SAP latest enterprise software giant to offer low code workflow

/0 Comments/in /by

Low code workflow has become all the rage among enterprise tech giants and SAP joined the group of companies offering simplified workflow creation today when it announced SAP Cloud Platform Workflow Management, but it didn’t stop there.

It also announced SAP Ruum, a new departmental workflow tool and SAP Intelligent Robotic Process Automation, its entry into the RPA space. The company made the announcements at SAP TechEd, its annual educational conference that has gone virtual this year due to the pandemic.

Let’s start with the Cloud Platform Workflow Management tool. It enables people with little or no coding skills to build operational workflows. It includes predefined workflows like employee onboarding and can be used in combination with Qualtrics, the company it bought for $8 billion 2018, to include experience data.

As SAP CTO Juergen Mueller told me, the company sees these types of activities in a much larger context. In the hiring example, that means it’s more than simply the act of being hired and getting started. “We like to think in end-to-end processes, and the one fitting into the employee onboarding would be recruit to retire. So it would start at talent acquisition,” he said.

Hiring and employee onboarding is the first part of the larger process, but there are other workflows that develop out of that throughout the employee’s time at the company. “Basically this is a collection of different workflow steps that are happening with some in parallel, some in sequence,” he said.

Okta adds new no-code workflows that use identity to trigger sales and marketing tasks

If there are experience questions involved like which benefits you want, you could add Qualtrics questionnaires to that part of the workflow. It’s designed to be very flexible. As with all of these kinds of tools, you can drag and drop components and do some basic configuration and you’re good to go. In reality, the more complex these become, the more expertise would be required, but this type of tool is designed with non-technical end users in mind as a starting point.

SAP Ruum is a simplified version of Cloud Platform Workflow Management designed for building departmental processes, and if there is an automation element involved where you want to let the machine take care of some mundane, repeatable tasks, then the RPA solution comes into play. The latter tends to be more complex and require more IT involvement, but it enables companies to build automation into workflows where the machine pushes data along through the workflow and does at least some of the work for you.

The company joins Salesforce, which announced Einstein Workflow Automation last week at Dreamforce and Google Workflows, the tool the company introduced in August. There are many others out there from companies large and small including Okta, Slack and Airtable, which all have no-code workflow tools built in.

The SAP TechEd conference has been going on for 24 years, and usually takes place in three separate venues — Barcelona, Las Vegas and Bangalore —  throughout the year. This year, the company is running a single-combined virtual conference for free to all comers. It runs for 48 hours straight starting today with a worldwide audience of over 60,000 sign-ups as of yesterday.

Salesforce applies AI to workflow with Einstein Automate

AWS announces SageMaker Clarify to help reduce bias in machine learning models

/0 Comments/in /by

As companies rely increasingly on machine learning models to run their businesses, it’s imperative to include anti-bias measures to ensure these models are not making false or misleading assumptions. Today at AWS re:Invent, AWS introduced Amazon SageMaker Clarify to help reduce bias in machine learning models.

“We are launching Amazon SageMaker Clarify. And what that does is it allows you to have insight into your data and models throughout your machine learning lifecycle,” Bratin Saha, Amazon VP and general manager of machine learning told TechCrunch.

He says that it is designed to analyze the data for bias before you start data prep, so you can find these kinds of problems before you even start building your model.

“Once I have my training data set, I can [look at things like if I have] an equal number of various classes, like do I have equal numbers of males and females or do I have equal numbers of other kinds of classes, and we have a set of several metrics that you can use for the statistical analysis so you get real insight into easier data set balance,” Saha explained.

AWS launches SageMaker Data Wrangler, a new data preparation service for machine learning

After you build your model, you can run SageMaker Clarify again to look for similar factors that might have crept into your model as you built it. “So you start off by doing statistical bias analysis on your data, and then post training you can again do analysis on the model,” he said.

There are multiple types of bias that can enter a model due to the background of the data scientists building the model, the nature of the data and how they data scientists interpret that data through the model they built. While this can be problematic in general it can also lead to racial stereotypes being extended to algorithms. As an example, facial recognition systems have proven quite accurate at identifying white faces, but much less so when it comes to recognizing people of color.

It may be difficult to identify these kinds of biases with software as it often has to do with team makeup and other factors outside the purview of a software analysis tool, but Saha says they are trying to make that software approach as comprehensive as possible.

We need a new field of AI to combat racial bias

“If you look at SageMaker Clarify it gives you data bias analysis, it gives you model bias analysis, it gives you model explainability it gives you per inference explainability it gives you a global explainability,” Saha said.

Saha says that Amazon is aware of the bias problem and that is why it created this tool to help, but he recognizes that this tool alone won’t eliminate all of the bias issues that can crop up in machine learning models, and they offer other ways to help too.

“We are also working with our customers in various ways. So we have documentation, best practices, and we point our customers to how to be able to architect their systems and work with the system so they get the desired results,” he said.

SageMaker Clarify is available starting to day in multiple regions.

Ransomware and The Perils of Paying

/0 Comments/in /by

Ransomware finds its victims by accident or intentionally and each week, the technology and business model adapt. Some pay the ransom to get back online faster and others don’t. The decision to pay is more complex than it appears and victims, IR firms, insurance companies and Bitcoin payers could be subject to fines and or criminal penalties.

“The increase in ransomware attacks over the last two years has been dramatic,” said Chris Keegan of Beecher Carlson. “Costs of attacks and payments have increased significantly, and the sophistication of the malware has increased substantially.”

  • Ransomware claims increased 239% from 2018 to 2019
  • Cost of ransomware payments increase 228% from 2018 to 2019
  • Average ransomware payments increased 31% from Q2 to Q3 2020
  • Ransomware payments in 2019 were 3X 2018 payments
  • Extortion demands paid in 2019 were 4X  2018 amounts
  • Ransomware incidents where data had been exfiltrated increased from 8.77% to 22% from Q1 to Q2 2020

Those data indicate widespread losses and begs the question, can this approach continue? If you are one of the companies that suffered a loss, it can be devastating. Keegan added that “cyber insurance payouts have increased significantly as a result of these developments and the markets are reacting by increasing premiums and seeking to provide tools to help insureds better identify and correct vulnerabilities. In addition, insurers are focusing on more careful selection of their policyholders.”

