DEV Community: digital transformer

The Importance of API Security: Lessons from Wordle, Twitter, and AWS

digital transformer — Thu, 20 Jul 2023 06:21:11 +0000

API security has become a critical concern for businesses worldwide. Recent incidents involving Wordle, Twitter, and AWS underscore the need for robust API security measures.

Wordle's API: A Cautionary Tale of Data Exposure

Wordle, the popular online puzzle game, recently experienced a security loophole. A curious security researcher managed to reverse engineer Wordle's API, revealing not only the answers to the current puzzle but also those of future puzzles. The researcher was even able to make POST requests to the server, potentially altering the answers for future puzzles.

This incident highlights two critical API security risks. First, the risk of excessive data exposure, where the API inadvertently leaked information about upcoming puzzles. Second, the issue of broken function level authorization, where the API endpoint allowed unauthorized users to upload new puzzles.

Twitter's API Breach: The Risk of PII Exposure

Twitter, the global social media platform, suffered a significant API breach that leaked user information, including email addresses, phone numbers, and Twitter IDs. While this information alone might not grant account access, it provides a valuable database for cybercriminals. They can use this data to launch targeted spear phishing campaigns, tricking users into revealing their login credentials or capturing account reset details.

AWS's Undocumented API: The Danger of Insufficient Logging

In another incident, security researchers at Datadog discovered an undocumented API in the AWS management console. This API, which was not logged by the built-in AWS CloudTrail logging service, allowed access to specific identity and access management (IAM) requests. The lack of logging means an attacker could make calls to this API service undetected, highlighting the risk of insufficient logging and monitoring in API security.

Key Takeaways

These incidents underscore the importance of robust API security measures. Businesses must be aware of potential risks, such as excessive data exposure and broken function level authorization, and implement strategies to mitigate these risks. Regular monitoring and logging of API activities are crucial to detect any unusual activities and prevent potential breaches.

APIs, serving as the vital conduits for communication between various functions, are inevitably in the crosshairs of cyber attackers due to their integral roles in contemporary networks and services. As long as APIs are in operation, they will continue to be a prime target. However, businesses are not defenseless in this scenario. They can leverage the expertise of specialized API security companies that employ advanced tools to thwart malicious attacks.

For instance, consider Firetail, an innovative API security startup that emerged in 2022. Firetail is pioneering a unique approach to API security. Instead of retrofitting traditional network security methods to APIs, which often proves to be a square peg in a round hole, Firetail embeds robust security protection directly within the API itself. This strategy not only enhances the security but also ensures seamless integration, making it a promising solution for businesses aiming to fortify their API security.

As these examples show, a breach in API security can lead to significant data exposure, providing a goldmine for cybercriminals and potentially damaging the company's reputation. Therefore, businesses must prioritize API security to protect their data and maintain their customers' trust.

The Danger of AI in Cyber Security

digital transformer — Thu, 20 Jul 2023 06:10:50 +0000

Artificial intelligence (AI) is rapidly changing the cyber security landscape. While AI has the potential to be a powerful tool for protecting against cyberattacks, it also poses new risks.

AI can be used to automate many of the tasks involved in cyber security, such as threat detection, incident response, and vulnerability management. This can free up human security professionals to focus on more strategic and creative work.

However, AI can also be used by attackers to develop more sophisticated and targeted attacks. For example, AI can be used to create malware that is more difficult to detect or to launch denial-of-service attacks that are more difficult to mitigate.

In addition, AI can be used to create deepfakes, which are videos or audio recordings that have been manipulated to make it appear as if someone is saying or doing something they never said or did. Deepfakes can be used to spread misinformation or to impersonate someone in order to gain access to sensitive information.

The use of AI in cyber security is a double-edged sword. It has the potential to make our systems more secure, but it also poses new risks. It is important for security professionals to be aware of these risks and to take steps to mitigate them.

To mitigate the risks of AI in cyber security, security professionals should:

Stay up-to-date on the latest AI-related threats.
Use AI-powered tools to detect and respond to attacks.
Implement security controls that are designed to protect against AI-based attacks.
Train employees on how to identify and report suspicious activity.

