Now your sweaty body can power your phone. Like Neo in the Matrix, a new system created by researchers at North Carolina State University lets you generate electricity with a wearable device. Previous systems used massive, rigid heat sinks. This system uses a body-conforming patch that can generate 20 μW per centimeter squared. Previous systems generated only 1 microwatt or less.

The system consists of a conducive layer that sits on the skin and prevents head from escaping. The head moves through a thermoelectric generator and then moves into an outer layer that completely dissipates outside the body. It is 2mm thick and flexible.

The system, which is part of the National Science Foundation’s Nanosystems Engineering Research Center for Advanced Self-Powered Systems of Integrated Sensors and Technologies (ASSIST), has a clear path to commercialization.

The goal is to embed these into health tools that can measure your vital signs without needing to be recharged. “The goal of ASSIST is to make wearable technologies that can be used for long-term health monitoring, such as devices that track heart health or monitor physical and environmental variables to predict and prevent asthma attacks,” said researcher Daryoosh Vashaee, an associate professor at NC State. “To do that, we want to make devices that don’t rely on batteries. And we think this design and prototype moves us much closer to making that a reality.”

Google has been offering public cloud services for several years now, but the company has continued to lag behind Amazon and Microsoft in customer growth. 

Under the leadership of VMware co-founder Diane Greene, who serves as the executive vice president of Google Cloud Enterprise, the tech titan has focused harder on forging partnerships and developing products to appeal to large customers. It has added a number of key customers under Greene’s tenure, including Spotify.  

One such win is Evernote, which announced Tuesday it would be migrating its service away from its private data centers and to Google’s public cloud. When Evernote was looking for a public cloud provider, the company was interested in not only the base level infrastructure available, but also high-level machine learning services and services for building machine learning-driven systems, said Anirban Kundu, Evernote’s CTO.

Tools like Google’s Cloud Natural Language API, a service that helps parse human language into something that a program could understand, were a major draw for Evernote. In fact, those high-level machine learning tools were enough to knock Amazon Web Services — often considered the leading public cloud platform — out of contention for Evernote’s business.

“AWS, they’re strong on the machine learning infrastructure side of things, but on the machine learning applications, we thought Google was definitely head-and-shoulders above them,” Kundu said in an interview.

Kundu’s assessment of Amazon’s machine learning capabilities was echoed on stage at TechCrunch Disrupt by LinkedIn co-founder Reid Hoffman, who said that Google and Microsoft were the leaders in cloud machine learning, while AWS is “working to get there.”

Moreover, Kundu said that Google’s services were more accurate than its remaining competition for the sort of tests that Evernote ran on them. In addition to looking at the possible features available from a platform’s machine learning services, it’s important for cloud customers to actually evaluate what those services are able to do, he said.

When asked whether Google ended up stronger than Microsoft when put to the test, Kundu said that he didn’t want to call one company weaker than the other, but that “the results were pretty strong in Google’s favor.” 

Those machine learning tools are important to Evernote, as the company looks to build on its existing popular note-taking app and create new intelligent applications. As more companies look to adopt machine learning tools, Google’s capabilities may help it close the gap with its competition in the public cloud market. 

“The proximity of strong developer services around data science is a key capability,” IDC analyst Al Hilwa said in an email. “Google has clearly invested greatly in this space in many ways because of it generates enormous amount of data and because of its investments in other AI initiatives over the years. What is new and interesting here is using these capabilities as a lever to attract customers like Evernote to its public cloud.”

What’s not clear yet is whether that lever will be successful over the long run in attracting companies to Google’s cloud instead of its competitors, especially since all of the major players in the cloud are constantly updating their capabilities. 

Evernote isn’t the only company using Google’s machine learning capabilities. Disney used the Cloud Vision API to build a marketing tool for its remake of “Pete’s Dragon,” while website building company Wix used the same tool to help its customers find images relating to the content of the site they’re working on. 

Actually getting Evernote moved over to Google’s cloud will be a massive task. The company has about 3 petabytes (a petabyte is 1,000TB) of data stored in its data centers. Evernote plans to begin migration in October, and hopes to have completed the move by the end of this year, Kundu said.

At the same time, the company is working on developing new capabilities that take advantage of Google’s cloud, both in terms of machine learning applications and cloud infrastructure in general. 