You Don’t Always Get What You Pay For

Attackers have become very sophisticated at pressuring victims to pay, but for enterprises, it’s not as simple as that.

Take the Blackbaud breach in May of this year. They reported “cybercriminals were able to remove a copy of a subset of data from Blackbaud’s self-hosted environment.” Blackbaud hired a third party firm to negotiate with the hackers, “we only paid the ransom when we received credible confirmation that the data was destroyed.”

Blackbaud is a “U.S. based cloud computing provider and one of the world’s largest providers of education administration, fundraising, and financial management software.” In July they gave notice to their clients that while they suffered a breach, no sensitive customer data was involved. In September, Blackbaud filed its Form 8-K SEC filing to reflect “the cybercriminal may have accessed some unencrypted fields intended for bank account information, social security numbers, usernames and/or passwords.”

Large cloud providers pose enormous risks to their downstream clients. Northshore University Health System had 348,000 patients lose PHI as a result of the Blackbaud incident. There are currently 23 class action lawsuits against Blackbaud and another 160 claims coming from USA, UK and Canada. They reported “breach related expenses of $3.6 million through September, with $2.9 mil in accrued insurance recoveries.”

It’s important to keep in mind that Blackbaud is a victim. Unfortunately, given the connected nature of their business model, offering services to non-profits, there is a shared responsibility for data that is ongoing. We place a higher burden on larger, publicly traded entities and expect them to embrace stewardship of our data better than we can ourselves.

Garden variety ransomware will encrypt data and seek a ransom payment in Bitcoin to “unlock” the files. In the above example, data was exfiltrated with a promise to destroy upon payment. The US Treasury and FBI have a policy against paying a ransom because it “not only encourages future ransomware payment demands but also may risk violating OFAC regulations….and threaten national security interests.”

Paying a Ransom Requires Resources…and Skill

As Blackbaud noted, they hired an independent forensic firm to negotiate on their behalf. And based on their disclosure, insurance reimbursed them for a percentage of that expense. On Oct 1, 2020, the Treasury Office of Foreign Asset Control (OFAC), issued an advisory cautioning companies against making ransom payments. But paying ransoms without violating the law requires a skilled team.

“Most payments where insurance companies are involved are made through specialist ransomware negotiation and incident response (“IR”) companies with experts in negotiations with threat actors”, says Keegan. “The Bitcoin wallets of these companies are usually the source of the payment – though a small number of cyber insurance companies have their own in-house experts and wallets. If the payments are small enough, they can be made on credit usually backed by the guarantee of the insurance company or the insured. As the IR firm that has the best knowledge of the threat actors, the insurance companies rely heavily on their expertise and on the investigation done by them for confirmation that they are in compliance with OFAC, FinCEN and any other payment regulations. The SLA agreements with the IR companies will often stipulate that it is their responsibility. Insurers will also be looking to breach counsel and their insured for confirmation.”

Blackbaud paid the ransom to protect its client data. Certainly, not having proper security in place or back ups is negligent in today’s world. But when hospitals are reduced to “paper operations” and cannot determine critical patient data or perform services as happened to the Universal Health Services 400 facilities, what is the greater harm? How did Blackbaud know that they were not diverting funds to a sanctioned person which could trigger a fine against Blackbaud, their IR firm or even the banks/exchanges facilitating the transfer into Bitcoin?

James Arnold of KPMG LLP shared a couple of interesting scenarios around attribution and the OFAC advisory. “How can the DFIR know for certain that a particular actor is responsible? And if the DFIR must represent that an SDN wasn’t involved, how can the Treasury prove us wrong? In October 2020, we began assisting a large multinational company who was suffering from a Wastedlocker attack. Following the release of OFAC’s October 1, 2020 Advisory, this company was advised by legal counsel that they could not deal with the hacker and as a result is experiencing significant business interruption and financial loss, to the point of possible bankruptcy.”

“This cannot be what OFAC intended,” Arnold added. “One radical suggestion might be to pass a law that says starting in January 2023, no US based companies will be allowed to pay any ransom related to a cyber-attack. This would force companies to begin enhancing their cyber security to address the most common control weaknesses that allow ransomware attacks to succeed like the lack of proper back-ups and failure to deploy MFA. NIST CF was phased in over several years and we now have better risk based controls and this would be a similar approach.”

Luke Emrich of RSM US LLP commented that his firm doesn’t make, get involved in, or facilitate any payment of ransom demands as part of an engagement. “No organization is ever the same after experiencing a ransomware event. We hope every ransomware victim has the ability to recover and rebuild in a way that leaves them stronger and more resilient to future attacks. The potential for OFAC sanctions may create a situation where a ransomware victim suffers a catastrophic loss, ultimately forcing them to close their doors due to damage and loss of systems, information and data required to run their business.”

“The struggle is when a business is faced with what is almost a life or death decision. Needing to pay to get their data back vs government penalties they will face from OFAC if they want to survive – they are going to pay 100% of the time – so the OFAC proclamation is ultimately meaningless. The penalty is an added cost of survival and the victim is just being taxed for being a victim,” said Keith Strassberg of Cybersafe Solutions, LLC.

OFAC Rules in Practice

David Tannenbaum, a former Treasury official, now of Blackstone Compliance Services LLC, notes “…this advisory is a reminder to the business community that OFAC regulations prohibit ransom payments to sanctioned persons. These prohibitions have always been in place, but OFAC typically issues advisories such as these when they see an uptick in risks or a prominent case and feel the need to raise awareness.”

The Treasury Dept. gets its authority to sanction individuals from EO 13694, and it can designate persons (individuals or an entity) who conduct certain cyber attacks. It’s confusing because they start with the malware families that are most damaging (Dridex, Wannacry, SamSam, Cryptolocker) and then attach persons (Evil Corp, etc.) to that malware once they have sufficient attribution. Arent Fox points out that there is a ‘Dridex Gang’ alias on the SDN list which is related to Dridex but is not the malware family. It’s well known that malware is shared by hackers and a Wastedlocker attack could be launched by someone other than the person designated.

This all means that a ransomware victim needs to know what the malware is and if they plan on paying the ransom, is there a SDN behind the attack? The other parties involved include the DFIR, the Insurance carrier and the payer, all of which could be held responsible. OFAC states that victims that involve law enforcement and document their actions to avoid interaction with SDN’s, is “a key mitigating measure to any sanctions enforcement case.”

