves the Guardians Of Peace [GOP] appeared on Sony computers. Within a few weeks, a mountain of data including movies, salaries, and private emails got dumped on the internet. Not only salacious emails of top executives but also Sony employees’ social security numbers, and medical records got leaked online. The White House did not make the discussion about the evidence, but the FBI came up with some details. It was the first time a president has blamed a Nation-state for a major cyber attack on American soil. The FBI announced today that… And we can confirm that North Korea engaged in this attack. -Barack Obama Bret Leatherman is a Special Agent in the FBI’s Cyber Division. Based on what’s publicly known, the hack seems to have gone down in four phases. Phase 1 - Spear Phishing. Phase 2 - Privilege Escalation. Phase 3 - Data Theft. Phase 4 - Data Destruction. The Approach First - Spear phishing, was likely how the hackers got into Sony. Somebody within a company or organization would receive an email that looks like a legitimate email that might contain an attachment or a link to a website and once you click on it, you may be directed to a malicious site or you could have triggered a malicious program to run in your computer and thus compromising yourself. For hackers, it is like gaining border access, their piece of software inside the network will let them expand from the border. Second - Privilege Escalation, Once the attackers get inside the network, their very first step would be escalating their privileges. The attackers were looking for users like “admin”, “CEO” or “CFO” because they have greater access to system files than ordinary employees. Since the malware affected the entire network, this phase was not hard for them. Third - Data theft, After gaining god-like access to the network, attackers began to exfiltrate the data. It is said that it might have taken several months for the attackers to exfiltrate all the data from the Sony network. Forth - Data Destruction, Came the grand finale and this phase makes the Sony hack a unique one. The malware was very much destructive that it almost destroyed all possible documents and files from the Sony network leaving them bare-handed. But still, all these conclusions made by the FBI did not prove the origin of the attack. How was the U.S Government so sure it was North Korea? Beyond the FBI, the NSA - National Security Agency one of America’s top-notch spy powers was reported to have evidence that it was North Korea. But the NSA won’t confirm or deny anything. Clever guys right? A few weeks after the hack FBI released vague evidence pointing to North Korea in which security experts and hackers quickly found holes and poked them loud. All these controversies led hackers and security experts to think if it’s really North Korea that is behind the curtains or any other. First of all, the agenda changed substantially at several points throughout the hack. That kind implies multiple different actors to me. -Marc Rogers As Head of Information Security at Cloudflare said, at first the email demanded money which actually doesn’t point to North Korean hackers because they are not unemployed or wandering for money. These all exactly create doubt that North Korea is part of the party. If yes, who else was at the party? Marc Rogers In 2011 - “Anonymous”, A notorious hacker group launched a DDoS [Distributed Denial Of Services] against Sony websites to protect George Hotz also known as Geohot, the first guy to jailbreak an iPhone when he was just 17. A few years later he again jailbroke a Sony Playstation 3 which Sony doesn’t seem to like. So maybe Anonymous was one among the party. Another interesting story about Sony being a target for hackers is in 2005, security researchers found suspicious software on CDs by the Sony BMG - Sony’s music division. The software that was on the CD did two things; First, it made computers incapable of copying music. Second, the software hid so you won’t be able to uninstall it. All these incidents made Sony a favorite and potential target for hackers at every step. Real Evidence? As a contradiction with the opinion of Marc Rogers, here came - Principal Security Researcher, Kaspersky Labs who think North Korea really is to be the one to blame. Kurtz is an expert in analyzing malicious code and coming up with defensive solutions. The Sony hack malware resembled the “ ” on South Korean Banks. There was also an interesting resemblance in both of the malware in that the word “Security” was misspelled in the exact same way. Kurt Baumgartner darkseoul attack - 2003 This led to the conclusion that both the malware shared a common code base. Also, both of the malware were of the “Wiper” category which wipes all the data from the targeted systems. All Though from these understandings it’s still unclear because there is no trace of association between North and South Korean hackers regarding this. Since those code bases are available open to hackers and each will have different versions of them and that is totally a common one. But wait the FBI got another one to put out. The Malware Source code did contain some IP addresses which indicates the computer’s location. FBI said those directly pointed to North Korea but this isn’t conclusive either because IP addresses can be easily faked in milliseconds. Okay for some moment let’s turn our pages to the side of Sony Pictures Entertainment and how they perceived this attack. Maybe the company should have had better security. It is pretty noticeable from blogs and research papers that the attack was not much sophisticated but still, it was successful. That may be because Sony company had less secured networks and followed Security practices inconsistently. Ultimately it all boils down to a fact that really matters how Sony should have defended this attack rather than a fact showing proof of the origin of the attack. Whether it’s North Korea or Russia who cares, It’s about people who got affected and held victims in the end. Matthew Preusch is an Attorney who represented Sony employees in the lawsuit against the studio. He said Sony didn’t do what a reasonable company should have done to protect private information on its system. The Poorness was able to be seen clearly starting from poor encryption methods and poor data segregation. But Sony Pictures declined to comment on these allegations and settled the lawsuit out of court. But it’s undeniable that private information that was leaked is going to be alive forever on the internet. so the real victims are the Sony employees. Whether it is North Koreans or Bored hackers, all competing theories lead to one conclusion that attributing a cyberattack is merely possible. Also published here. Feature image source.

From Breach to Fallout: The Story of the 2014 Sony Hack 

Chances are at some point in your internet travels you’ve stumbled on a warning that reads something like “Your connection is not private. Attackers might be trying to steal your information.” The page usually gives you an option to proceed to the website anyway. But should you? Why Did I Get Rerouted to This Page? Today, we conduct more activities online than ever before: paying bills, buying groceries, and interfacing with doctors, to name a few. With more of these websites requesting personal information, we rely on our web browser’s security practices to ensure that our data stays safe. Each time you visit a website, your web browser (e.g., Chrome, Safari, or Firefox) first checks for the existence of one of two digital certificates: a Transport Layer Security (TLS) or Secure Sockets Layer (SSL) certificate. These indicate two important things. First, they confirm the identity of the website, affirming that the website is who it says it is. Second, they verify that the information on the website—and any data you share with it—will be secure and encrypted. Encryption ensures that the information you share, whether it’s a credit card number or home address, will not be intelligible if intercepted. You can tell if a website has a valid certificate by clicking on the small padlock to the left of the URL or by looking for “HTTPS”—not “HTTP”—at the front of the website link. The use of HTTPS indicates that the website uses a secure certificate to move information across the web. In 2014, it would use the existence of a certificate as a quality factor in its search results, placing safer sites higher in those results. Google announced Then, in 2018, the company that its Chrome browser would flag all websites without a properly configured certificate (either TLS or SSL) and display the “Connection Not Private” window to warn users. Other browsers have . announced adopted similar measures As a result, when you browse the web, you may receive variations of this message when you try to visit some websites. Will My Information Really Be Stolen If I Proceed to the Website Anyway? Possibly. The Connection Not Private window could be triggered by a poorly configured certificate, one that’s only recently expired, or one that’s missing entirely. Visiting websites that don’t have proper encryption can put you at risk for a number of cyberthreats. Your information could be intercepted as it travels across the internet in what security experts call a . Bill Budington, a senior staff technologist at the Electronic Frontier Foundation (EFF), said this most often occurs when someone hijacks your Wi-Fi connection, tricking your device into thinking that the hacking software is the access point your device should be connecting with. “man-in-the-middle” attack This process gives the attacker access to your internet traffic and any data you provide to a website. “Whether this means a nation-state tricking its citizens into thinking it is google.com or a hacker tricking a coffee-shop patron into divulging the domains the patron browses, the result is the same,” said Budington. “It means a compromise of sensitive data that was never entrusted to that untrusted party, and the possibility of impersonating the target or retrieving a history of communications in the sites they’ve visited.” This is especially dangerous when visiting e-commerce websites, where customers routinely enter sensitive information like their address and credit card number. Once intercepted, this information can facilitate identity theft, which . hit a record high in 2021 One white hat hacker to see how easy it is to intercept unencrypted information online. While his software did not collect actual user information, it connected with 49 devices in a single afternoon at the mall. performed his own experiment Visiting websites without encryption also leaves you vulnerable to ransomware attacks, which can occur when a user visits an infected website and malware is secretly downloaded to the person’s device. The malware enables attackers to hold users’ files hostage until they pay a ransom. Lastly, ignoring the warning and continuing to the site leaves you open to , where attackers pose as a trusted website to lure users into sharing financial or other sensitive information. phishing attacks In this case, the Connection Not Private message is triggered because the certificate of the website isn’t authentic. If a user types in their bank’s URL and sees this message, something has gone awry because the bank’s website would certainly have a working certificate. What Should I Do When I Encounter a Warning Like This? As a first step, security expert and Harvard faculty associate Bruce Schneier recommends making sure you are trying to connect to the correct URL. After that, Schneier says it usually comes down to a judgment call. For example, if you click on a link in an email from a sender you don’t know and you get the alert, you shouldn’t proceed. But if you correctly type in a well-known URL, you are likely fine to continue, he said, because it’s probably “just an error.” According to Schneier, there are many benign reasons that would trigger the alert, such as the recent expiration of a certificate or a mismatch between the typed URL and the name associated with the certificate. There are ways to figure out what triggered the warning. The message is often accompanied by an error code, which you can look up. For example, the error NET::ERR_CERT_COMMON_NAME_INVALID usually means that the name on the certificate does not match the URL entered. Another common reason the window will appear is if you are browsing by public internet in places like the library or an airport. Public Wi-Fi is more susceptible to man-in-the-middle attacks from people on your local network. It is therefore more important to use HTTPS when on public Wi-Fi, as this will help protect against attacks from people in your vicinity. If you want to make sure the error wasn’t a fluke, you can try restarting your computer, clearing your cache, or moving to a private Wi-Fi connection to see if the error persists. Perhaps it does, but you’re determined to visit the site anyway. If you’re browsing on Chrome or Firefox, you can usually select “Advanced” in the error window and then click the link to proceed to the website. Again, be careful about entering personal information—from passwords to addresses—as it won’t be protected on these websites. And Schneier cautions that while a verified certificate confirms that a website is encrypted, it can still be malicious in other ways if the website owners have ill intentions. Corrections A previous version of this story stated that data is not encrypted if there is a certificate name mismatch. This is not correct. That version of the story also incorrectly stated that public Wi-Fi is less secure because it uses HTTP instead of HTTPS. The Wi-Fi network’s security and the website’s HTTPS status are unrelated. Wi-Fi networks secure the connection between the user's computer and the router, whereas HTTPS secures the connection between the user's browser and the server hosting the website. Written by: Eve Zelickson Also published here Feature image source