The use of AI in cyber security is a complex issue. There are both risks and benefits to consider. However, by taking the necessary steps to mitigate the risks, security professionals can help to ensure that AI is used to make our systems more secure, not less.

Negotiating a path to commercial success

digital transformer — Tue, 19 Jul 2022 08:44:17 +0000

Chris Atkins explains why creating and implementing a high-performing negotiation culture can help a business deliver its business strategy.

Mention the desire to change your company’s culture and you will swiftly and yourself facing some resistance. There will be many who have grown up, and grown successful, within the existing culture, and the forces for maintaining the status quo will be as strong, if not stronger, than those that see the benefit in change.

Add to that the suggestion that the new culture should be anchored in a skill that may be merely a commercial necessity and eyebrows will understandingly begin to rise.

Every day, every team in your company negotiates internally and externally to get their job done. Only through negotiations can they achieve their goals. Only through their negotiations can you realize your company’s goals. So, when we talk about implementing a negotiation culture we are talking about developing a culture that directly enables your team’s ability to implement your business strategy.

So, let’s examine each of the elements of negotiation culture and try to unpick the “Why?”

I’ll start by considering and correcting some common misconceptions.

MISCONCEPTION #1: NEGOTIATION IS A WIN-LOSE GAME

One of the challenges of being a negotiation consultant is that people expect and assume that you specialize in being tough, argumentative, and insistent on driving a hard bargain. And when negotiation is an aggressive activity of last resort, then driving this into organizational culture could be considered a negative, even retrograde step, creating an unpleasant place to work for all but the toughest, most Machiavellian individuals.

But this is a narrow and misleading definition of negotiation. The much more interesting and complex truth is that in its most complete form, negotiation is a subtle, combined art of listening, understanding, and creative problem-solving. When we work with our clients in negotiation, regardless of the intervention, we consistently concentrate on supporting the desired behaviours of a successful negotiation team, who:

1. Know what they’re doing, their responsibilities, and their level of empowerment.
2. Plan efficiently and completely.
3. Objectively evaluate and mitigate risk.
4. Take control of their situation.
5. Understand and select options effectively. Know their counterparty.
6. Develop strategies and understand the “How?” as well as the “What?”.
7. Value elements and priorities from their point of view and their counterparty’s.
8. Ensure all parties are aligned throughout the process.
9. Ensure their plans and activities align with the overarching strategy.
10. Communicate effectively – internally and externally.
11. Have a replicable process and tools that maximize the chance of success.

Viewing these principles through a different lens, I suggest they are also the principles of sound commercial management which, when firmly embedded within a cultural framework that rewards these principles, will lead to better decisions being made, understood, and implemented effectively.

In our experience these principles, while appearing obvious when they are written down, are not commonly, consistently, or completely practised in many business environments. Sometimes it’s because we don’t have time to plan properly. Sometimes it’s because objective evaluation is not rewarded. And sometimes it just feels more heroic to fight fires than to stop them from igniting in the first place.

Whatever the reason, introducing and encouraging the habitual adoption of negotiation principles will start moving the needle toward a more commercially aware and astute approach. This will in turn start moving the profitability dial.

MISCONCEPTION #2: NEGOTIATION IS LIMITED TO CERTAIN SPECIALIST TEAMS

The sales team – they do the negotiating, right? Oh, and Procurement, of course. And while we are thinking about it, Supply Chain negotiates all the time. Hang on, what about Employee Relations, and their negotiations with unions or prospective hires? And Legal, well of course they negotiate contracts too. Marketing – don’t they negotiate with agencies? IT have ongoing negotiations with contractors and service providers. As do Facilities. I could go on.

Every team negotiates with someone daily, be it internal or external because negotiation is the act of two or more parties coming together to reach an agreement. And in today’s world, multiple stakeholders have an impact on the trajectory of negotiations that would have previously been conducted in a one-department “bubble”.