“Attribution and enforcement of the OFAC and FinCEN rules may become more difficult due to moves away from Bitcoin to other crypto currencies which provide greater anonymity,” offered Keegan. “Further, tactics techniques and procedures (TTPs) which are typically used for attribution are becoming increasingly shared with the rise of Ransomware as a Service. Ransomware criminals are eager not to put up any roadblocks to payment and go through great lengths to preserve their anonymity using frequently rotated burner cryptocurrency wallets. To date, we have not seen companies in the insurance industry, or their vendors, seek to get a license from the Treasury for an exception to OFAC rules for payment of ransomware.”

“Attribution has been a tough aspect during these matters. We all know definitive attribution is very difficult but even speculation of an OFAC-listed entity may preclude the facilitation of payments. This is where we need clarity and improvement, said Anthony Dagostino of Lockton Companies.

Jeremy Murtishaw of DFIR firm Fortify24x7 says, “understanding the ‘who’, an individual or an APT group, is a difficult task. It requires the incident response team to really understand the source of the malware being used to distribute the ransomware, so informing OFAC and the FBI is required in advance of making the payment.”

Chris Prewitt of MCPC also noted the challenges DFIR firms face. “Attribution is incredibly difficult, and while OFAC has designated numerous malicious cyber actors under its cyber-related sanctions program, quite often the victim organization has no idea who the criminal is or where they are located. How are they going to be certain of this? It seems like this is a poor attempt at slowing down ransom payments.”

Tannenbaum recommends that “DFIRs setup policies and procedures that outline key steps which it would take in each case to determine if there is a sanctions nexus. This process should be documented (such as to produce a checklist) to evidence the due diligence, which the other parties involved can reference when doing their own assessment.”

“At a high level, some of these controls may be:

❖ Using threat intelligence tools to determine if any of the evidence left behind (e.g. malware, ransom note, name of attacker, etc.) have been previously tied to a sanctioned party;

❖ Examining the cryptocurrency address to determine, through address clustering or other methods, whether the address provides any clues to the attacker’s provenance; and

❖ Examining the malware to determine if it is the same or similar to other malware attacks by sanctioned actors.”

If the DFIR conducts this analysis, it can categorize the attack as having: a SDN nexus; no SDN nexus or not certain…a gray area. The third category will enable the victim to make a risk based decision and pay the ransom, not knowing if it could later be determined it had a nexus with a SDN.

There is another option and that includes getting a license from Treasury to pay the fine, even though it is a SDN behind the malware. However, Tannebaum cautions, “OFAC can issue a license to pay a ransom but stated in their advisory that they presume they will deny a license request…attacks which endanger the life and safety of individuals may be more likely to receive a license than ones which just disrupt commercial operations.”

Keegan noted that “a review of the OFAC and FinCEN fine lists over the last few years do not show any fines due to ransomware payments.”

Insurance Risk Transfer

Buying cyber insurance can offset losses and, in many cases, prevent losses if proactive services offered by the carrier are properly utilized. But if there is a ransom event, IR firms that have earned a slot on the insurance panels have the best shot at recovering data and successfully negotiating Bitcoin transfer. But can the cyber insurance market continue to support ransomware fines when they appear to be out of control?

“Most cyber insurance policies do not have specific exclusions for payment of ransomware which might be subject to OFAC and FinCEN restrictions but incorporate provisions which freeze the effect of the policy and make it subject to OFAC oversight in the event an entity or person claiming the benefits of the policy has violated any sanctions law,” said Keegan. “Insurance companies have indicated that they will be reluctant to act if that action is illegal, could affect their licensing or subject them to fines and penalties. However, our experience is that cyber insurance companies are honoring their contractual obligations and paying claims except for a very few cases where there is very clear evidence of payment to a banned entity. In those cases, the insureds, banks and IR firms are all under the same restrictions.”

That view is shared by other insurance brokers. “Insurance policies are written to respond to threats and losses suffered by the insured. You won’t see policies addressing ‘who is the origin of the bad actor’. If the insured organization suffers a covered loss, the insurers intend to cover it. There can be limitations in the form that could come into play such as a war or terrorism exclusion as well as an OFAC endorsement,” said David Lewison of AMWins Insurance.

“To date, the insurance market has not limited coverage for cyber-attacks but there have been adjustments in premium to cover the increased losses,” offered Keegan. How big are the price increases to keep your cyber insurance coverage or to add new coverage? “Insurance carrier increases of zero to five percent rate in the second quarter 2020, gave way to five to fifteen percent increases in the third quarter which were raised again to ten to thirty percent in the fourth quarter.. Not all increases are in this range, but cyber insurance buyers should be prepared for requests at these levels. Some adjustments to the structure of programs, such as raising retentions, can be made to limit the increased costs and carriers are amenable to these discussions.”

But all coverage may be out the window if it involves a sanctioned entity involved with a ransomware payment. “The OFAC endorsements can become an issue if a ransom demand emanates from a country on the OFAC list. If the insurer is legally barred from sending funds to a listed country, there will be a problem paying off a ransom to recover systems or data. In this instance I would not expect all coverage to be taken away, just the ransom payment. There are other parts of the policy that would still respond to pay expenses associated with business interruption, forensics, data recovery, the potential for hardware replacement coverage depending on the policy form, legal fees and more,” Lewison added.

“Insureds typically understand OFAC restrictions in general but more education and advice is needed in the area of ransomware and how coverage responds. We’re also concerned with insurers that hold up covered expenses associated with the ransom. While prohibiting the actual demand payment is understandable if deemed to be the act of an SDN, holding up the business interruption loss or other IR costs is problematic,” added Dagostino.

“Ransomware has driven so many losses for the cyber insurance market, we’re seeing much more scrutiny of company’s controls for ransomware in the underwriting process before an event occurs. I think it’s likely we’ll see similar increases in scrutiny of the payments after an event as well,” said Dan Burke of Woodruff Sawyer.

Keegan shares a positive view on the OFAC advisory. “To date, the insurance market has seen only a small minority of situations where payments have been held up because of an indication that the payments might be being made to OFAC and FinCEN restricted entities. First, there are only a handful of known threat actor groups or individuals listed on the known Specially Designated Nationals (“SDN”) lists in addition to a short list of sanctioned nation states (e.g., Cuba, the Crimea region of Ukraine, Iran, North Korea, and Syria). Further, there are very few instances where attribution can be made with a degree of certainty. Many businesses will not be able to get enough information on attribution before a decision is made on payment and so will be taking a risk in order to get their businesses operating.”