The “Connection Not Private” Warning Explained

Explicación de la advertencia "Conexión no privada"

L'avertissement "Connexion non privée" expliqué

"कनेक्शन निजी नहीं" चेतावनी की व्याख्या

「接続がプライベートではありません」という警告の説明

Explicação do aviso "Conexão não privada"

Giải thích cảnh báo "Kết nối không riêng tư"

“连接不是私人的”警告解释

Music is one industry that has evolved a lot in the advent of digital technology. From the days when we had to buy albums in stores and burn them on CDs, music is now readily accessible in digital format at the click of a button. But not all have been singing praises for this evolution. Artists and producers alike suffer from the excess baggage of digital technology. As much as the web has helped make music accessible to all, it has also created an avenue where people can illegally download and share music without any consequences. Both independent producers and large music labels face massive losses in revenues due to piracy. In addition, it has become overly challenging for producers to track and monitor the usage of their work by other people, including fellow producers. And even if listeners do stream music legally through platforms like Spotify and Apple Music, the creator ends up seeing very little profit. For example, Spotify . So even big acts that get millions of streams don’t make much money — a million listens only equals a thousand dollars. To put this into context, , one of the biggest bands in the world, has just over 800,000 streams in Canada for their most popular song ‘Sex on Fire”. (No wonder they are ). generally pays between $.003 and $.005 per stream, meaning you’ll need about 250 streams to make a dollar Kings of Leon getting into the NFT game While the fans get to enjoy a remarkable music selection thanks to streaming, musicians are left with very little to show for their work. Till now, there haven’t been any alternatives for up-and-coming musicians to make a name for themselves and generate enough revenue to support their music career. But this is about to change. The Making of a Revolution Music production evolved from analogue to digital, paving the way for increased accessibility. Using nothing more than a laptop and an internet connection, up-and-coming artists can strut their stuff on equal footing with well-established names. Major recording labels are already turning to new ways of doing things not to be left behind. Some have even cut deals with tech companies like Spotify and YouTube, looking to improve their bottom line. Then there are independent labels using crowdfunding and other alternative sources of financing such as Patreon. But the real revolution is happening now as a direct result of the rising and increased adoption of blockchain technology. With a secure immutable digital ledger at its heart, blockchain is ushering in a new era of transparency, traceability, and security for all transactions and records. It brings accountability and essentially eliminates the very problem that has been plaguing the music industry for so long. Blockchain technology enables the use of cryptocurrencies which allow anyone from anywhere in the world to pay for music, and support the artists they love. Musicians can also use cryptocurrency to purchase licenses to the music they want to produce. With billions of unbanked and underbanked people in the world with no access to financial services, credit cards and other electronic means of payment, this is a game-changer. The ledger that blockchain technology uses to keep a record of all transitions is designed to prevent any tampering, and whenever you purchase or sell music on your blockchain-powered system, they are recorded for everyone to see. Projects, startups, and companies utilizing blockchain technology to change the game include: a music rights marketplace that allows music fans to fund the artists, songwriters and producers they love more directly, and in exchange, fans can receive royalties earned from their favourite recordings. Vezt: a decentralized platform that creates a database of music ownership rights and automates royalty payments. Ujo: a music streaming and digital payment platform that uses blockchain to fairly pay artists in a timely manner. Choon: a collective of artists, musicians and music lovers looking to empower creatives in the music industry. Mycelia: a blockchain-based music distribution and royalty management platform that rewards both artists and fans. eMusic: The Revolution Goes Mainstream While blockchain technology has a lot to offer to musicians and the music industry, it wasn’t until the explosion of NFTs onto the art, culture, and music scene this year that blockchain became more mainstream. , a blockchain innovation that has been somewhat dormant and in slow evolution for the past 4 years, but since the beginning of 2021 it has dominated the day-to-day conversation on every level, from niche tech circles to clubhouse rooms, social media, mainstream media, and even regular people on the proverbial street. NFTs Before NFTs news of cryptocurrency prices cast a shadow on everything blockchain, and at times when the prices were in a slump negatively impacted the whole industry. An NFT is a unique digital token, a piece of programmable code, akin to a deed of ownership of a unique item. The item can be anything from physical painting to digital artwork, a piece of music, intellectual property, domain name, patent, a piece of content, and much more. Virtually, anything and everything you want to sell and people want to buy can be turned into an NFT. The power of the NFT is in the underlying technology, the blockchain. When created or “minted” in NFT slang, NFTs are recorded in the ledger of the blockchain they belong to. Most NFTs are being created on the Ethereum blockchain. Other blockchain networks include Flow, Tezos, EOS, WAX, and Near. Every transaction involving an NFT on the Ethereum blockchain for example is recorded in the tamper-proof immutable ledger of the Ethereum blockchain which is publicly available. That means anyone and everyone in the world can know at any given moment who owns that NFT, i.e. who owns the item that the NFT represents. No need for any third party to track the ownership or prove it. The value of NFTs only grows from there. Because they are more than just paper deeds of ownership, they are digital pieces of code that can be programmed to do all kinds of cool things. Most importantly they can be programmed to send a piece of every secondary sale to the original creator of the item. This is a simple but revolutionary step forward for artists who no longer have to sign agreements and pay people to calculate and collect royalties, they can now rely on the code of the NFT unfailingly executing every time a transaction takes place and their share of the transaction will immediately show up in their crypto wallet. The Evolution of The NFT Revolution In the past 4 years, NFT sales volume has been under $100M but since the start of 2021, sparking massive interest and causing many to look at NFTs as the way forward for blockchain mainstream adoption. sales volumes surged to $10B , a company that has made a name for itself in the startup crowdfunding space with its innovative approach to the industry now hopes to revolutionize money-making in the world of music using a new form of NFTs. Republic According to Republic “ combine NFT technology with an innovative investing framework. S-NFTs make it possible for fans to invest capital toward a new song or album and in return, get ownership in the royalty rights.” Security NFTs (S-NFTs) Building on the idea of allowing everyone to become an investor in startups, a radical change from the convention, where only the rich and accredited investors could invest in private companies, Republic seems to eye the music industry and allow everyone to become an investor in music. Security NFTs (S-NFTs) combine the ownership and transparency of NFTs with an innovative investing framework making it possible for fans to invest capital toward a new song or album and in return, share in the royalties. Artists and musicians have been selling their albums and songs as NFTs, however, no mechanism exists to tie the returns from streaming distribution to the NFT. Republic is one of the first crowdfunding platforms to offer a type of investment that allows fans to buy the music rights to a song or album. It does that through special membership units of an LLC that owns the rights to a song, album, or equivalent. The membership interest may be represented by a non-fungible token (an NFT) which is a representation of that ownership and the vehicle in which returns are distributed. Republic is challenging the traditional paradigms and roles in the music industry. by making you more than a fan, you are an investor, and your playlist is more than just a collection of songs, it’s your portfolio. You can now go beyond buying some merch and donating to the artist you love, you can invest in the music you love and get to share in the returns. Experience Your Investments! For the longest time investing in was a way to grow your money, support entrepreneurs and businesses you believe can succeed, or advance a cause you believe in. Everything else you spend your money on like music, concert tickets, games, collectables, and subscriptions is called consumption. However, with NFTs you are no longer just a consumer, you are an investor, and thanks to this innovation made possible by blockchain technology you can experience your investment, listen to them (songs), attend them (live performances), engage with them (artists meet and greet) and so much more. By allowing regular people to fund an artist directly, Republic cut’s out the middleman and allows fans to directly support the artists fixing a major issue in the industry that pays creators only 12% of the revenues they generate. Republic is starting strong with hip hop artist 5-time platinum artist Lil Pump who has 7.8M monthly listeners and 1.8B Youtube views, in addition to KSHMR voted one of the Top-100 DJs by DJ Mag 6 years in a row and has 7.6M monthly streams and 250M Youtube views. With probably more to come, the fans of those artists will most likely welcome the opportunity to invest in their favourite artists’ songs and earn returns from streaming royalties, remixes and more in addition to exclusive perks like access to tickets, merch, special events and more from the artists. Crowdfunding The Future For decades, in the music industry and reaped most of the rewards. Blockchain technology gives power back to fans and creators and is capable of democratizing every aspect of the industry, but until now only a few could harness the capabilities blockchain has to offer. few middlemen held all the power NFTs encapsulate much of the magic and horsepower of blockchain technology and put it in the hands of creators and fans. And just like crowdfunding transformed the funding game for many startups, with Republic’s entry into the space and the introduction of Security NFTs (S-NFTs), the music industry and the lives of many musicians and fans will be transformed in ways the big labels can never predict and may not be able to compete with. The question to you and I is which new artists will we support, which new music will we invest in, and how long before the impact of our choices is felt and seen in every corner of this new blockchain world.