Here’s an example. We recently supported a multibillion-dollar RFP process for a significant portfolio of raw material commodities. Because this raw material sat at the core of our client’s end product, the award decision needed to consider many dimensions: environmental sustainability, contractual requirements, supply chain resilience, innovation, technical support, customer service, productivity, quality and, of course, cost. In total, more than 30 different factors were assessed, and all stakeholders needed to be satisfied. It is this ecosystem of factors that needs to be considered in any negotiation, all of which require suitable planning, alignment, and communication if a negotiation is to be successful in today’s environment.

MISCONCEPTION #3: NEGOTIATION HAPPENS AT THE END OF THE BUSINESS PLANNING PROCESS

No. Negotiation is the means by which an organization delivers its business strategy. At The Gap Partnership, we’ve built a reputation as negotiation specialists – and we’re proud of that. But increasingly it’s clear that we’re also specialists in the execution of business strategy, in realizing the goals set within that strategy and maximizing the chances of success.

We often encounter critical failure points in our negotiation support activities:

1. Specific negotiation goals are mismatched to individual KPIs.
2. Individual KPIs are mismatched to departmental objectives.
3. Departmental objectives are mismatched to business strategy.

The magnifying effect of this layering of mismatches results in a negotiated outcome that fails to deliver the business strategy, and in many cases has a directly contradictory outcome. So, the overarching business strategy is bound to fail in its execution. Consequently, our first task is recreating the connections between specific negotiation goals and business strategy.

The connection between organizational strategy and its execution – its negotiation – is inextricable, so it’s critical to consider the end-to-end process with all its many facets as the strategy is developed.

BRINGING IT ALL TOGETHER

What is negotiation culture, at its most fundamental? A great place to start is with the meaning of the words themselves. Both have their roots in Latin: Negotiation is from the Latin negotiari, meaning to carry out business. Culture is from the Latin cultus, meaning foster or cultivate.

So, negotiation culture is Fostering a [new/better] way of carrying out business.

To implement a successful negotiation culture requires us to understand and address shortcomings in three key areas:

The people that we hire, the methods by which we develop their capability, and the ways in which we encourage their behaviours.

The replicable process and methodology provides a more consistent chance of success in multiple scenarios, and the tools provided to support those processes with the thinking that underpins them.

The organizational structures that we put in place provide governance, guidance, and empowerment. Cultural reinforcement develops habits, facilitates communication, and creates a safe learning environment and a corporate memory which reduces reliance on the knowledge of few individuals.

Let’s return to our original questions: “Why do I need to change the culture of my organization and why would I choose a negotiation culture?”

Because an organization with a strong negotiation culture has everything in place to execute and deliver its commercial business strategy. Because the commercial world is changing, and the speed of change will continue to accelerate. Because it is imperative to keep pace with change today: the competitor you’ve never heard of is doing it already.

The rise of data insights and self-service analytics

digital transformer — Wed, 06 Jul 2022 10:16:51 +0000

Discover how organisations are making data insights more available to their teams and customers by creating new self-service analytics tools.

Data analytics tools have been on the rise in organisations over the past decade – but the recent pandemic years have seen the demand for data insights shoot to new heights.

As companies worldwide have faced unprecedented challenges and changes, the demand for helpful business intelligence has soared. This was not just to gain a competitive advantage – for many businesses it has made the difference between survival and extinction.

Data analytics power to the people

At the same time, ways of working have changed dramatically. Employees moved overnight to remote working – and have had to become much more resourceful and self-sufficient. When it comes to data analytics, organisations realise they cannot always have IT specialists and data scientists conducting the analysis for business teams. They must equip their workforce with new self-service digital tools that empower employees to derive their own insights.

This movement also extends to the customer. As companies have had fewer customer service staff available, they have had to provide customers with new digital ways to serve themselves. For example, customers are increasingly used to being given access to data about the products and services they buy from your business – and to gain insights about how they are consuming these.

Overall, these trends mean that data analytics tools today are judged not just in terms of advanced capabilities – but increasingly in terms of their ease of use and intuitive user interfaces.