“Over the past few years insurance has created a database of bad actors…. which ones will provide functional decryption keys, which [hackers] may return looking for additional ransom and which ones may negotiate on the ransom amounts. We would hate to hear that someone paid a ransom and did not get their data back or have it corrupted beyond recovery. Having that institutional knowledge is another advantage of buying cyber insurance rather than tackling the problem alone,” said Lewison.

Conclusion

Ransomware victims need to be aware of the potential consequences of paying extortion. “Civil penalties per violation can be up to $307,922 or twice the value of the payment at issue (whichever is higher); and criminal penalties for knowing violations can be up to $1,000,000 and 20 years in prison.”

The decision to pay needs to come from senior management as they could suffer reputation damage in addition to the above penalties.

Every major standards body for cyber safety has set forth best practice for avoiding ransomware attacks. A good security stack on the endpoint is needed along with back ups and a plan to respond when hit. But most companies haven’t factored paying extortion into their risk analysis and where should this task fall?

“It is important for each actor to consider the sanctions risks from where they sit in the transactional chain,” offers Tannenbaum. “OFAC regulations prohibit both the payment and any actions which facilitate the payment such as insurance and advice. Each type of entity should consider whether they have a sanctions compliance program, and policies and procedures to address their relevant sanctions risks.”

Insurance companies have been investing heavily in proactive risk mitigation to avoid this mess altogether. “We recommend that companies should have proper business continuity and disaster recovery plans in place and regularly tested so that payment of ransomware is not the organization’s only choice,” said Keegan. “Backups of critical systems should be segmented and stored offline. Companies should have a well-documented and ransomware specific incident response plan to allow clear and efficient decision-making to weigh legal risks against the risks to the business”.

Ransomware is hitting all major companies daily and because they have proper controls and back ups in place, we don’t read about them.  Prepare…and stay out of the news!

We want to thank our contributors: Chris Keegan, David Lewison, David Tannenbaum, James Arnold, Anthony Dagostino, Dan Burke, Jeremy Murtishaw, Luke Emrich, and Chris Prewitt

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

Jeli.io announces $4M seed to build incident analysis platform

/0 Comments/in /by

When one of AWS’s east coast data centers went down at the end of last month, it had an impact on countless companies relying on its services, including Roku, Adobe and Shipt. When the incident was resolved, the company had to analyze what happened. For most companies, that involves manually pulling together information from various internal tools, not a focused incident platform.

Jeli.io wants to change that by providing one central place for incident analysis, and today the company announced a $4 million seed round led by Boldstart Ventures with participation by Harrison Metal and Heavybit.

Jeli CEO and founder Nora Jones knows a thing or two about incident analysis. She helped build the chaos engineering tools at Netflix, and later headed chaos engineering at Slack. While chaos engineering helps simulate possible incidents by stress-testing systems, incidents still happen, of course. She knew that there was a lot to learn from them, but there wasn’t a way to pull together all of the data around an incident automatically. She created Jeli to do that.

“While I was at Netflix pre-pandemic, I discovered the secret that looking at incidents when they happen — like when Netflix goes down, when Slack goes down or when any other organization goes down — that’s actually a catalyst for understanding the delta between how you think your org works and how your org actually works,” Jones told me.

She began to see that there would be great value in trying to figure out the decision-making processes, the people and tools involved and what companies could learn from how they reacted in these highly stressful situations, how they resolved them and what they could do to prevent similar outages from happening again in the future. With no products to help, Jones began building tooling herself at her previous jobs, but she believed there needed to be a broader solution.

“We started Jeli and began building tooling to help engineers by [serving] the insights to help them know where to look after incidents,” she said. They do this by pulling together all of the data from emails, Slack channels, PagerDuty, Zoom recordings, logs and so forth that captured information about the incident, surfacing insights to help understand what happened without having to manually pull all of this information together.

Gremlin brings Chaos Engineering as a Service to Kubernetes

The startup currently has eight employees, with plans to add people across the board in 2021. As she does this, she is cognizant of the importance of building a diverse workforce. “I am extremely committed to diversity and inclusion. It is something that’s been important and a requirement for me from day one. I’ve been in situations in organizations before where I was the only one represented, and I know how that feels. I want to make sure I’m including that from day one because ultimately it leads to a better product,” she said.

The product is currently in private beta, and the company is working with early customers to refine the platform. The plan is to continue to invite companies in the coming months, then open that up more widely some time next year.

Eliot Durbin, general partner at Boldstart Ventures, says that he began talking to Jones a couple of years ago when she was at Netflix just to learn about this space, and when she was ready to start a company, his firm jumped at the chance to write an early check, even while the startup was pre-revenue.

“When we met Nora we realized that she’s on a lifelong mission to make things much more resilient […]. And we had the benefit of getting to know her for years before she started the company, so it was really a natural continuation to a conversation that we were already in,” Durbin explained.

How you react when your systems fail may define your business

Berlin’s Wonder raises $11M for a new approach to video chat where you wander and join groups

/0 Comments/in /by

If this year has taught us a lesson about the world of work, it’s that collectively, we weren’t very well-equipped in terms of the technology we use to translate the in-person experience seamlessly to a remote version. That’s led to a rush of companies launching new services to fill that hole — cloud computing and data warehousing startups, collaboration platforms, sales tools and more — and today one of the latest startups in the area of videoconferencing is announcing a round of funding to see its business scale to the next level.

Wonder, a Berlin startup that has built a platform for people to come together in video-based groups to meet up, network and collaborate, while also having a bird’s-eye view of a larger space where they can more serendipitously, or more intentionally, interact with others — not unlike in an office or other business venue — is today announcing that it has raised $11 million (€9 million) in a substantial seed round.

The funding was led by European VC EQT Ventures, with BlueYard Capital — which led a pre-seed round in the startup when it was previously called “YoTribe” — also participating.

It comes on the heels of the young startup seeing some impressive traction this year.