How NFTs Can Turn Musicians Into Entrepreneurs and Fans Into Investors

Ever since technology was introduced into the business world, there has been a massive change in the fortunes of business sectors. So much so, that every established business sectors and upcoming sector, look to technology to either scale them up or maintain equilibrium, or in case of emerging companies, give them that initial push so that they can get to the autopilot mode. One Industrial sector that plays a huge role, in helping the economic growth of any country, and creates a difference, is the Healthcare sector. The Healthcare sector is often considered to be the most vital sector and equally complicated too, more so as it involves giving the right medical attention to the needy at the right time. The pre-internet area would see a huge process attached to every activity, involved in following a medical procedure, but ever since, technology took over, there has been a sea of change. One such huge contribution from technology towards the improvement of the healthcare system is the introduction of IoT in Healthcare. IoT in Healthcare The Internet of Things or just IoT, as it is more prominently known as across the world, has been nothing short of a phenomenon and revelation, right since it was introduced. With IoT bringing along a host of very attractive features like connectivity, safety, integration, analysis, Endpoint management as the most important being, the , it was only a matter of time that Industries got attracted to this super technology, which changed their fortunes altogether. use of Artificial Intelligence Now, with IoT in Healthcare, there has been a major shift in the way complex procedures have been simplified to the advantage of both, the patients as well as healthcare service providers. What is it in IoT that Healthcare looks much more advanced and organized now? Let’s take a closer look. Significance of IoT in the Healthcare Industry Before the introduction of IoT, the healthcare industry continued to face challenges with respect to setting up a responsive and professional system. Especially, with aging being a natural process, access to the right medical care at the right time for senior citizens, was always going to be a challenge, if not impossible. Though technology can’t bridge the gap completely, it could do wonders to make the process faster and easier and relieve the patients from the all-important stress factor, which is one of the main causes for chronic diseases to increase. The influence of IoT in healthcare has just about managed to achieve that. Areas Under the Healthcare System Where IoT Can Be useful Quick Access to Doctors The erstwhile medical system was full of complexities, especially when it was concerning the basic minimum facility for patients in need; the access to the right doctor at the right moment. Even though this was achieved, for every variation in the patient’s health condition, it involved either the patient to travel to the doctor, against all odds or the doctor having to come and see the patient at his place of residence. But with technology in the form of IoT being introduced into the healthcare system, lot of these issues have been more or less sorted out. Doctor these days are at a huge advantage at being able to remotely monitor the heath of a patient, from wherever they are and recommend the right quality treatment, without loss of time. More importantly, it has been able to help reduce travel cost for both as well as creating a continued engagement amongst both of them at all times. 1. The Patient’s Perspective IoT in healthcare has served as a big plus point for patients too as with attractive and creative, IoT devices, in the form of warbles, can now help them to know the status of their health. Especially, elderly patients are at an advantage, because it can help them track their health conditions, with the use of wearable like BP and Heart rate monitoring cuffs and Diabetes monitoring equipment. These devices are tuned in a way to keep the patient alert on any variations in their health condition. : 2. The Healthcare Centre’s Perspective The Healthcare Centre or Hospitals could be equally, big beneficiaries, by implementing IoT in their healthcare system. In addition to monitoring patient’s health condition, IoT enabled devices with sensors, can help track the availability of critical hospital equipment and SOS equipment like wheel chairs, stretchers, nebulizers, oxygen cylinders etc. So that they are readily available at all times to help patients in extreme emergencies like cardiac failure, serious accidents and other critical conditions. 3. The Health Insurance Perspective One of the very important activities which complete a professional healthcare system is health insurance. With every medical treatment attaining very high costs, a well-organized health insurance is of paramount importance. Health insurance companies can also leverage of the advantages of IoT. A more professional approach and system can be set up to process claims, thereby helping the companies to improve the trust factor with customers. This way, even fraud claims can be detected and action can be taken. Major Takeaways by Using IoT in Healthcare 1. Quick reporting and Monitoring IOT devices help in monitoring health care situations in real time. These devices, when connected to your smartphone, help transmitting real time data, which can be accessed by the physicians immediately, especially during extreme emergencies and they can decide on immediate medical treatment. The critical data can include BP and Sugar levels, oxygen levels and ECG readings. 2. Cost Savings Excessive travel. To and from, for either patients or doctors could be greatly reduced, resulting in cost savings as IoT devices can help in real time patient monitoring. 3. Flawless Communication Exchange Transmission of medical data from one physician to another is extremely vital, when it comes to inter departmental consultations. With IoT devices, these communications can be streamlined, resulting in authentic data being transferred and received in between physicians and thereby improving medical service. 4. Faster Disease Diagnosis IoT in healthcare is a major step forward which has facilitated continuous patient monitoring and real time data, which helps in diagnosing diseases at an early stage. 5. Data sorting This is a very important activity which IoT can perform. A large amount of data which gets transferred is usually to retrieve at the critical moment when it is required. IoT devices can help sort out data as per the categories required so that it can be accessed by the relevant physician. 6. Drugs Management Another critical area involved with the healthcare industry Management of drugs and medical equipment. With sensors which could be attached to IoT devices, these can be easily monitored, especially, medical equipment 7. Error Reduction IoT in Healthcare not only helps in efficient patient administration but also can prevent fraudulent data from being transmitted, thereby helping establish an efficient and fool proof healthcare system. Conclusion IoT in Healthcare is one of the best things to have happened to the sector in recent times. Technology accompanying IoT, has transferred the beliefs of common man on the Healthcare sector, and made it more assuring. With every related activity in the healthcare sector being benefited, IoT applications are a sure hit amongst patients, families, physicians, hospitals and insurance companies. Implementing fool proof security measures is crucial. IoT explores new dimensions of patient care through real-time health monitoring and access to patients’ health data. Hence, adapting to this supreme gift from technology  would prove to be the differentiator in the increasingly connected world.