Unlocking value from business data

Businesses today are creating, accessing and storing more data than ever before. This is not only structured data like spreadsheets and databases – but also increasingly unstructured data, streaming in real-time from online transactions, social interactions, and IoT device sensors.

However, on average, up to 73% of all data within an organisation goes unused for analytics. (Source: Forrester) This means that most of the potential value in a company’s data is never unlocked and utilised.

Conventional data analytics and business intelligence (BI) tools are also not accessible or usable by most business people – or by their customers. So even when potentially valuable data is made available, most people have no easy way to get insights from it.

Making data insights more available

Consumers are increasingly used to accessing data insights and visualisations about the products and services they use – whether that’s electricity usage recorded via a smart metre, financial analysis of their bank transactions, or an interactive summary of their digital music consumption. Business users are bringing these consumer expectations into their working lives – and want similar data insights from enterprise service providers.

In response, businesses are creating a variety of new digital tools and dashboards that make it quick and easy for customers and employees to bring data insights to life.

These self-service analytics tools enable customers or business users to run queries and generate reports themselves via a web browser or mobile app, without needing specialist IT assistance.

Success with self-service analytics

Three factors are vital for delivering a successful self-service analytics tool:

Making the right data accessible for analytics: These self-service tools provide a range of basic analytic capabilities, based on an underlying data model. This data has usually been processed, simplified or scaled down, for clarity of understanding and ease of access. Making the right data available to the tool may require consolidation of siloed data sources, real-time data processing, and development of new application programming interfaces (APIs).

Understanding what users want to know: Rather than providing advanced general-purpose analytics, these tools are configured to answer a specific set of questions that users need answers to. For the tool to be truly useful, it must be created based on research and understanding of the most frequent and pressing user needs.

Making insights clear with design and visualisation: The goal of these tools is to deliver insights via an outstanding user experience (UX). Rather than just viewing data in lists and tables, they should provide graphical dashboards and interactive visualisations, to make the meaning and value of the data immediately clear.

Meeting industry demand for data insights

One good example of this trend in action is a recent project by satellite communications business Inmarsat – a leading enabler of data connectivity to the maritime industry. As an airtime service provider for many global fleets, Inmarsat enables the lifeline of connectivity for thousands of vessels across the world’s oceans.

Fleet owners need to operate their vessels efficiently. Many of them already use Inmarsat’s connectivity to enable “smart ship” systems, sending real-time data to the fleet manager on metrics such as location, speed, engine performance and fuel consumption.

However, one area where fleet owners have lacked insight is on connectivity itself. They increasingly want to know how, when and where airtime is used – and to confirm that their connectivity meets Service Level Agreements (SLAs).

Previously, if a customer wanted to understand the connectivity performance for its vessels, Inmarsat would have to manually create a report from its various data logs, requiring cost, time and effort.

Inmarsat is committed to continuously improving its services to customers – and giving them clearer visibility into the connectivity they receive is an ideal way to achieve this.

Creating a self-service analytics tool in practice

Recently, Inmarsat worked closely with London-based digital product agency Elsewhen to create a new customer-facing self-service online analytics platform. The aim was to provide real-time and historical data insights on the connectivity experienced by each vessel.

The project team identified what relevant data existed – and where it was located in Inmarsat’s systems. The team developed a new API that would enable the platform to access the data it needs for analytics. They also consulted with Inmarsat’s customers to determine which insights would provide the most value.

The new analytics platform gives Inmarsat’s customers a comprehensive picture of their vessels’ connectivity and airtime usage over a user-specified timeframe. Gaining a visual representation of the status and location of each vessel helps fleet owners understand how connectivity may be affected by geography, weather and other factors. It provides a responsive user interface for display on a range of devices – and is quick and easy to use, even when working with data for very large fleets.

The benefits of self-service insights

Creating a modern self-service analytics platform and API for visualising connectivity data is enabling Inmarsat to unlock new value for its customers. The anticipated follow-on benefits for Inmarsat include a reduction in manual work to resolve client queries, as well as improved customer satisfaction, loyalty and revenue.