Wonder now has 200,000 monthly users from a pretty diverse set of organizations, including NASA, Deloitte, Harvard and SAP, which are using it for a variety of purposes, from team collaboration through to career fairs. The company will use the funding both to add in more features as requested by current users, as well as to hire more people for its team, co-founder Stephane Roux said in an interview. Those features will include sharing files and other technical services, but they will not be piled on quickly or thickly.

“We think of this less in terms of content and more about people,” he said. “The core experience is about live interaction, not just repositories of stuff. We want to build a place for collaboration and communication. Interesting ways to carve up a group virtually.”

Now, you may be thinking: another workplace video app? Hasn’t this $14 billion space race already been “won” by Zoom (which some of us now use as a verb for videoconferencing, regardless of which app we actually use)? Or Microsoft or Google or BlueJeans, or whatever it is that your organization has inevitably already signed up and paid for?

But it turns out that for all the growth and use that these other platforms have had, they are sorely lacking in their overall experience, as it pertains to what it’s like to be in physical spaces with other people. One of the key points, it turns out, is that a lot of solutions are not really built with the user experience of the larger group in mind.

Wonder is built around the idea of a “shared space” that you enter. That space comes not from a VR experience as you might expect, but something much simpler that takes a tip from more rudimentary but very effective older game dynamics. You get a single window where you can “see” from an aerial view, as it were, all of the other people who are in the same space, and the areas within that space where they might cluster together.

Those clusters could be designed around a specific interest (such as marketing or HR or product) or — if the product is being used at a career fair, for example, at a list of different companies taking part; or — at a conference — different conference sessions, plus an exhibition space.

You can move around all of the clusters, or start your own, or sit in the margins with another person, and when you do come together with one or more people, you can join them in a video chat to interact. In the future, the plan is to do more than just join a video chat; you might also be able to access documents related to that cluster, and more.

The clusters can be “public” for anyone to join, or set to private, as you might have in a physical meeting room. The overall effect is that, without actually being in a physical space, you get the sense of a collective group of people in motion.

The startup was originally the brainchild of Leonard Witteler, who built a version of this last year as a coding project at university before showing it to friends and family and getting positive feedback.

As another co-founder, Pascal Steck, describes it, he, Witteler and Roux, who all knew each other, had been looking to build a startup together, but around a completely different idea — a portal for photographers and other creatives in the wedding industry.

Given how drastically curtailed weddings and other group gatherings have been this year, that didn’t really go anywhere at all. But the three could see an opportunity, a very different one, with the software that Witteler had built while still a student. So in the grand tradition of startups, they pivoted.

Wonder had previously been called YoTribe, which sounds a little like YouTube and also plays on the idea of groups of friends who come together around special interests.

And from how Steck and Roux described it to me in an interview (over Wonder of course), it didn’t sound like the initial idea was to target enterprises at all, but people who found themselves a bit at a loss when music festivals and other events like that suddenly died a death because of COVID-19.

Indeed, they themselves were all too aware of the state of the market for videoconferencing apps: it was very, very crowded.

“The space is very busy and some great products are already out there. But as soon as you zoom into this space” — no pun intended, Steck said — “when it’s about large group meetings, these other tools do not allow for serendipitous conversations or bottom-up gatherings, and the list gets very thin very quickly. Our focus is around improving presentations, but in the case of large groups, there is just not a lot out there. Especially something building an association as we know it to how we do things in the offline world. We think we have a unique spot in the market. 

“A meeting for three people can use Zoom or Teams perfectly. There is no need for anything else, but for larger groups, that is not the case and it seems like the market is really open for something like Wonder.”

The name “Wonder” is an interesting choice when the startup rebranded from YoTribe. Wonder’s main meaning is surprise and discovery, but it has long been thought and assumed that “wonder” is also connected to the word “wander”. (In fact, the two are not related etymologically, but have often crossed paths and wandered into each other’s territories over the centuries.) Similarly, the idea with Wonder the app is that you can “wander” around a room, and find who and what you are looking for in the process.

Wonder is not the only upstart video app that has picked up some attention in the last several months. In fact, there has been a wave of them launching or announcing funding (or both) in 2020 to try to address the gaps — or opportunities — that exist as a result of the features from the current leaders.

Other launches have included mmhmm (Phil Libin’s latest startup that adds lots of bells and whistles to make the presentations more than just a talking head); Headroom (founded by ex-Google and ex-Magic Leap entrepreneurs, using AI to get more meaningful insights from the video conversations); Vowel (which lets people search across video chats to follow up items and dig into what people said across different calls); and Descript, Andrew Mason’s audio effort, now also has video features.

Descript, Andrew Mason’s platform to edit audio by editing text, now lets you edit video, too

But if anything, a lot of these newer tools fail to address the shortcomings of what it’s like being a part of a big group using a video app. In fact, many of these newer entrants highlight another set of challenges, those of the speaker, who is thus graced with better presentation tools in mmhmm, or given way better insights into the audience with Headroom, etc.

In any case, Wonder has found, serendipitously, a lot of traction from people who have identified and lamented the problems with so much else out there today. The app is still free to use, and the plan will be to keep it that way until some time in 2021, Roux said. Ironically, he pointed out that many of its current customers are asking to be charged, not least because it lends using it more credibility, which is important with IT departments and so on. All that might mean the charging plan gets pushed up sooner.

In any case, even if companies are also using something else, they are also adopting Wonder, and that has in turn piqued the interest of investors who are interested to see where it might go next.

“Throughout COVID-19, real-time video has become the default for both private and professional interactions, and hybrid working is here to stay,” said Jenny Dreier, investor at EQT Ventures Berlin, in a statement. “No other video tools come anywhere near as close to replicating real-life interactions as Wonder, so the product has explosive potential, already foreshadowed with the platform’s stellar organic growth. It’s incredibly exciting to be working with the team and to be part of the journey; I can’t wait to be a part of their next chapter.”

mmhmm, Phil Libin’s new startup, acquires Memix to add enhanced filters to its video presentation toolkit

3 questions to ask before adopting microservice architecture

/0 Comments/in /by
Madison Friedman
Contributor

Madison Friedman is an investor intern at Vertex Ventures US and an MBA candidate at the Wharton School of Business.

As a product manager, I’m a true believer that you can solve any problem with the right product and process, even one as gnarly as the multiheaded hydra that is microservice overhead.