How IoT Solutions Helps in Healthcare Industry

Security issues of crypto exchanges and shared my thoughts on how to make trading convenient and safe - Viktor Kochetov, CEO at Kyrrex , a digital wallet and professional cryptocurrency trading. By and large, bitcoin is not susceptible to security problems; it is an asset that has value due to speculation on it. Of course, a successful hacker attack on a large cryptocurrency platform can weaken bitcoin’s position, but this also applies to the entire market. Cost reduction of crypto assets will occur only due to the fact of trade volumes; this happens because of the unstable psychological climate — hype around market security. But, in general, bitcoin and the companies engaged in activities with it, will easily return their positions after the information dust settles. Even top exchanges are losing millions. The perennial problem is that the attack is always ahead of the defense due to its unpredictability and non-systematic nature. It is difficult to anticipate the next step intruders will take. Companies go through trial and error —  they react to precedent. Sometimes companies themselves hire specialists who must find weak spots in the system. It all works great, but the attackers, too, never sleep. Their schemes go far beyond technical hacking of platforms, indeed, they also resort to the use of human relations. Social engineering, NLP, and the simple deception of gullible people, lead to one thing — hackers acquire access to user assets on a particular platform. The first six months were pretty harsh for crypto exchanges: seven of them fell victims to massive attacks. Source: Cointelegraph As per data, the USA is the primary and the most attractive target for hackers, and every third victim is actually American. Russia and China take the second and the third positions respectively. When talking about criminal C&C servers, could you possibly guess their whereabouts? The dominant majority of them are located in the USA (56,1%), Netherlands, and Ukraine and Russia follow behind. Hot For Security As of July 16, 2019 the average bitcoin transaction volume exceeded $3,22 billion per day, which is 210% growth since April. The bitcoin network soars and the crypto community expands. Given this, the question of security becomes more thorny than ever. Crypto security: why it matters Both credible crypto businesses and hackers, two opposing worlds, leverage the same technologies. The first ones are focused on broad objectives and higher purposes, while the intruders keep their eye on the ball, maintain a sharp sense of the latest market developments, and use every chance to be on the same page with it. But what about crypto exchanges? Are they really in line with hacking trends? It seems like these two worlds are spinning at different speeds. Tangible and intangible losses, plus reputational damage, raise the question of corporate security posture, safety philosophy, and attitude towards this challenge and its magnitude. In other words, is security paramount for this or that exchange? We are far from saying that there are still businesses engaged in crypto that underestimate the potential damage from attacks and prefer to rely on the law of averages. Any self-respecting platform devotes its time and resources to reducing the risks of potential attacks on a daily basis. Throughout the history of crypto industry there were hacks of various scales. In view of this, each platform adopts all new methods and systems to ensure the safety of its users. Security matters for one major reason; exchanges have immense cryptocurrency volumes, and if hackers want them, they will get their hands on assets via hot wallets. If they have your keys, they have your bitcoin, and you cannot get it back. In terms of financial well-being, the sense of safety and trust is more important than  any other aspect. Human after all There is a popular belief that a crypto exchange cannot be 100% secure. We do not support this kind of rhetoric because security is not that black and white, it is nuanced. On the one hand, the exchange can be completely safe from a technical point of view, and the human factor will play a decisive role. As long as platforms are created by humans there will always be the possibility of error. It is becoming more and more difficult for intruders to go through technical “circles of hell” built by the security system. So they try another way — human imperfection. A series of resonant attacks were carried out with huge help from the human factor (the thirst for easy money, gullibility, ignorance, etc.) Also, there are cases where personal data of stock exchange employees was stolen simply because some staff members were not prudent. Yes, we can and should talk about 100% protection of exchanges, however, we should not forget about the nature of cryptocurrency and its initial idea. Cryptocurrencies are created with the implication of anonymous decentralized use. This essence is something the attackers will always exploit. Suppose there is a system which is flawless from a technical standpoint and its users are cautious and aware of cryptocurrency functionality and security measures. In this case, we can say a system is completely safe. Vulnerable areas Today crypto exchanges have five major weak points which are precisely hit by attackers: high susceptibility to phishing, insufficient or absent hot wallet protection, unsecured staff credentials, software flaws and malleability of transactions. The concept of crypto exchange security breaks down into four dimensions: user safety, registrar and domain security, DoS security, and Web security. Let’s dive into each of them: implies content flaws in exchange codes, the acceptance of weak passwords, 2FA availability, and action confirmation via email. User safety is about the availability of registry lock, role accounts for employees, DNSSEC, and expiration date for high profile accounts. Registrar and domain security means protection from Denial-of-Service attack and implies resilience to MITM, Clickjacking, Heartbleed, POODLE attacks, and availability of HSTS header. DoS security means security of web protocols, the availability of headers that ensure attack protection — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and X-XSS-Protection headers. Web security Last year, the situation with security across 140 analyzed crypto exchanges was quite saddening: Source: Sqreen The figures above reflect the reality: there is no correlation between crypto exchange trade volumes and its security posture. Defense in practice In addition to standard security systems such as multifactors client authentication (for example, 2FA), we consider it crucial to provide additional layers of security. They come in the form of additional (unique) codification of operations confirmation (various QR codes and CAPTCHA), and the formation of modules that store access keys on user devices for signing operations (tokens). We realize the urge of keeping up to date and moving with the times. Therefore, it is essential to adapt innovations in the cryptocurrency world. And go even further than that. At a certain point we felt the need to separate financial operations of platforms from operations with own funds. Being more scrupulous about security, one will come to the conclusion that various entry points imply different levels of security. Anti-fraud algorithms are used for active monitoring and  safe-watching of customers` financial transactions, operations with exchange`s own assets, for sounding the alarm of unusual behavioral patterns, blocking and rejecting of  automated operations, and for users and security manager notifications. The combination of technological security, cluster security (separation of operations), and logical security, create an unbreakable barrier for intruders. The security management process is based on the system improvement principles. The system is divided into accessibility modules by various types of information and its processing, such as: personal information about the client, operations, balance sheets, commands and functions, etc. Each module has its own security level which is individually checked for threats, and the threat handling process is built for each level. The “new” threats are monitored and the level of resilience is checked for the threat that has arisen in the context of the modules. Graphically, this can be displayed as follows: This process allows the system to maintain a threat list and constantly adapt the security system. At the same time it is vital to keep in mind that, in the realm of IT, an attack always advances protection. Therefore, modularity and levels allow for the prevention of threats at an early stage and reduce losses. The system, as a whole, adapts to new challenges rather quickly. This management process is logical and justified by the time and behavioral models of network participants. To regulate or not to regulate? Not the question People who have a vague idea about cryptoworld as a  financial system do not express much trust in the power of regulation. If they could walk a mile in our shoes they would definitely see the strong bond between regulation and security. Regulated platforms are accountable organizations, which means they have something to lose. They have no other options, loopholes, or chances to compromise decency. They operate under the sword of justice, therefore, they must follow the prescriptions of the regulatory body. The exchange without regulation can afford to cut down on some trifles, but this will inevitably lead to large-scale losses for its users. Registered crypto projects are not only attractive in terms of security; regulation establishes ethical, moral principles and constraints business will never step over. These exchanges allow traders to rest easy and deal with things in a safe environment.

Security in the language of crypto exchange: providing traders with peace of mind

Cyber-security experts have been running around educating people on cyber-attacks and threats but the most interesting bit is the number of misconceptions that businesses have in the realm of implementing cyber security solutions. Take an example of the number of companies that carry the myth that security implementations are expensive or perhaps difficult to handle and as a result, they resort to cheap, ineffective methods that end up being costly and time consuming. Well, it is no secret that hackers today have evolved their techniques and recognized that cyber-attacks are highly lucrative. Think of it this way, hackers might access your sensitive data such as credit cards or SSN details and sell them in the black market. Therefore, it is time to look at some of these misconceptions and dispel them or in other words let us straighten things up! Myth#1 — It is expensive to upgrade security systems It is a common assumption that an upgrade necessarily means that more money will be spent in fact; in some cases, the cost might even be lower! However, any company looking to upgrade their security systems has to think of the cost of the upgrade and budget for the process. If your company still prefers to use outdated security systems that can easily be hacked into then it might suffer a greater cost at upgrading the system and recovering back the data but not forgetting the difficulty in winning back the trust of your clients. This implies that constantly updating the system is cheaper as it relates to bug fixing and update of software and hardware. In other words, it will be expensive if you wait for years to update your system or to fix a system that has already been breached. i.e. Enabling HTTPs on your website will cost thousands but in real scenario, it is available at fair price nowadays, which will help you protect data traveling between two ends. Truth: Myth#2 — Changing Security Solutions can lead Vulnerability to cyber-attacks and Cause Downtimes It is myth that updating the security system or installing a new one might create such a loophole. Organizations want systems and security solutions that function around the clock to ensure that the data is safe. Leaving the business exposed for even the shortest period might open up a spot for cybercrime-loopholes for stealing intellectual property, financial information and other data that would be a massive blow to any organization. Policies should also be reconfigured before the security replacement starts so that the set guidelines can be followed to the latter. This ensures that the new system is well installed and functioning properly as soon as possible without leaving the organization vulnerable to attacks. Truth: Myth#3 — IT personnel have little time to implement a new Security Solution It is true that the IT department is an essential department in a company and most of times they have projects going on and deadlines to meet. However, the beauty is that these solutions can be made easy by managing the implementation through a single console! As a result, business leaders in companies are usually worried when there are new security implementations to be made by the already busy department. This is where the incumbent solution is eliminated and replaced by a new solution with all this being managed from a single location. The process will ease the work of the IT department and save on operation costs. Truth: Myth#4 — Security implementation will affect end user experience. Most companies are scared of hurting customer experience during security implementations and rightly so. To alleviate of this, it is vital to use the right tools and plan appropriately when performing security implementations-especially, where end users are involved. System updates especially in data centers should be scheduled during off-hours to avoid slowing down the company operations and inconveniencing the clients and employees altogether. Even automation of security implementation will also cut manual efforts to be invested install the system. Truth: Myth#5 — A Company will not get support after the implementation This will depend on the vendor you choose but in most cases, basic support is provided to your company after the security solution has been offered. The main cause of worry is that there is no continuous support after implementation. On the other hand, companies that want higher levels of support that should have the option of purchasing the support that best suits the needs of the company. Many software providers frequently release updates than other providers especially in security products that are another reason from the security perspective while choosing a vendor. Truth: Myth#6 — Information security is not that important Of course, if you have never been a victim of cyber-attack then you will not take the matter seriously. However, the risks are very real just google around and check reports on the vice to get a glimpse of the size of the problem. Therefore, it is up to you to take initiative and protect yourself and your customers before to become a victim. Poor cyber security leads to attacks, malware and phishing attacks, your personal or company data can be lost or corrupted and your reputation will be ruined. Even attackers target smaller businesses as they have little expertise, policy, and tools to prevent security attacks. Truth: Myth#7 — I am not big enough to be attacked Just because your company is small, it does not give you a free pass against an attack. Cyber criminals do not necessarily look at the size of the company but the protection that they consider. For example, interconnected systems can randomly be attacked using automated attacks to identify vulnerabilities and if there are loopholes in your systems, you will surely be compromised. If these systems have no useful information, attackers can use it for performing other system attacks. Truth: Myth#8 — I can protect myself with an Anti-virus Let us just say an antivirus is just one-step towards protection but you need to do more! Antivirus cannot prevent many forms of attack from entering into computer. If you use the internet for example, you are exposed to many forms of attack e. g Man in the Middle attacks, SQL injection, and XSS attack. In some cases, spyware can be installed to monitor what you do online and worse even, to control your system(s) remotely. So products like SSL Certificates (enables HTTPS), Anti-Malware scanner, Vulnerability Scanner, SQL prevention Applications, etc. Truth: Myth#9 — An attack cannot come from within the company. This is a huge misconception that you have not enemies within the organization. When you hear of the word cyber-attack, you may be fooled that it is all about external threats only. Internal attacks can either be intentional say maybe a bitter employee sabotages the company’s security and data. In other cases, it can be accidental say an employee downloads malware from the internet. The company should therefore set strict rules on what sites are accessed over the internet and what kind of material is to be downloaded, additionally company should also focus on BYOD, BYOP and BYOT policies, to avoid attacks. Truth: CONCLUSION Cyber Security has grown to be an important facet of business life. Do not let yourself be a victim of cyber-attack with all the information that is provided to you and the wide array of protection options available. All it takes is proper planning and understanding the security needs of the company and you are good to get started! Priya is a Technical SEO at Hopinfirst, a leading mobile app development company which provide best and Services. Author Bio. :- ios app development Android app development