StorSimple Virtual Array (SVA) can be configured as a File Server or as an iSCSI Server. Configured as a File Server, StorSimple Virtual Array provides the native shares which can be accessed by users to store their data. StorSimple Virtual Array configured as an iSCSI server provides volumes (LUNs), which can be mounted on an iSCSI initiator (typically a Windows Server). This blog post looks at the various requirements that should be considered when choosing a configuration of the StorSimple Virtual Array for a remote or branch office.

Architecture

Useful Links:

StorSimple Virtual Array Overview

StorSimple Virtual Array Deployment Videos

StorSimple Virtual Array Best practices

How often do you receive an email message with a footer like this:

The contents are not to be disclosed to anyone other than the addressee. Unauthorised recipients must preserve this confidentiality and should please advise the sender immediately of any error in transmission.

This gem of pseudo-legal nonsense is from a message that I did not solicit and is the work of eDigitalResearch.com at the behest of ”The Expedia Customer Experience Team.” At some point, someone in either or both organizations must have thought this footer was necessary which is curious because the serious, weighty, highly private content in the message was a customer satisfaction survey addressed to me. Was this, you might be wondering, a very personalized survey with, perhaps, sensitive, personal data included? Nope, and here, at the very slight risk of their dogs of law snapping at me, is the message that had the above footer appended:

Pretty personal, eh? The survey was triggered by my recent and very disappointing stay at the DoubleTree Club by Hilton Orange County Airport. I posted my review to Yelp but unlike other reviews I’ve written, neither Hilton nor Expedia has made any attempt to address my concerns.

What was even more annoying about this survey from Expedia was that days before, minutes after check-in at the hotel, they’d sent me another survey by email! As with the majority of these surveys, there’s no benefit whatsoever to the person being surveyed even when it provides the opportunity to complain because you are hugely unlikely to ever get any response. You have to wonder why anyone ever bothers responding.

So, back to the footer … why the stern and forbidding legalese and does it have any real legal juice behind it? I posted about this to my favorite list and a list-friend, Karl Hakkarainen of Queens Lake Consulting, replied:

Usual disclaimer: I am not a lawyer, etc. … In the short bit of research that I’ve done, I’ve yet to find a case where blather of this type led to any kind of meaningful outcome (good or bad). There might be a few cases out there, but the signal to noise ratio is extremely low. … The lawyers I know who actually get stuff done don’t have this detritus in their messages.  

After a bit of research I discovered a 2013 post on the American Bar Association’s site, Do Email Disclaimers Really Work? in which the author, John Hutchins, comments:

There is virtually no scholarly analysis of the impact of email disclaimers and very little analysis by non-scholars. One of the few authors who have commented on the subject suggests that the misconception that email disclaimers have validity may arise from the mistaken belief that the Electronic Communications Privacy Act (ECPA) somehow applies … But, as this author points out, the ECPA prohibits only “intercepting” emails. Emails that arrive at their destination—even if the sender did not intend that destination—are not emails that have been intercepted in transit, and the ECPA is therefore inapplicable. In short, the ECPA is focused on the criminal intent of the interceptor, not the ability of the sender to execute his or her own intentions.

Interesting! But, confusingly, Hutchins adds:

I’m not suggesting that everyone who uses disclaimers at the end of emails immediately run out and order the IT staff to delete them. Although rare, there are circumstances where “everybody does it” is as good a reason to do something as any. Email disclaimers cost nothing, and you certainly won’t be in the minority if you use them.

So, what this advice amounts to is that legal footers are most likely completely pointless but, go on, continue to act like sheep. Great. ANother opinion, this time from the Economist’s post, Spare us the e-mail yada-yada:

E-mail disclaimers … are mostly, legally speaking, pointless. Lawyers and experts on internet policy say no court case has ever turned on the presence or absence of such an automatic e-mail footer in America, the most litigious of rich countries.

Many disclaimers are, in effect, seeking to impose a contractual obligation unilaterally, and thus are probably unenforceable. This is clear in Europe, where a directive from the European Commission tells the courts to strike out any unreasonable contractual obligation on a consumer if he has not freely negotiated it. 