Working for Vertex Ventures US this summer was my chance to put this to the test. After interviewing 30+ industry experts from a diverse set of companies — Facebook, Fannie Mae, Confluent, Salesforce and more — and hosting a webinar with the co-founders of PagerDuty, LaunchDarkly and OpsLevel, we were able to answer three main questions:

  1. How do teams adopt microservices?
  2. What are the main challenges organizations face?
  3. Which strategies, processes and tools do companies use to overcome these challenges?

How do teams adopt microservices?

Out of dozens of companies we spoke with, only two had not yet started their journey to microservices, but both were actively considering it. Industry trends mirror this as well. In an O’Reilly survey of 1500+ respondents, more than 75% had started to adopt microservices.

It’s rare for companies to start building with microservices from the ground up. Of the companies we spoke with, only one had done so. Some startups, such as LaunchDarkly, plan to build their infrastructure using microservices, but turned to a monolith once they realized the high cost of overhead.

“We were spending more time effectively building and operating a system for distributed systems versus actually building our own services so we pulled back hard,” said John Kodumal, CTO and co-founder of LaunchDarkly.

“As an example, the things we were trying to do in mesosphere, they were impossible,” he said. “We couldn’t do any logging. Zero downtime deploys were impossible. There were so many bugs in the infrastructure and we were spending so much time debugging the basic things that we weren’t building our own service.”

As a result, it’s more common for companies to start with a monolith and move to microservices to scale their infrastructure with their organization. Once a company reaches ~30 developers, most begin decentralizing control by moving to a microservice architecture.

Teams may take different routes to arrive at a microservice architecture, but they tend to face a common set of challenges once they get there.

Large companies with established monoliths are keen to move to microservices, but costs are high and the transition can take years. Atlassian’s platform infrastructure is in microservices, but legacy monoliths in Jira and Confluence persist despite ongoing decomposition efforts. Large companies often get stuck in this transition. However, a combination of strong, top-down strategy combined with bottoms-up dev team support can help companies, such as Freddie Mac, make substantial progress.

Some startups, like Instacart, first shifted to a modular monolith that allows the code to reside in a single repository while beginning the process of distributing ownership of discrete code functions to relevant teams. This enables them to mitigate the overhead associated with a microservice architecture by balancing the visibility of having a centralized repository and release pipeline with the flexibility of discrete ownership over portions of the codebase.

What challenges do teams face?

Teams may take different routes to arrive at a microservice architecture, but they tend to face a common set of challenges once they get there. John Laban, CEO and co-founder of OpsLevel, which helps teams build and manage microservices told us that “with a distributed or microservices based architecture your teams benefit from being able to move independently from each other, but there are some gotchas to look out for.”

Indeed, the linked O’Reilly chart shows how the top 10 challenges organizations face when adopting microservices are shared by 25%+ of respondents. While we discussed some of the adoption blockers above, feedback from our interviews highlighted issues around managing complexity.

The lack of a coherent definition for a service can cause teams to generate unnecessary overhead by creating too many similar services or spreading related services across different groups. One company we spoke with went down the path of decomposing their monolith and took it too far. Their service definitions were too narrow, and by the time decomposition was complete, they were left with 4,000+ microservices to manage. They then had to backtrack and consolidate down to a more manageable number.

Defining too many services creates unnecessary organizational and technical silos while increasing complexity and overhead. Logging and monitoring must be present on each service, but with ownership spread across different teams, a lack of standardized tooling can create observability headaches. It’s challenging for teams to get a single-pane-of-glass view with too many different interacting systems and services that span the entire architecture.

Tecton.ai nabs $35M Series B as it releases machine learning feature store

/0 Comments/in /by

Tecton.ai, the startup founded by three former Uber engineers who wanted to bring the machine learning feature store idea to the masses, announced a $35 million Series B today, just seven months after announcing their $20 million Series A.

When we spoke to the company in April, it was working with early customers in a beta version of the product, but today, in addition to the funding, they are also announcing the general availability of the platform.

As with their Series A, this round has Andreessen Horowitz and Sequoia Capital co-leading the investment. The company has now raised $60 million.

The reason these two firms are so committed to Tecton is the specific problem around machine learning the company is trying to solve. “We help organizations put machine learning into production. That’s the whole goal of our company, helping someone build an operational machine learning application, meaning an application that’s powering their fraud system or something real for them […] and making it easy for them to build and deploy and maintain,” company CEO and co-founder Mike Del Balso explained.

They do this by providing the concept of a feature store, an idea they came up with and which is becoming a machine learning category unto itself. Just last week, AWS announced the Sagemaker Feature store, which the company saw as major validation of their idea.

AWS launches SageMaker Data Wrangler, a new data preparation service for machine learning

As Tecton defines it, a feature store is an end-to-end machine learning management system that includes the pipelines to transform the data into what are called feature values, then it stores and manages all of that feature data and finally it serves a consistent set of data.

Del Balso says this works hand-in-hand with the other layers of a machine learning stack. “When you build a machine learning application, you use a machine learning stack that could include a model training system, maybe a model serving system or an MLOps kind of layer that does all the model management, and then you have a feature management layer, a feature store which is us — and so we’re an end-to-end life cycle for the data pipelines,” he said.

With so much money behind the company it is growing fast, going from 17 employees to 26 since we spoke in April, with plans to more than double that number by the end of next year. Del Balso says he and his co-founders are committed to building a diverse and inclusive company, but he acknowledges it’s not easy to do.

“It’s actually something that we have a primary recruiting initiative on. It’s very hard, and it takes a lot of effort, it’s not something that you can just make like a second priority and not take it seriously,” he said. To that end, the company has sponsored and attended diversity hiring conferences and has focused its recruiting efforts on finding a diverse set of candidates, he said.

Unlike a lot of startups we’ve spoken to, Del Balso wants to return to an office setup as soon as it is feasible to do so, seeing it as a way to build more personal connections between employees.

Tecton.ai emerges from stealth with $20M Series A to build machine learning platform

Daily Crunch: Slack and Salesforce execs explain their big acquisition

/0 Comments/in /by

We learn more about Slack’s future, Revolut adds new payment features and DoorDash pushes its IPO range upward. This is your Daily Crunch for December 4, 2020.

The big story: Slack and Salesforce execs explain their big acquisition

After Salesforce announced this week that it’s acquiring Slack for $27.7 billion, Ron Miller spoke to Slack CEO Stewart Butterfield and Salesforce President and COO Bret Taylor to learn more about the deal.