9 Myths of Security Implementation

There are countless statistics available online that points out one thing on what kind of content users engage in — videos. Videos fascinate people and spur audience count to expand tremendously. In 2017, Oxford has chosen the term “Binge watching” as the word of the year, indicating that entertainment has become synonymous to online video-on-demand platforms. Revenue generated worldwide through video streaming industry amounts to a total of US$19,572, as of 2018. It is also projected that a staggering population of 548 million people would channel to video-on-demand websites as their prime entertainment source. This climate in media sharing indicates that the gates are wide open to new ventures in the on-demand arena. Video Streaming and Youtube Monopoly: Though there are a number of video sharing websites scattered online, no other video sharing service has been able to beat youtube since its inception in 2005. This humongous success is owed to 3 major factors that the creators of youtube incorporated in their brainchild — Personalisation, leisurely watchability and a wide range of video choices. Any video sharing platform that is to be built in the future or the ones that are already present online are bound to follow these essential codes to give a user-friendly experience. In order to build a video sharing website that aces the competition in video sharing, there are customizable video sharing solutions available that would make your job easier in building a successful video sharing website and app. Vplayed — A Condescending Video Streaming Solution of Successful Platforms Vplayed is a media streaming solution that has helped multiple global brands to create their own video sharing website like youtube. Since their inception, Vplayed has extensively researched on the climate prevailing around the video sharing arena and has subsumed all the above parameters in addition to the highly flexible customization options. How Vplayed confers the possibilities of success Building an independent video sharing platform yields more benefits than one would anticipate. Vplayed has loaded its solution with multiple pre-built features that have proven to be successful models for multiple global brands. These features are explained in detail below to give a foresight as to why it would be the best option you lay hands on for starting your own website like youtube. Video Players Vplayed uses HTML5 player in default as it offers additional benefits where you can add external links and applications to your videos. The application links can, in turn, be integrated with Skype or email marketing connects increasing the momentum of your circle reach. The HTML5 player is capable of driving the quality of pictures, sound quality, the ability to be adapted via extensions and be compatible cross-platform while being supported across all browsers. In case, if the owner of the website desires to wield a video player of their own to create their video sharing website, Vplayed equipped team would integrate the said player of their wish. Live Streaming Live streaming is a prime feature to be focused on when it comes to building a video sharing platform of your own. This mode of streaming brings in a brand exposure to people beyond your customer target. Vplayed prowesses in live streaming, as it has built highly functioning live streaming websites in the past. There is no definitive way to create a live streaming video that works well that lets the viewers gain knowledge of what your product is. Vplayed’ Live streaming feature provides a channel in which you can directly engage with your customer base without any restrictions. Customizability Though Vplayed has multiple no.of versatile features readily available, the solution always has its doors open for experimenting with new ideas for its clients. Whatever may be the challenge, Vplayed delivers what was asked of the video sharing website and app alongside an incredible UI experience that attracts relevant audience to the businesses. Widgets Vplayed aces the fixture of widgets, as its prime motto is to offer customization from all dimensions. Widgets are the elements that provide fundamental functions to be configured in web and mobile apps. These widgets form the functional units of any well-versed app. Some of the primary widgets in the video sharing websites are ‘Popular’, ‘Featured’, ‘Recent’, ‘Related’ etc with simple drag-drop options. They are the basic functionalities necessary to customize an app and give them their own style. The Off-panel widgets, in particular, proffers features that can be switched off while using the app by the user but cannot be deleted. Smart search Vplayed, by standard, integrates the video sharing apps with smart search engines. These smart search engines allow keyword search within the website. By landing on the specific category of content within a click, it enables platforms to retain viewership and extend the time they spend on the platform. User channels When you pitch in famous and creative relevant content makers to stream videos on your platform, the user base is bound to multiply with potential customers. Vplayed’s video sharing solution has remarkable user channel integration modules that allow the video sharing websites being created to be unique in its own way. Cloud Storage Vplayed uses Amazon S3 bucket that gives platform owners the freedom to store and transcode unlimited amount of data in them. They also provide a source of security and ensures your data is safeguarded from any kind of theft by incorporating encryption models. The adaptive scaling and speckless streaming are added icing on the cake. Multiple user registration Vplayed offers Multiple user registration that comes in handy when you desire to engage with viewers and broadcasters. This feature lets the platform to take up the notch and widen the horizons of streaming capabilities. Security The term being self-explanatory is to be taken into consideration as one of the prime factors. Security is not a parameter to be compromised with. Vplayed offers a three-step security encryption( DRM system, SSL certification & access control) process to safeguard your content from illegal breaches. Analytics Vplayed’s astute analysis such as User behaviour analysis, Current viewership status, Comparative study and Consolidated data report ventures on data to give instant updates provides you with real-time data of the performance statistics of each individual video which would give you an insight of what works the best without spending tons of your investment on content that doesn’t work. Monetization Monetizing your videos is as important as producing and streaming it. Below are the methods through which Vplayed warrants your content to be monetized. — Loyal consumers wouldn’t mind paying a fee for subscribing to quality content. Enabling this option would reap promisable benefits. Subscription — Be it an advertisement of your own co-products or ads of external agents. Ads have proven to work well in streaming platforms. Advertisement — Make money out of every view. By this method, the videos that perform well would be able to fetch justifiable revenues. Pay per view — Sell your content for offline downloads and make money. This monetization model promotes videos to escalate your business. Purchasable asset CONCLUSION: Even though building a video sharing website like Youtube or Vimeo of your own might sound hectic, creating a platform where you can stream HD videos of your own gives a face-lift for your entire business model and increases returns sooner than one would anticipate it to. Now you’ve got an idea on how to make a successful video sharing website that performs magic in its platform, it’s time to take your business a step above the notch with Vplayed’s expertise to elevate the ordeal.

How to Build a Video Sharing Website Like Youtube and Vimeo with Brand New Technologies

Security Tokens Series (5 part series — Part 2) You can also watch our video about security tokens, its advantages and how to identify them . here There is no doubt that Blockchain technology is poised to cause major disruptions in almost all industries in existence by making it possible to create a vast array of new business models. It has brought forth useful innovations such as decentralization and trustless networks. One of the significant factors that has contributed to the success of this technology is the use of tokens. Today, utility tokens and tokenized securities are million dollar concepts that startups across the globe are grabbing onto as they crowdfund. But what do these terminologies mean? How different is a utility token from a security token? Let’s dive in and explore the details: What is a Token? A token is a utility, an asset or a unit of value issued by a company. In most cases, tokens are issued when a company launches an initial coin offering (ICO) — that works more or less like an initial public offering (IPO). The difference between an ICO and an IPO is that in an IPO you receive stock in exchange for the investment you make while in an ICO you receive a token in exchange for your investment. Image: Worldspectrum As we mentioned earlier, there are two primary types of tokens that you are likely to meet in the ICO space: Utility tokens Security tokens Confusion often arises in differentiating between security tokens and utility tokens. Even though they may seem complicated at first, they are in fact very easy to understand as you will see in the subsequent sections. What is a Utility Token? Utility tokens are simply app coins or user tokens. They enable future access to the products or services offered by a company. Therefore, utility tokens are not created to be an investment. Just like an electronics dealer might accept orders for a video game that will be released several months later, a startup can create utility tokens and sell digital coupons for the services or products it is developing. A good example is Filecoin, which raised $257 million through the sale of tokens. These tokens will allow users access to its decentralized cloud storage platform. What is a Security Token? A security token is a digital asset that derives its value from an external asset that can be traded. Therefore, these tokens are subject to federal laws that govern securities. Failure to comply with these regulations could result in severe consequences including penalties and potential derailment of the development of a project. On the other hand, security tokens can offer a vast array of applications if the startup abides by all the regulatory requirements. The most promising of these features is the ability to offer tokens as a digital representation of shares of a company’s stock. For instance, Overstock recently announced that tZERO, one of its portfolio companies, would hold an ICO to fund the creation of a licensed security token trading platform. The tZERO tokens will be issued according to SEC regulations. Security Tokens or Utility Tokens? The major difference between security tokens and utility tokens is in the intended use and functionality of the tokens. Security tokens are created as investments. Token holders are given dividends in the form of additional coins every time the company issuing the tokens earns a profit in the market. Users holding the security token also get ownership of the company. Blockchain offers a platform that can be used to create a voting system that allows investors to exercise control on the company’s decision-making process. Utility tokens, on the other hand, are not intended to give their holders the ability to control how decisions are made in a company. They merely enable users to interact with a company’s services. Both security and utility tokens can increase in value if the prices of the tokens appreciate in the market. And since they can both earn some profit, many people may still find it difficult to differentiate them. Here is the formulated by SEC to enable you to classify a cryptocurrency token as either a security or utility token. Howey test The Howey Test This test uses two simple questions to differentiate between security tokens and utility tokens: Are the token holders allowed to provide funding for the company’s capital and receive a portion of the profits? Does the fundraising effort of the ICO entail investment in the project where profits are generated entirely from the effort of individuals other than the creators or founders of the project? The token is likely to be a security token if the answer to any of these two questions is yes. How does the fundamental difference between utility and security tokens affect ICOs? The securities act of 1933 governs securities in the US. The law has two primary objectives which include the prevention of fraudulent activities such as misrepresentations and deceit and ensuring that those issuing the securities provide financial and other relevant information to the investors. Anyone issuing any form of securities must register their investment contracts with the SEC. Failure to make appropriate registration when dealing with securities can result in fines, lawsuits, penalties or even imprisonment. Some of the important disclosure requirements include disclosures related to proxy solicitations and corporate reporting among others. SEC also oversees the security market to prevent unlawful activities such as insider trading. Companies issuing securities have to abide by essential anti-money laundering (AML) and know-your-customer (KYC) requirements, which are not only costly but also time-consuming. Let us examine the current happenings in ICOs First, startups create their whitepapers, tokens, websites and other marketing materials and then launch their ICO. Most ICOs are actually security tokens disguised as utility tokens through the citing of a number of primary use cases. They do this to evade the regulations governing security tokens. They then employ aggressive marketing strategies that promise investors huge profits. Keep in mind that any security sold with the expectation of future profit qualifies as a security. Yet, some startups often fail to abide by the reporting and disclosure rules and they do not register their ICOs with SEC. Such companies are at risk of facing prosecution. Why the regulators step in The cryptocurrency market cap is currently around 300 billion dollars. From January to March 2018, ICOs raised an estimated amount of about $5 billion. With such vast amounts of money pouring in, regulators were bound to act. SEC is not against ICOs in general. Its primary objective is to ensure that all ICOs comply with the regulations. Attempting to undermine the law presents serious risks for the investors and also for future Blockchain based cryptocurrency projects. In case things go wrong investors have no legal recourse against the malpractices. Earlier this year, they stepped in and officially set up a cryptocurrency task force. By now, the task force has already sent notices to noncompliant ICOs such as Centra and Tezos. Nonetheless, most upcoming Blockchain startups have now realized the importance of complying with the regulations, and several SEC-compliant tokens have been issued. Examples of such tokens include; Polymath, Corl, and tZERO. After the tokens has been issued, they can be potentially listed on licensed security token exchanges such as CEZEX or Openfinance. Final word We hope this article was helpful in enabling you to distinguish security tokens from utility tokens, and their impact in the crypto world. What your opinion on how the fundamental differences between utility and security tokens affect ICOs? Do you believe adhering to SEC rules will go a long way in ensuring the growth of the ICO industry for many years to come? Security Tokens Series (Part 1): 10 Important Things to Know About Security Tokens Keen to find out more about Katalyse? Join our crowdfunding revolution conversation on our Telegram group, or follow us on Twitter.