So, as is common in many situations where the Internet runs full tilt into how we used to do business, the answer as to whether disclaimer footers are a good thing is a faint maybe, possibly, sort of yes, but, in reality, no, not at all; they’re just a waste of time. As for the endless surveys every time you buy something or stay in a hotel or do pretty much anything, they’re also a total waste of everybody’s time. So, if your organization is adding disclaimer footers or sending out pointless, stupid surveys please stop it and make our lives and our email just a little less annoying.

Comments? Thoughts? Connect to me or comment below then follow me on Twitter and Facebook.

The Department of Energy says the $40 million it is investing in nearly two dozen multi-year projects will result in exascale computing systems that perform calculations on data 50 to 100 times faster than today’s most powerful supercomputers.

The DoE Exascale Computing Project says such high-performance computing systems can make at least a billion billion calculations per second, and will be used to process data for applications such as energy security, economic security, scientific discovery, healthcare and climate/environmental science. The U.S. is shooting to attain such powerful systems by the mid-2020s and China is aiming for 2020.

MORE: The 10 Most Powerful Supercomputers in the World

The project fits with President Obama’s overall National Strategic Computing Initiative, which is also being undertaken by the Department of Defense and the National Science Foundation.

Leading the Exascale Computing Project will be six DoE labs, including Argonne, Lawrence Berkeley, Oak Ridge, Los Alamos, Lawerence Livermore and Sandia.

A sampling of projects (15 fully funded, 7 with seed funding): 

*Exascale Deep Learning and Simulation Enabled Precision Medicine for Cancer

*Data Analytics at the Exascale for Free Electron Lasers

* Computing the Sky at Extreme Scales

MORE: 10 of today’s really cool network & IT research projects

Backup and disaster recovery are brilliant applications for cloud and Microsoft now reckons it has made Azure an enterprise-grade contender, at least for workloads and data already in Azure.

Redmond’s revealed that Azure Backup’s had an upgrade that delivers the following:

• Ability to view all backup policies in a Recovery Services vault from a single window
• Ability to add a new policy from policy list view
• Ability to edit a backup policy to match modified backup schedule and retention requirements – once a backup policy is updated, changes are pushed automatically to all virtual machines configured with the policy
• Ability to add items to a backup policy – add more virtual machines to an existing backup policy in a single click
• Get a view of virtual machines protected with a policy
• Delete a backup policy which is no longer in use

There’s nothing startling on that list, but there is some nice automation and sensible enhancements that if applied thoughtfully should protect Azure VMs rather nicely.

And enterprise grade? There’s a bit of “any colour you want so long as it is black” in that claim, seeing as Azure Backup only backs up Azure. At the very least it’s a very useful set of new features that makes Azure more robust while highlighting how the cloud can be a rather simpler environment than the complication that is on-premises storage held across storage appliances that may or not have been made with backup in mind. But there’s still plenty of room for the likes of Veeam, CommVault and their ilk to point out how they can add value and nuance. ®

Sponsored:
Boost business agility and insight with flash storage for analytics

Floppy disk sales have, well, flopped but there are still masses of PCs and old embedded PC-based systems out there with floppy disk slots and drives. Now this near-dead space can be made usable again, with a 32GB FLOPPYFlash drive from Solid State Disks Ltd.

It’s a drop-in replacement for a floppy disk drive and takes CompactFlash solid state cards instead of floppy disk media. The firmware is field-upgradable via an included USB port.

The device has a 3.5-inch footprint and uses a standard 34 pin floppy disk drive connection, needing a 5V power supply. It also supports 26 pin / 34 pin slim and Shugart floppy connections.

Data transfer rates can be set between 125 Kbits and 500 Kbit/s depending on whether the matching encoding method is FM, MFM or MMFM. The emulated track configuration is programmable.

TCP/IP networking via standard RJ45 Ethernet connection is also supported, allowing FLOPPYFlash to be connected to any existing local area network for remote configuration, control, diagnostics, backup and restore.

FLOPPYFlash drive and CompactFlash media

FLOPPYFlash is also available as a network drive upgrade with IP address set up at the factory. It ships with Solid State Disks’ FLASH2GUI graphical user interface used for control and configuration of the drive as well as backup and restore operations.

FLOPPYFlash network drive GUI

SSD tells us: "The use of solid state technology also delivers greatly increased reliability (MTBF) and media life, improved environmental efficiency with lower power consumption, noise and heat generation, and a reduction in unplanned downtime."