Butterfield claimed that Slack will remain relatively independent within Salesforce, allowing the team to “do more of what we were already doing.” He also insisted that all the talk about competing with Microsoft Teams is “overblown.”

“The challenge for us was the narrative,” Butterfield said. “They’re just good [at] PR or something that I couldn’t figure out.”

Startups, funding and venture capital

Revolut lets businesses accept online payments — With this move, the company is competing directly with Stripe, Adyen, Braintree and Checkout.com.

Health tech venture firm OTV closes new $170M fund and expands into Asia — This year, the firm led rounds in telehealth platforms TytoCare and Lemonaid Health.

Zephr raises $8M to help news publishers grow subscription revenue — The startup’s customers already include publishers like McClatchy, News Corp Australia, Dennis Publishing and PEI Media.

Advice and analysis from Extra Crunch

DoorDash amps its IPO range ahead of blockbuster IPO — The food delivery unicorn now expects to debut at $90 to $95 per share, up from a previous range of $75 to $85.

Enter new markets and embrace a distributed workforce to grow during a pandemic — Is this the right time to expand overseas?

Three ways the pandemic is transforming tech spending — All companies are digital product companies now.

(Extra Crunch is our membership program, which aims to democratize information about startups. You can sign up here.)

Everything else

WH’s AI EO is BS — Devin Coldewey is not impressed by the White House’s new executive order on artificial intelligence.

China’s internet regulator takes aim at forced data collection — China is a step closer to cracking down on unscrupulous data collection by app developers.

Gift Guide: Games on every platform to get you through the long, COVID winter — It’s a great time to be a gamer.

The Daily Crunch is TechCrunch’s roundup of our biggest and most important stories. If you’d like to get this delivered to your inbox every day at around 3pm Pacific, you can subscribe here.

The Good, the Bad and the Ugly in Cybersecurity – Week 49

/0 Comments/in /by

The Good

The US Department of Justice has been busy this past week, sentencing two individuals to long prison terms for their cyber crimes.

Ryan S. Hernandez  (aka Ryan West or “RyanRocks” as he called himself online), 21, was sentenced to three years in prison, with a further seven years of supervised release and registration as a sex offender after release. Hernandes’ cyber crimes included spearphishing a Nintendo employee, stealing his credentials and downloading confidential Nintendo files related to its consoles and games, such as the then much-anticipated Nintendo Switch console. He then went on and shared this confidential information on gaming forums. 

In June 2019, FBI agents raided his house and seized numerous electronic devices. Further forensic investigation revealed that he had collected thousands of videos and images of minors engaged in sexually explicit conduct, which he stored in the aptly named folder “Bad Stuff”.

Hernandez will be joined in klink by another individual named Timothy Dalton Vaughn, 22, (aka “WantedbyFeds” and “Hacker_R_US”). Vaughn was a member of the “Apophis Squad,” a worldwide collective of computer hackers and swatters.

The collective has a reputation for making threatening phone calls and issuing bomb-related threats, but primarily engages in DDoS attacks. In early 2018, Vaughn demanded 1.5 bitcoin from a Long Beach company in exchange for not launching a DDOS attack against the company’s website. When it failed to make the payment, he launched an attack that knocked the website offline. Vaughn also possessed hundreds of sexually explicit images and videos depicting extremely young children.

Vaughn was sentenced to nearly eight years in federal prison for his crimes.

The Bad

Most of us are breathing a sigh of relief now that a viable Covid-19 vaccination seems just around the corner. However, before any effective vaccine can be distributed and administrated to the general public, it needs to be manufactured, stored and shipped with utmost care. In particular, the Moderna and Pfizer vaccines need to be stored at very low temperatures, -4 and -94, respectively. Those conditions make it necessary to have a dedicated network of “cold chain” distributors at every stage of delivery.

This week, security researchers at IBM have released findings concerning a malicious cyber campaign aimed at attacking this elaborate supply chain, focusing on companies and organizations associated with Gavi, the Vaccine Alliance’s Cold Chain Equipment Optimization Platform.

The campaign started in September and used Haier Biomedical, a credible and legitimate company that manufactures cold chain storage equipment. Purporting to be from a Haier employee, crafted phishing emails were sent to the European Commission’s Directorate-General for Taxation and Customs Union, as well as other organizations headquartered in Germany, Italy, South Korea, the Czech Republic, greater Europe and Taiwan. The emails attempted to harvest credentials to infiltrate the targeted organizations.

While the origin and goals of the campaign are still unclear, it seems that someone wants to nurture the capability to disrupt the global effort to develop and distribute vaccinations.

In addition, Interpol has issued an alert suggesting that “plain” cybercriminals would also utilize the public availability of a vaccine to gain some quick bucks. Interpol fears that the desire of some to obtain the vaccination at all costs will result in “Criminal networks targeting unsuspecting members of the public via fake websites and false cures, which could pose a significant risk to their health, even their lives.”

Interpol suggests extreme caution when looking for and ordering medicines online. However, just browsing these sites can put users at risk of contracting another kind of virus: Interpol’s Cybercrime Unit has revealed that of 3,000 websites associated with online pharmacies suspected of selling illicit medicines and medical devices, more than half contained cyber threats, especially phishing and spamming malware.

The Ugly

Brazilian newspaper Estadao reports that the personal information of more than 243 million Brazilians, both living and deceased, has been exposed online for at least 6 months.

The data leak came from a website called e-SUS-Notifica, an official web portal of the Brazilian Ministry of Health, where Brazilian citizens can sign up and receive official government notifications about the COVID-19 pandemic.

The site’s source code contained the administrator username and password encoded in a rather easy to decode format: Base64. Using the decoded credentials, it was possible to access the official Brazilian Ministry of Health (SUS) database, which stores information on all Brazilians who signed up for the country’s public-funded health care system, established in 1989, and contains full names, home addresses, phone numbers and, of course, medical records.

It’s not the first time the Ministry has had data security problems, with one security expert commenting that “Every time you stop and go to analyse the information security and data management policy of the Ministry of Health, you find a more serious vulnerability”.

It is not currently known if the data was illegally accessed during the six months it was exposed. The ministry says the incident is being investigated. If the database had been stolen or accessed without authorization, it would amount to the largest data breach Brazil has ever known.