Security Tokens vs. Utility Tokens — How different are they?

How do you control the number of concurrent state machine executions that can access a shared resource? Here at , we are migrat­ing from our lega­cy plat­form into a brave new world of and microser­vices. Along the way, we also dis­cov­ered the delights that AWS Step Func­tion has to offer, for exam­ple… DAZN microfron­tends flex­i­ble error han­dling and retry the under­stat­ed abil­i­ty to wait between tasks the abil­i­ty to mix auto­mat­ed steps with that require human interven­tion activ­i­ties In some cas­es, we need to con­trol the num­ber of con­cur­rent state machine exe­cu­tions that can access a shared resource. This might be a busi­ness require­ment. Or it could be due to scal­a­bil­i­ty con­cerns for the shared resource. It might also be a result of the design of our state machine which makes it dif­fi­cult to par­al­lelise. We came up with a few solu­tions that fall into two gen­er­al cat­e­gories: Con­trol the num­ber of exe­cu­tions that you can start Allow con­cur­rent exe­cu­tions to start, but block an exe­cu­tion from enter­ing the crit­i­cal path until it’s able to acquire a (i.e. a sig­nal to proceed) sem­a­phore Control the number of concurrent executions You can con­trol the MAX num­ber of con­cur­rent exe­cu­tions by intro­duc­ing a SQS queue. A Cloud­Watch sched­ule will trig­ger a Lamb­da func­tion to… check how many con­cur­rent exe­cu­tions there are if there are N exe­cu­tions, then we can start MAX-N exe­cu­tions poll SQS for MAX-N mes­sages, and start a new exe­cu­tion for each We’re not using the new here because the pur­pose is to the cre­ation of new exe­cu­tions. Where­as the SQS trig­ger would push tasks to our Lamb­da func­tion eager­ly. SQS trig­ger for Lamb­da slow down Also, you should use a FIFO queue so that tasks are processed in the same order they’re added to the queue. Block execution using semaphores You can use the API to find out how many exe­cu­tions are in the RUNNING state. You can then sort them by and only allow the eldest exe­cu­tions to tran­si­tion to states that access the shared resource. Lis­tEx­e­cu­tions start­Date Take the fol­low­ing state machine for instance. The state invokes the Lambda func­tion and returns a flag. The state then branch­es the flow of this exe­cu­tion based on the flag. Only­One­Shall­RunA­tOne­Time one-shall-pass proceed Shall Pass? proceed :Type: TaskResource: arn:aws:lambda:us-east-1:xxx:function: Next: Shall Pass? :Type: ChoiceChoices:- Variable: # check if this execution should proceedBooleanEquals: Next: Default: WaitToProceed   # otherwise wait and try again later :Type: WaitSeconds: 60Next: OnlyOneShallRunAtOneTime OnlyOneShallRunAtOneTime one-shall-pass Shall Pass? $.proceed true SetWriteThroughputDeltaForScaleUp WaitToProceed The tricky thing here is how to asso­ciate the Lamb­da invo­ca­tion with the corre­spond­ing Step Func­tion exe­cu­tion. Unfor­tu­nate­ly, Step Func­tions does not pass the exe­cu­tion ARN to the Lamb­da func­tion. Instead, we have to pass the exe­cu­tion name as part of the input when we start the exe­cu­tion. const = uuid().replace(/-/g, '_')const input = JSON.stringify({ , bucketName, fileName, mode })   const req = { stateMachineArn, name, input }const resp = await SFN.startExecution(req).promise() name name When the func­tion runs, it can use the exe­cu­tion from the input. It’s then able to match the invo­ca­tion against the exe­cu­tions returned by . one_shall_pass name Lis­tEx­e­cu­tions In this par­tic­u­lar case, only the eldest exe­cu­tion can pro­ceed. All other executions would tran­si­tion to the state. Wait­To­Pro­ceed module.exports.handler = async ( , context) => {const executions = await listRunningExecutions()Log.info(`found ${executions.length} RUNNING executions`) input const oldest = _.sortBy(executions, x => .getTime())[0]Log.info(`the oldest execution is [${oldest.name}]`) x.startDate if ( === ) {return { ...input, proceed: true }} else {return { ...input, proceed: false }}} oldest.name input.name Compare the approaches Let’s com­pare the two approach­es against the fol­low­ing cri­te­ria: . How well does the approach cope as the num­ber of con­cur­rent exe­cu­tions goes up? Scal­a­bil­i­ty . How many mov­ing parts does the approach add? Sim­plic­i­ty . How much extra cost does the approach add? Cost Scalability Approach 2 (block­ing exe­cu­tions) has two prob­lems when you have a large num­ber of con­cur­rent exe­cu­tions. First, you can hit the region­al throt­tling lim­it on the API call. ListExecutions Sec­ond, if you have con­fig­ured time­out on your state machine (and you should!) then they can also time­out. This cre­ates back­pres­sure on the sys­tem. Approach 1 (with SQS) is far more scal­able by com­par­i­son. Queued tasks are not start­ed until they are allowed to start so no back­pres­sure. Only the cron Lamb­da func­tion needs to list exe­cu­tions, so you’re also unlike­ly to reach API lim­its. Simplicity Approach 1 intro­duces new pieces to the infra­struc­ture — SQS, Cloud­Watch sched­ule and Lamb­da. Also, it forces the pro­duc­ers to change as well. With approach 2, a new Lamb­da func­tion is need­ed for the addi­tion­al step, but it’s part of the state machine. Cost Approach 1 intro­duces min­i­mal base­line cost even when there are no exe­cu­tions. How­ev­er, we are talk­ing about cents here… Approach 2 intro­duces addi­tion­al state tran­si­tions, which is around $25 per mil­lion. See the page for more details. Since each exe­cu­tion will incur 3 tran­si­tions per minute whilst it’s blocked, the cost of these tran­si­tions can pile up quick­ly. Step Func­tions pric­ing Conclusions Giv­en the two approach­es we con­sid­ered here, using SQS is by far the more scal­able. It is also more cost effec­tive as the num­ber of con­cur­rent exe­cu­tions goes up. But, you need to man­age addi­tion­al infra­struc­ture and force upstream sys­tems to change. This can impact oth­er teams, and ulti­mate­ly affects your abil­i­ty to deliv­er on time. If you do not expect a high num­ber of exe­cu­tions, then you might be bet­ter off going with the sec­ond approach. Hi, my name is . I’m an and the author of . I have run production workload at scale in AWS for nearly 10 years and I have been an architect or principal engineer with a variety of industries ranging from banking, e-commerce, sports streaming to mobile gaming. I currently work as an independent consultant focused on AWS and serverless. Yan Cui AWS Serverless Hero Production-Ready Serverless You can contact me via , and . Email Twitter LinkedIn Check out my new course, . Complete Guide to AWS Step Functions In this course, we’ll cover everything you need to know to use AWS Step Functions service effectively. Including basic concepts, HTTP and event triggers, activities, design patterns and best practices. Get your copy . here Come learn about operational for AWS Lambda: CI/CD, testing & debugging functions locally, logging, monitoring, distributed tracing, canary deployments, config management, authentication & authorization, VPC, security, error handling, and more. BEST PRACTICES You can also get off the face price with the code . 40% ytcui Get your copy . here