The dashboard helps Inmarsat demonstrate to customers that they are getting a good service and value for money. Fleet owners can see at a glance where each of their vessels has travelled, the connectivity it has experienced, and for what purpose the airtime was being used.

The implementation of this new product has enabled Inmarsat to hit several of its strategic targets. As well as reducing burden on Inmarsat’s customer support team, the new platform has helped its sales team to prove Inmarsat’s contract value and ROI to new prospects and existing customers.

*Empower customers and employees with self-service data analytics
*
So in conclusion, your organisation can now give your customers or employees the ability to analyse and visualise data on the performance and status of your business processes, products, services and other metrics. By providing a self-service analytics tool and dashboard, you can empower people with more insight, confidence and satisfaction from your data.

Best python libraries for web scraping in 2022

digital transformer — Mon, 20 Jun 2022 08:05:12 +0000

Python is a versatile language that can be used for a wide variety of tasks, including web scraping. In this article, we'll take a look at some of the best Python libraries for web scraping, which can make your life much easier when extracting data from websites.

1. Beautiful Soup

Beautiful Soup is a Python library for parsing HTML and XML documents. It offers a very simple API for extracting data from websites. Beautiful Soup is also one of the most popular web scraping libraries for Python.

2. Scrapy

Scrapy is a Python framework for building web spiders, which are used to crawl and scrape websites. Scrapy is very powerful and fast, and it can be used to extract large amounts of data from websites. It's also one of the most popular web scraping frameworks for Python.

3. Selenium

Selenium is a web testing tool that can be used to automate web browsers. Selenium can be used to scrape websites that are rendered by JavaScript. It's also one of the most popular web scraping tools for Python.

4. urllib2

urllib2 is a standard Python library for opening URLs. It can be used to fetch pages from websites and to make HTTP requests. urllib2 is very simple to use and it's one of the most popular libraries for web scraping in Python.

Beautiful Soup

Beautiful Soup is a Python library that is designed for web scraping. It has a simple and easy-to-use interface. Beautiful Soup makes it easy to extract data from HTML documents.

Beautiful Soup handles errors gracefully: If it encounters an error while parsing a document, it will print out a warning message. But it will still continue to parse the document and return the data that it was able to extract.

BeautifulSoup is very fast and efficient, and it can handle a large amount of data without slowing down your computer.

Overall, Beautiful Soup is an excellent Python library for web scraping. It is easy to use and can handle errors gracefully. It is also available for free under the MIT license.

Scrapy

Scrapy has a wide range of features that make it easy to use and powerful. Scrapy is open source and available under the BSD license.

Scrapy is fast and efficient. It can handle large amounts of data without crashing. Scrapy is also very flexible. It can be used for a wide range of projects, from small personal projects to large-scale commercial projects.

Scrapy has an active community of developers who contribute to the project. This means that there is always someone available to help if you run into any problems. Scrapy is well-documented, so you should be able to find everything you need in the documentation.

Selenium

Selenium is easy to use and well-documented. It also has good support for a wide range of browsers, including Chrome, Firefox, Safari, and Edge.

Selenium is a web driver that allows you to automate web browsers. It is very easy to use and can be integrated into your web scraping projects.

The Selenium-based scraping solution is more complex to install than the BeautifulSoup-based solutions. It requires a driver to be installed on your machine, and it can take longer to scrape websites.

To use Selenium with Python, you need to install the selenium package using pip:

pip install selenium

Urllib

Urllib is a Python library that allows you to access websites and download data from them. It is very easy to use and can be integrated into your own web scraping projects.

Urllib is very fast and efficient, and it can handle a large amount of data without slowing down your computer. It is very reliable and has been used by many professional web scrapers.

Urllib is available for free from the Python Package Index.

Requests

Requests is one of the most popular Python libraries for web scraping. It allows you to make HTTP requests to website URLs and process the response data. Requests supports HTTPS, so you can scrape websites that use SSL encryption.