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

The post The Good, the Bad and the Ugly in Cybersecurity – Week 49 appeared first on SentinelOne.

Why Slack and Salesforce execs think they’re better together

/0 Comments/in /by

When Salesforce bought Slack earlier this week for $27.7 billion, it was in some ways the end of a startup fairytale. Slack was the living embodiment of the Silicon Valley startup success fantasy. It started as a pivot from a game company, of all things. It raised $1.4 billion, went from zero to a $7 billion valuation to IPO, checking off every box on the startup founder’s wish list.

Then quite suddenly this week, Slack was part of Salesforce, plucked off the market for an enormous sum of money.

While we might not ever know the back (Slack) room maneuvering that went on to make the deal a reality, it is interesting to note that Slack CEO Stewart Butterfield told me in an interview this week that he was not actually trying to sell the company when he approached Salesforce president and COO Bret Taylor earlier this year. Instead, he wanted to buy something from them.

“I actually talked to Bret in the early days of the pandemic to see if they wanted to sell us Quip because I thought it would be good for us, and I didn’t really know what their plans were [for it]. He said he’d get back to me, and then got back to me six months later or so,” Butterfield said.

At that point, the conversation flipped and the companies began a series of discussions that eventually led to Salesforce acquiring Slack.

Big money, big expectations

From the Salesforce perspective, Taylor says that the Slack deal was worth the money because it really allows his company to bring together all the pieces of their platform, one that has expanded over the years from pure CRM to include marketing, customer service, data visualization, workflow and more. Taylor also said that having Slack gives Salesforce a missing communication layer on top of its other products, something especially important when interactions with customers, partners or fellow employees have become mostly digital.

“When we say we really want Slack to be this next generation interface for Customer 360, what we mean is we’re pulling together all these systems. How do you rally your teams around these systems in this digital work-anywhere world that we’re in right now where these teams are distributed and collaboration is more important than ever,” Taylor said.

Everyone has an opinion on the $27.7B Slack acquisition

Butterfield sees a natural connection between what people do in the course of their work, what machines do behind the scenes in these systems of record and engagement and how Slack can help bridge the gap between humans and machines.

He says that by putting Slack in the middle of business processes, you can begin to eliminate friction that occurs in complex enterprise software like Salesforce. Instead of moving stuff through email, clicking a link, opening a browser, signing in and then finally accessing the tool you want, the approval could be built into a single Slack message.

“If you have hundreds of those kinds of actions a day, there’s a real opportunity to increase the velocity, and that has an impact, and not just in the minutes saved by the person doing the approval, but the speed of how the whole business operates,” Butterfield said.

Competing with Microsoft

While neither executive said the deal was about competing with Microsoft, it was likely an underlying reason that the companies decided to join forces. They may prove better together than they are separately, and both have complicated histories with Microsoft.

Slack has had an ongoing battle with Microsoft and its Teams product for years. It filed suit against the company last summer in the EU over what it called unfairly bundling of Teams for free with Office 365. In an interview last year with The Wall Street Journal, Butterfield said that he believes Microsoft sees his company as an existential threat. Hyperbole aside, there is tension and competition between the two enterprise software companies.

Salesforce and Microsoft also have a long history, from lawsuits in the early days to making friends and working together when it makes sense after Satya Nadella took over in 2014, while still competing hard in the market. It’s hard not to see the deal in that context.

As Slack acquisition rumors swirl, a look at Salesforce’s six biggest deals

In a recent interview with TechCrunch, Battery Ventures general partner Neeraj Agrawal said the deal was at least partially about catching Microsoft.

“To get to a market cap of $1 trillion, Salesforce now has to take MSFT head on. Until now, the company has mostly been able to stay in its own swim lane in terms of products,” Agrawal told TechCrunch.

As for Butterfield, while he saw the obvious competition, he denied the deal was about putting his company in a better position to compete with his rival.

“I don’t think that was really an important part of the rationale, at least for me,” he said, adding “the competition with Microsoft is overblown. The challenge for us was the narrative. They’re just good PR or something that I couldn’t figure out,” he said.

While Butterfield cited a list of large clients in enterprise tech, insurance and banking, the narrative has always been that Slack was favored by developer teams, which is where it initially gained traction. Whatever the reality, with Salesforce, Slack is definitely in a better position to compete with any and all comers in the enterprise communications space, and while it will be part of Salesforce, the two companies also have to figure out how to maintain some separation.

Keeping Slack independent

Taylor certainly recognizes that Slack’s current customers are watching closely to see how they handle the acquisition, and his company will have to walk a fine line between respecting the brand and product independence on one hand, while finding ways to create and build upon existing hooks into Salesforce to allow the CRM giant to take full advantage of its substantial investment.

It won’t be easy to do, but you can see a similar level of independence in some of Salesforce’s recent big-money purchases like MuleSoft, the company it bought in 2018 for $6.5 billion, and Tableau, the company it bought last year for more than $15 billion. As Butterfield points out, those two companies have clearly maintained their brand identity and independence, and he sees them as role models for Slack.

Slack’s stock climbs on possible Salesforce acquisition

“So there’s a layer of independence that’s like that [for Mulesoft and Tableau] because it’s not going to help anyone call us Chat Cloud or something like that. They paid a lot of money for us, so they want us to do more of what we were already doing,” he said.

Taylor, whose opinion matters greatly here, certainly sees it in similar terms.

“We want to make sure we have a real integrated value proposition, a real integrated platform for developers, but also maintain Slack’s technology independence, technology agnostic platform and its brand,” he said.

Better together

As for the companies coming together, both men see a lot of potential here to merge Slack communications with Salesforce’s enterprise software prowess to make something better, and Taylor sees Slack helping link the two with workflows and automations.

“When you think about automation, it’s event driven, these long-running processes, automations. If you look at what people are doing with the Slack platform, it’s essentially incorporating workflows and bots and all these things. The combination of the Salesforce platform where I think we have the best automation intelligence capabilities with the Slack platform is incredible,” Taylor said.

The challenge these two men now face as they move forward with this acquisition, and all of the expectations inherent in a deal this large, is making it work. Salesforce has a lot of experience with large acquisitions, and they have handled some well, and some not so well. It’s going to be imperative for both companies that they get this right. It’s now up to Taylor and Butterfield to make sure that happens.

Salesforce buys Slack in a $27.7B megadeal