Step Functions: how to implement semaphores for state machines

There’s no argument that data is the fuel of the future and the expansion of data has led to the rapid adoption of cloud services. As one of the main categories of cloud computing services, Software as a Service ( ) has largely become the ‘new normal’ for organizations, eliminating the need to install and run applications on their own computers or in their own data centers. SaaS While this offers myriad benefits for companies and their customers, from a build and deploy perspective developers are finding themselves under increasing pressure to create SaaS applications at speed. The was introduced to help developers build web-based apps quickly and efficiently. The methodology is simple yet powerful, advocating the creation of apps that are both scalable and maintainable in the modern era. Twelve-Factor App While the guidelines promote scalability, resiliency, continuous delivery and maintainability, the fact that software continues to be written and deployed at an ever faster rate raises another important question. Is it possible to build a Twelve-Factor app securely? Is there a 13th factor that’s been forgotten? WhiteHat Chief Scientist Eric Sheridan and his team believe that rather than a 13th step, security should be embedded into each of the existing Twelve- Factors. As such, they have created a specifically for developers and architects, which provides actionable guidance on how to materially improve the state of security across each of the Twelve-Factors. Security Security Addendum to the Twelve-Factor App This article takes a look at each factor and explains how security can be implemented into each one. The first factor in the Twelve-Factor app focuses on codebase and advises putting all code into one repository or source control system that can be tracked in a version control system (such as GitHub or Subversion) and make use of multiple deployment environments (think staging, development, production, etc.) While this is the ideal, it’s important to remember that code is only as secure as the systems used to build it. As the guardian of the code and the systems in which it is housed, what steps can a developer take to ensure that the repository is properly secure? ● These days source code is the core of most businesses, therefore it’s imperative to protect it. The best way to do this is to impose restrictions by limiting access to the source code repository to authenticated users only. Additionally, limit commits to pull requests as opposed to direct commits. In this way, pull requests are reviewed by the team responsible for the master code, which then decides whether to merge the new code with the existing base, or not. Lock it down. ● Write code as if everything you did was open sourced. Operating ‘out in the open’ may actually be the best protection. It means writing application code with the assumption that it could be disclosed, so ideally the aim will be to have no secrets in the actual application. Externalize secrets and make their location known via startup arguments. This means putting secrets into configuration files where people can find them. Use the environment to protect the configuration. No more secrets. ● Enforce secure coding guidelines via review of all pull requests. Equally important is to educate the team on solutions to pull requests that fail code reviews. Collaboration by sharing feedback and experiences will go a long way towards promoting awareness and supporting application coding that is undertaken quickly, correctly and securely. Review code regularly. The second factor of the Twelve-Factor app methodology calls for dependencies to be explicitly declared and isolated. All the environments in which code runs will need to have some dependencies, such as a database or an image library. Most modern applications consist of just 10% of built code, and up to 90% of borrowed code. Because open source is used everywhere, it’s logical that it can enter the code from everywhere and often, application security vulnerabilities come along with it. According to the Department of Defense and Security, of all recorded security threats in the U.S., 90% occurred as a result of exploits against defects in software, rather than holes in the network. In order therefore to ensure application security, it’s important to have an understanding of what third party components are in your code. Are they affected by known security vulnerabilities? Are they up-to-date and do they comply with license policies? Using software composition analysis makes it easy to know which applications are using a particular library, either directly or transitively. ● . Software composition analysis will enable you to identify third party and open source components that have been integrated into your applications. It informs you of factors such the license of each component, and libraries that need to be upgraded or patched. Essentially vulnerability data is gathered from many different sources and software composition analysis can identify which ones have been validated. Know your composition ● Software composition analysis provides information about license risks and can therefore help organizations reduce these risks that may be hidden in open source agreements. This extends to identifying and remediating those dependencies that may introduce security and/or legal risks. Know your risks. ● Now that you know what licenses each of these dependencies uses, it will be easy to identify and remove those licenses that conflict with business policies. Automate the extraction of composition and liabilities and enforce risk acceptance policy via integration into the build pipeline. Review dependencies regularly. The third factor of the Twelve-Factor App advises storing configurations in the environment. According to 12-factor.net, an app’s is everything that is likely to vary between (staging, production, developer environments, etc). This includes resource handles to the database, credentials to external services such as Amazon S3 or Twitter, and per-deploy values such as the canonical hostname for the deployment. config deploys It goes on to explain that apps sometimes store config as constants in the code. This is a violation of Twelve-Factor, which requires strict separation of config from code. Config varies substantially across deploys, code does not. Twelve-Factor encourages the externalizing of that information, but the security ‘gotcha’ can lie in the security of the environment itself. For example, if a properties file is marked as ‘world readable’, anyone with access to that system can begin to read production properties, which can include confidential credentials to backend services, secret keys and tokens. Therefore, when externalizing it’s very important to audit the environment. Identify and apply hardening guidelines to the environment, and take the opportunity to leverage a third party security team to assess the environment. The fourth factor of the Twelve-Factor methodology suggests treating backing services as attached resources. It defines backing services as anything that’s outside of your app, which can be treated as a resource. It helps to encourage encapsulated development and smaller programs for example, but from a security perspective, backing services can also inadvertently encapsulate vulnerabilities. Remember: ● Understand the security posture of the backing service and write code as if it is being attacked, or is attacking you. You assume their risk. ● Establish all connections using Transport Layer Security, authenticating to the backing service using a least privileged account. Secure your communications. ● Encapsulate security checks within the Resource abstraction, and limit the need for users of the Resource abstraction to be security aware. Resource security abstraction. The fifth factor recommends to strictly separate build and run stages. This factor relates more to processes, with an emphasis on identifying and separating each stage of app development, and encouraging automation between each so as to accelerate the process. From a security point of view, keep in mind these key activities during the build, release and run stages: ● The Build Stage is responsible for automating enforce of the security policy, and breaking builds that fail the said policy. _Build — enf_orce security policy. ● The Release Stage should provide a consolidated view of the application’s risk, thereby allowing for a ‘go/no-go’ decision with respect to Release. — Release security go/no-go. ● The Run Stage should provide capabilities to reduce business impact of exploited vulnerability (whether known or unknown). Run — production protection. In the sixth factor, the Twelve-Factor methodology encourages executing the app as one or more stateless processes by using small programs that communicate over the network. Many organizations are undertaking a ‘re-platforming’ journey, in which the overarching platform is broken up into smaller programs that are more service oriented, enabling changes to be made more quickly. Unfortunately, a major security drawback of this journey is that when you start to break up a big building block into smaller pieces, the attack surface increases. This means there are more places where requests can be sent to your infrastructure, which equates to more opportunities to send an attack. Always assume therefore that all process inputs are controlled by hackers, and create one or more processes that are dedicated exclusively to security services. The seventh factor focuses on exporting services via port binding and is actually an extension of factor VI. It encourages the integration of the network handling traffic code inside your running application. For example, PHP apps may run as a module inside Apache HTTPD, or Java apps might run inside Tomcat. The challenge is that these modules must still be configured, which can lead to security risks if an app is bound to privileged ports or protected with poor passwords. To elevate security, avoid binding to privileged ports, instead using port forwarding to unprivileged ports. Once done, immediately drop privileges once bound to a privileged port. Factor eight or concurrency suggests scaling out via the process model. A simple explanation for this factor is to picture a lot of little processes handling specific requirements, such as web requests, API calls, or sending tweets. Keeping all these working independently means that the application will scale better, and you’ll be able to manage more activities concurrently. The security challenge to this is that the ability to scale requires that we pay attention to APIs that are known to introduce Denial of Service issues. One such API is known as “readLine”. Implementations of this method are available on almost every software development platform and yet is subject to Denial of Service. “readLine” will continuously read bytes from a given input stream until a newline character is found. Assume the attacker controls that stream… what if the attacker never provides a newline character? What will happen? More often than not, this will result in errors and stability issues stemming from memory exhaustion. ● Document relevant DoS-able API for your platform (ex. Readline) and ban them. Ban DoS-able API. ● Expose simplistic pattern to facilitate closing of I/O resources (ex. Scope). Resource Closure. In the ninth factor, disposability, the methodology suggests maximizing robustness with fast startup and a graceful shutdown. This factor focuses on getting code and app deployments quickly out of the starting blocks and functioning immediately. Likewise your application also needs to be strong against crashing, and if does crash, it needs to be able to restart cleanly. An important item to remember with disposability is to apply signatures and expirations to limit the life of derived security assertions. If the code is written without an expiration for example, and it’s intercepted over the wire, that token can easily be re-used, something that you don’t want to happen. The tenth factor, DEV/product parity suggests keeping development, staging and production as similar as possible. The Twelve-Factor app puts a lot of emphasis on keeping services the same between the various phases of the product development lifecycle. However, when striving for DEV/prod parity as you move through the Twelve-Factors, do not share product secrets, as Uber found out the hard way when it on a public GitHub page. stored a sensitive database key ● This means that DEV can’t see any secrets in QA, QA can’t see any secrets in STAGE, and STAGE can’t see any secrets in PROD. Enforce the separation of duties. ● Simply put, product security services must be replicated in the DEV, QA, and STAGE processes. Replicate security services. The eleventh factor suggests to treat logs as event streams. The most important security step in this factor is to log for security in such a way that anyone who is aggregating the log can easily extract the security log messages to avoid being burdened with stack traces for example. So in other words, create a log record for each security critical event with supporting information, as well as a ‘SECURITY’ log record category to assist in aggregation. The final and twelfth factor, focuses on admin processes and running admin/management tasks as one-off processes. From a security standpoint, admin processes must be subject to the same security scrutiny as prescribed for factors I to XI. Incorporate one-off admin processes as part of ‘product’ discussions and understand the security risks associated with one-off admin processes. The contains all of the information discussed in this article. It is published as a list so as to be digestible and useful for developers. WhiteHat Twelve-Factor App Security Addendum Checklist