You can install Requests using pip:

pip install requests

Once installed, you can import the library into your Python code:

import requests

Conclusion

As you can see, there are plenty of great Python libraries for web scraping. Be sure to check out each of these libraries so that you can find the one that best suits your needs.

Happy scraping!

Python vs PHP which one is better to learn in 2022 Introduction

digital transformer — Fri, 17 Jun 2022 08:44:37 +0000

It can be hard to decide which programming language to learn when there are so many different options available. If you're trying to choose between Python and PHP, this article will help you make a decision by providing an overview of each language's key features.

What is Python?

Python is a programming language with many features that make it attractive for beginners and experienced programmers alike. Python is easy to read and write, and its syntax is simple and straightforward. Python also has a large standard library that contains modules for many different tasks, making it easy to get started with programming in Python.

PHP is a popular server-side scripting language. PHP code is executed on the server, and the results are then sent to the client (the web browser). PHP is widely used for developing dynamic websites. PHP code can be embedded into HTML code, making it easy to create dynamic web pages.

Python and PHP are both widely used programming languages. Python is known for its ease of use, while PHP is known for its power and flexibility. When deciding which language to learn, it is important to consider what you want to use the language for. If you want to develop dynamic websites, then PHP would be a better choice. If you want to learn a language that is easy to read and write, then Python would be a better choice.

What is PHP?

PHP is a server-side scripting language. That means that when a user visits a website that is powered by PHP, the server will execute the PHP code and generate the HTML output that is sent to the user's browser.
PHP is one of the most popular web programming languages. It is used by millions of websites, including some of the biggest sites on the internet.
PHP is relatively easy to learn. If you are already familiar with another programming language, such as C++ or Java, then you should be able to pick up PHP fairly easily. However, if you are new to programming, then you may find PHP a bit more challenging to learn.
There are many good reasons to learn PHP. Firstly, it is a very popular language and there is high demand for PHP developers. Secondly, it is relatively easy to learn compared to other programming languages. Thirdly, PHP can be used to create dynamic websites that are interactive and user-friendly. Finally, learning PHP will give you a good foundation for learning other server-side languages such as Ruby on Rails and ASP.NET

Which one should you learn?

There is no easy answer when it comes to deciding between Python and PHP. Both languages have their own strengths and weaknesses. Ultimately, the best language for you to learn will depend on your own needs and preferences.

If you are looking for a language that is relatively easy to learn, then Python might be a good choice. Python syntax is clean and simple, making it easy to read and write code. Additionally, there are many resources available online if you need help understanding a concept or want to learn more about the language.

On the other hand, PHP might be a better choice if you need a language that is more widely used. PHP is used by some of the biggest websites in the world, including Facebook and WordPress. If you know PHP, you will have no trouble finding a job as a web developer. Additionally, PHP has many different frameworks available that can make web development more efficient.

There are a few things to consider when deciding which programming language to learn. One important factor is the job market. According to the website Stack Overflow, Python is the most popular programming language, followed by PHP. This means that there are more job opportunities for Python programmers.

Another thing to consider is the difficulty of the language. Python is considered to be a easier language to learn than PHP. This is because Python uses simple syntax and has an intuitive structure. PHP, on the other hand, can be more difficult to learn because it has more complex syntax.

So, which one should you learn? If you are looking for more job opportunities, then Python would be the better choice. However, if you are looking for a language that is easier to learn, then PHP might be a better option.

In the end, it is up to you to decide which language is best for you. If you are unsure, try experimenting with both languages before making a decision.

Conclusion

Python and PHP are two of the most popular programming languages. They are both versatile, powerful, and easy to learn. So, which one should you learn in 2022?

If you're looking for a language that will be in high demand by employers, Python is the way to go. According to the TIOBE Index, Python is the third most popular language in the world and it is expected to continue growing in popularity. On the other hand, PHP is not growing as quickly as Python and it ranks sixth on the TIOBE Index.

So, if you're looking for a language that will give you an edge in the job market, Python is the better choice. However, if you're just starting out and want to learn a language that is relatively simple but still powerful, PHP might be a better option for you.

What do you think?