Mark Nottingham

The traveling salesman problem in AI - Rethinking the "Heatmap + Monte Carlo Tree Search" Paradigm for Solving Large Scale TSP https://lnkd.in/g4c4K5ij

2

Azure OpenAI is now approved for government use! Federal agencies can securely deploy Azure OpenAI services into new or existing accredited cloud environments. From planning ATO to implementing use cases, explore how AI can support mission-critical operations while ensuring top-tier security. Read the announcement: https://okt.to/QVJm7p Learn how AIS can help you navigate the deployment process on our blog: https://okt.to/Qu0jPl #AzureOpenAI #GovernmentAI #FedRAMP #DoD #CloudSecurity #DigitalTransformation #MicrosoftAzure

16

From Australia comes the news that Google accidentally deleted all of UniSuper‘s private cloud environment “due to an error in provisioning”. As much as the incident will be analysed to death, the more interesting question is: “How will they recover?”. In this week's Multi-cloud Midweek we’ll look at how cloud environments can fail and what can be done in terms of recoverability. https://lnkd.in/dcEnwFDD

1

The Australian Government updated its guidance on Post Quantum Cryptography (PQC) on 12th December. It has stated that Diffie Hellman (DH, ECDH, and ECDSA) and RSA "will not be approved for use beyond 2030". Instead, the PQC algorithms ML-KEM and ML-DSA have been added to the list of approved cryptographic algorithms. The guidelines state "the development or procurement of new cryptographic equipment and software, which is intended to be used beyond 2030, should be undertaken with the goal of supporting ASD-approved post-quantum cryptographic algorithms by 2030". In other words, if you are selling an IT system to the Australian Government from next year, and it has a 5 year expected lifetime, it will need to be able to support PQC. https://lnkd.in/e55Hzvcr #quantum #quantumsafe #quantumcomputers #postquantumcryptography #pqc

22

The Open Source Initiative (OSI), self-declared “steward” of Open Source, has finally succeeded in killing its community dead with heavy-handed censorship, which is a weird thing for an organisation to do that’s “actively involved in Open Source community-building”. From moderating, closing, and forking posts to outright banning members, it seems no tool of repression is too much for its community managers. Their formerly animated Discourse discussion forums haven’t seen a third-party post by anyone not on the payroll in over a month now, ever since they launched their Open Source AI Definition (OSAID) 1.0 over a steady stream of objections (up to and including the last post). Fortunately, several community members saw it coming and cast off a life raft at https://lnkd.in/g29DBMqU, including an active and uncensored Discourse server at https://lnkd.in/gg7CSB9e — see you there! #OpenSource #FreeSoftware #Censorship #Freedom #FreedomOfSpeech #ArtificialIntelligence #AI #OpenAI #OSAID

7

1 Comment

This post is the first one of a series about debunking preconceptions about 'Large Language Models and Identity'. I've been told that comments and followers are better than "likes." So, if your summer vacation allows, please #comment_and_follow the IAMONES page. #Everything_as_Natural_Language_in_Identity

15

1 Comment

The debate between public cloud adoption and on-premises infrastructure is more relevant than ever. Dmitry Shevrin's latest blog post explores the motivations behind cloud repatriation and the factors that support on-prem Kubernetes. Read more about why organizations are reevaluating their cloud strategies, dive into the debate between cloud and on-prem, and see how Kubernetes bridges the two. Check out Dmitry’s insights here 👉 https://lnkd.in/dR5dj9gQ

24

📣 Issue 76, 77 & 78 is out. Highlights: - SES Mail Manager now supports full lifecycle logging. - Amazon ECR expands registry policy to all ECR actions. - Get Phished by a Public AWS Systems Manager Automation Document by Gabriel Koo. - Bedrock Slip: Sysdig TRT Discovers CloudTrail Logging Missteps. - Deep Dive: AWS Organization Policies (Part 1). - CISA Binding Operational Directive (BOD 25-01): Implementing Secure Practices for Cloud Services. https://lnkd.in/eZDSyTuN

8

🚀 DevSecOps in Action at the Australian Azure Users Group! 🚀 We’re excited to share that our Principal Consultant, Chirag Dave, and CEO, Ossie Terron, recently spoke at the Australian Azure Users Group, discussing “DevSecOps: A Pathway to Achieving Continuous Authority to Operate (CATO).” In this blog, we recap their key insights, including how adopting DevSecOps practices can enhance security, accelerate deployment, and ensure continuous compliance. Whether you’re already familiar with DevSecOps or just starting to explore it, this session is packed with valuable takeaways. 👉 Read the full blog and watch the video here: [Link to Blog] #DevSecOps #CATO #Cybersecurity #CloudSolutions #ShowtimeConsulting #Azure #Innovation