Applying security to the Twelve-Factor App

itsgoingdown.org is very important when developing applications. How do you encrypt data and manage encryption keys in your application? Successful key is critical to the security of a cryptosystem. This is where KMS’s come into play. Let’s first see what a KMS really is. Security management Key Management System (KMS) According to Wikipedia, A (KMS), also known as a (CKMS), is an integrated approach for generating, distributing and managing for devices and applications. Compared to the term key management, a KMS is tailored to specific use-cases such as secure software update or communication. In an holistic approach, it covers all aspects of security — from the secure generation of keys over the secure exchange of keys up to secure key handling and storage on the client. Thus, a KMS includes the backend functionality for , distribution, and replacement as well as the client functionality for injecting keys, storing and managing keys on devices. With the , KMS becomes a crucial part for the security of connected devices. key management system crytographic key management system cryptographic keys machine-to-machine key generation Internet of Things A KMS makes your life easy when dealing with key management and encryption. AWS KMS Now we know what a key management system is. Let’s talk about AWS KMS briefly. AWS KMS is a service by AWS that makes it easy for you to manage your encryption keys. It uses Hardware Security Modules (HSMs) in the backend. AWS KMS is integrated with other AWS services. It is also low in cost. AWS KMS provides access control to your keys so that you can determine who can access the keys when can the keys be accessed and a lot of other options. AWS KMS uses the algorithm in , known as AES-GCM. AWS KMS uses this algorithm with 256-bit secret keys. Advanced Encryption Standard (AES) Galois/Counter Mode (GCM) AWS KMS pricing can be viewed . Free tier includes 20,000 requests/month. here Using AWS KMS With Node.js In this section I am going to share how to use AWS KMS within your Node.js application. I will cover the following topics here, How to create a CMK (Customer Master Key). How to attach an IAM user to CMK with an IP restricted policy. How to encrypt data using CMK. How to decrypt data using CMK. Envelope encryption using AWS KMS. Encryption context (Intro) With that being said I want to first state that I am not a crypto expert!. How to create a CMK (Customer Master Key) The primary resources in AWS KMS are (CMKs). CMKs are either customer managed or AWS managed. Let’s take a look at how to create a customer master key in AWS. customer master keys Login to AWS console and go to services. Then select “IAM”. There on the left side you can see a section called “Encryption Keys”. Navigate to that section. Then select “Create Key” on top left. Enter an alias for the key and a description. In the advanced options select KMS. Here you can import your own external key if you want. I am not going to cover how to import an external key here (It is also pretty straight forward). Click next. Add tags (optional) if you require. Go to next step again. If you have an IAM user already created (If not skip selecting a user. We will create a user later) and if you want to allow that user to access this key select the user from the list and click next. Finally finish the process. Your key will be created now. How to attach an IAM user to CMK with an IP restricted policy Now if you don’t have a previously created IAM user, follow these steps to create one. Go to “IAM” (as above). Select “Users” on the left side. Select “Add user” top left corner. Fill the required details. An example is given below. Select next. Select the option “Attach existing policies directly”. Then select “Create policy”. You can visually edit the policy or edit the json of the policy. I am going to edit the json here. Select “json” tab. I will be using the below simple policy which will only allow access to the CMK from a one selected IP. You can select an IP range or you can customize the policy in any way you want. After that follow the instructions to save the created policy. Then finish creating the user. At the last page new user’s Access key ID and Secret access key will be displayed. Download those information. You won’t be able to view it afterwards (But you can create new credentials again). Now go to Encryption keys and select the key that you just created. Go to “Key Users” section and select “Add”. Select the user you have created. Then that user will be added to the allowed list for the CMK you created. Key Users How to encrypt data using CMK Enough setting up things, let’s see how to use AWS KMS! I am using AWS SDK for Node.js here. Let’s install AWS SDK package from npm. npm install aws-sdk Following function encrypts a given buffer and outputs the cipher text blob. encrypt(buffer) { kms = aws.KMS({accessKeyId: 'AKCVBTRNOSMLTIA7RPQQ', //credentials for your IAM usersecretAccessKey: 'lJQtdIfH/Cup9AyaaHV8h2NnR/eKFIsZea5Vn0k', //credentials for your IAM userregion: 'ap-southeast-1'}); Promise((resolve, reject) => { params = {KeyId: '965d2884-b2cd-4d79-8773-6b1f57133300', // The identifier of the CMK to use for encryption. You can use the key ID or Amazon Resource Name (ARN) of the CMK, or the name or ARN of an alias that refers to the CMK.Plaintext: buffer// The data to encrypt.};kms.encrypt(params, (err, data) => { (err) {reject(err);} {resolve(data.CiphertextBlob);}});});} function const new return new const if else How to decrypt data using CMK Following function decrypts a cipher text blob that was encrypted before and returns the plain text buffer. decrypt(buffer) { kms = aws.KMS({accessKeyId: 'AKCVBTRNOSMLTIB7ROQQ',secretAccessKey: 'lJQtdIfH/Cup9AyabHV9h2NnR/eKFIsZea2Vn0k',region: 'ap-southeast-1'}); Promise((resolve, reject) => { params = {CiphertextBlob: buffer// The data to dencrypt.};kms.decrypt(params, (err, data) => { (err) {reject(err);} {resolve(data.Plaintext);}});});} function const new return new const if else Following code encrypts the text “abc” then decrypts it and prints the value to the console encrypt( Buffer('abc','utf-8')).then(decrypt).then(plaintext => {console.log(plaintext.toString('utf-8'));}); new Envelope encryption using AWS KMS AWS KMS has a size limit on directly encrypting data using the CMK. You can only encrypt up to 4 kilobytes of data per request. If you want to encrypt data of bigger size, for an example a video, you need to use envelope encryption. In envelope encryption we generate a data key by using our CMK at KMS. When generating the data key, AWS sends us both the plaintext key and the encrypted key (using our CMK). Then we use the plaintext data key generated to encrypt our data. After encrypting the data we destroy the plaintext key and keep the encrypted key with us. When we want to decrypt the data we send the encrypted key to AWS KMS and get back the plaintext key and continue with decryption. First we need to generate a data key from AWS KMS. Following diagram depicts that procedure. http://docs.aws.amazon.com Following function generates a data key from AWS KMS. generateDataKey() { kms = aws.KMS({accessKeyId: 'AKCVBTRNOSMLTIB7ROQQ',secretAccessKey: 'lJQtdIfH/Cup9AyabHV9h2NnR/eKFIsZea2Vn0k',region: 'ap-southeast-1'}); Promise((resolve, reject) => { params = {KeyId: '965d2884-b2ab-4e78-8773-6b1f57133300', // The identifier of the CMK to use to encrypt the data key. You can use the key ID or Amazon Resource Name (ARN) of the CMK, or the name or ARN of an alias that refers to the CMK.KeySpec: 'AES_256'// Specifies the type of data key to return.};kms.generateDataKey(params, (err, data) => { (err) {reject(err);} {resolve(data);}});});} function const new return new const if else “data” has both encrypted data key and plain text data key as buffers. Next step is encrypting data with plain text data key. http://docs.aws.amazon.com Following is an example code which uses AES-CBC to encrypt data using the data key. This uses crypto package. Here I have used a fixed iv (initialization vector) for the simplicity. encryptAES(key, buffer) { algorithm = 'AES-256-CBC'; function const **const** iv = **new** Buffer('00000000000000000000000000000000', 'hex');  

encryptor = crypto.createCipheriv(algorithm, key, iv);  
encryptor.write(strBuffer);  
encryptor.end();  

**return** encryptor.read(); } Let’s see how to decrypt the encrypted data. First of all we need to decrypt our ecrypted key using the CMK. Following diagram illustrates that. The code snippet I have posted earlier can be used to do this (just the same as regular data decryption). http://docs.aws.amazon.com The last step is decrypting the data. Following diagram illustrates that. http://docs.aws.amazon.com A sample code to decrypt the data we encrypted above using AES-CBC is shown below. decryptAES(key, buffer) { algorithm = 'AES-256-CBC'; function const **const** iv = **new** Buffer('00000000000000000000000000000000', 'hex');  

encryptor = crypto.createDecipheriv(algorithm, key, iv);  
encryptor.write(buffer);  
encryptor.end();  

**return** encryptor.read(); } Following is a code snippet to encrypt and decrypt a string using envelope encryption. generateDataKey().then(data => { cipherTextBlob = encryptAES(data.Plaintext, Buffer('abc', 'utf-8')); ( i = 0; i < data.Plaintext.length; i++) {data.Plaintext[i] = ;}decrypt(data.CiphertextBlob).then(key =>    { dataBuffer = decryptAES(key, cipherTextBlob);console.log(dataBuffer.toString('utf-8'));});}); const new for let null const Encryption context Other than all of these AWS KMS provides support for encryption context to further enhance the security. There are some security issues that can be mitigated by using an encryption context. To learn more about encryption context and how to use it, please head over . here OK we are at the end. This has been a pretty lengthy article. But I hope that you have learned something from this. Now its your time to check AWS KMS out!!!

Stories, News & Mentions about STEPSECURITY

Stepsecurity’s Stories on HackerNoon