35

2 Comments

Congratulations to my fellow Penten colleagues David Liebowitz and Phillip Yialeloglou whom with respected researchers from CSIRO's Data61 (Raymond K. Zhao, Nazatul H. Sultan, Dongxi Liu, Josef Pieprzyk) have just successfully presented a paper titled “MIKA: A Minimalist Approach to Hybrid Key Exchange” at the 21st Annual International Conference on Privacy, Security, and Trust conference. Here’s my interpretation of the paper: The focus is on a practical implementation and performance benchmarking of a hybrid keying system that uses both classical and Post-Quantum Cryptography (PQC) algorithms, while minimising changes to the classic code implementation in the open-source strongSwan library. MIKA is designed to enable the negotiation of multiple session keys using diverse key exchange methods and key negotiation protocols. In my view, this is a highly practical approach to introducing PQC into our existing infrastructures.

36

1 Comment

Are you in need of justification for investment in certificate lifecycle management? Tim Callan and I map the crucial role of CLM to NIST's Cybersecurity Framework 2.0. In glorious video.

12

1 Comment

In this article Kevin Kline, Database Technology Evangelist at SolarWinds, shares his opinion about critical decisions tech teams in Australia are facing that will shape the future of their cloud strategies. https://bit.ly/3DwRPYo

2

Aave hacked via periphery contract — $56K stolen from ‘tip jar’ Quote "The affected periphery contract, ParaSwapRepayAdapter, isn’t part of the core Aave protocol and appears not to have been audited." The new version of CCSS will ensure this does not happen. All smart contracts must be audited before use by stakeholders. There are currently three new CCSS requirements for smart contract audits under review addressing the main threat vectors. #DigitalAssetsFramework #DigitalAssets #VirtualAssets #CryptoCustody #CryptoCompliance #Crypto #CryptoCurrency #ccss #ccssa #informationsecurity #digitalpayments #cryptosecurity #informationsecurity #risk https://lnkd.in/gtt-TG8p

4

The Australian Signals Directorate and Australian Cyber Security Centre update their Guidelines for Cryptography. Highlights: 👉 While they have approved ML-DSA and ML-KEM, they haven't approved SLH-DSA. 👉 Classical cryptography will not be approved for use beyond 2030. 👉 Security level 1 ML-DSA and ML-KEM are not approved. 👉 Security level 3 ML-DSA and ML-KEM will t be approved for use beyond 2030. 👉 AES-128 and AES-192 will not be approved for use beyond 2030. 👉 The development and procurement of new cryptographic equipment and software ensures support for the use of ML-DSA-87, ML-KEM-1024, SHA-384, SHA-512 and AES-256 by no later than 2030. If somebody asks you why preparing the migration now if we don't know when a cryptographically relevant quantum computer will exist, you can answer it is not because of the quantum computer: It is because of the already available standards and regulations. Thanks to Tomas Gustavsson for sharing this. https://lnkd.in/dZrVBrSV

33

Join Perconian Lester Sydney at the Apex Assembly for an insightful session on open source databases! Key takeaways: 👉 Cut costs without compromise 👉 Freedom to innovate 👉 Future-proof your strategy 🔗 https://bit.ly/3OkOpKs #OpenSource #OSS #database

8

I asked Gemini what it thought about a Microsoft O/S Ring 0 driver that could load p-code and run it through download. Here is what Gemini said: -- Creating a Ring 0 driver that pulls in and executes P-code is an extremely dangerous proposition. Here's why: Unpredictable Behavior: P-code is typically interpreted, which introduces performance overhead and makes the behavior of the code less deterministic. In the critical context of Ring 0, this is a recipe for instability. Security Nightmare: Introducing dynamic code execution into Ring 0 opens up a vast attack surface. Malicious code could be injected, potentially leading to system compromise. Violation of Trust: Drivers are expected to be static entities with a well-defined purpose. Dynamically loading and executing code contradicts this fundamental assumption. WHQL Certification Issues: Such a driver would likely not pass WHQL certification due to the inherent instability and security risks. In conclusion, while there might be theoretical use cases for dynamic code execution, Ring 0 is categorically the wrong environment for it. The potential consequences are far too severe. -- And yet... hmmmm.

1