If you still have a PC with a floppy disk drive installed then (1) congratulations, and (2) we’d be surprised if you care much about improved environmental efficiency with lower power consumption, noise and heat generation, although a reduction in downtime and improved media reliability probably do matter a lot.

Setting irony aside, this use of flash drive media in a floppy disk drive bay looks a great little idea. ®

* There have long been rumours that certain launch codes are stored on a floppy….

Sponsored:
Flash storage buyer’s guide

This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.

Most CISOs receive a rude awakening when they encounter their first major security issue in the cloud. If they identify a critical vulnerability that requires a patch, they may not have the authorization to tweak the cloud provider’s pre-packaged stack. And if the customer does not own the network, there may not be a way to access details that are critical to investigating an incident.

In order to avoid a major security issue in the cloud, CISO’s must  have an incident response plan.  Here is how to build one:

1.  Establish a joint response plan with the cloud provider. If you have not yet moved to the cloud, the most practical first step is to establish a joint response process. Responsibilities and roles should be clearly defined, and contact information for primary and secondary contacts should be exchanged. Obtain a detailed explanation of what triggers the provider’s incident response and how the provider will manage different issues.

2.  Evaluate the monitoring controls and security measures that are in place in the cloud.For an effective response on security issues related to cloud infrastructure, it is important to understand what kind of monitoring and security measures are in place by the cloud provider and what access you have to those tools. If you find they are insufficient, look for ways you can deploy a supplemental fix.

3.  Build a recovery plan. Decide whether recovery will be necessary in the event of a provider outage. Create a recovery plan that defines whether to use an alternate provider or internal assets as well as a procedure to collect and move data.

4. Evaluate forensic tools for cloud infrastructure. Find out what tools are available from the cloud provider or from other sources for conducting forensics in case of an incident. If the incident involves PII information, it might turn into a legal and compliance challenge, so having appropriate tools which can help with forensics and evidence tracking is essential.

Handling an incident in the cloud

Many incident response steps are similar whether you are dealing with the cloud or a local installation. However, there are some additional steps you may need to take in the case of a cloud incident:

• Contact your provider’s incident response team immediately, and be aggressive in your communications. If the provider’s team cannot be reached, do everything you can on your end to contain the incident, like controlling connections to cloud service and revoking user access to the cloud service in questions.
• If the incident cannot be controlled or contained, prepare to move to an alternate service or set up an internal server.

• The cloud allows you to delay identification and eradication until the crisis has passed. In most cases, you can proceed immediately to restore production services by instantiating a new instance.

Best practices for incident response in the cloud

One critical issue that many enterprises face is the lack of talent possessing the proper skills to manage security. It is difficult to find the right candidates, and if you locate them, you can expect to have ato pay top salaries. By the end of 2024, the Bureau of Labor Statistics expects information security analyst jobs to grow 18%, and salaries are already averaging well into six figures.

However, there are some steps that you can take to bring new employees up to speed quickly or enhance the skills of existing employees:

• Promote collaboration to help junior analysts benefit from the experience of senior analysts. As a bonus, collaborative efforts may reveal duplicate efforts that can be eliminated.

• Create playbooks that prescribe standard procedures for responding to incidents. Naturally, you cannot create a guide for every potential situation, but playbooks can be valuable guides and excellent training materials. Just remember to keep playbooks updated, which is a task that can often be automated.

• Speaking of automation, many tasks can be automated, especially if they are repetitive and routine. Mundane tasks take up an unjustifiable amount of time. Automation can free your staff members for more important tasks.

• Foster situational awareness from both the historical and real-time points of view. An effective analysis of past incidents can help you make better decisions about current incidents.

• Analyze incidents and create a database to help determine the types of problems encountered, the skills needed to address the issue, the frequency of each type of incident, and other facts. Analysis can help you identify vulnerabilities and determine where to bolster security.

Like most security best practices related to cloud applications, incident response is also a shared responsibility. Planning ahead for incident response is critical to make sure you have the right contacts, tools and processes in place. Having an incident response platform that can enable collaboration for internal and external teams, track incident response processes and automate key security tasks, is essential in the time of crisis to contain issues quickly and respond effectively.

For more information, visit www.Demisto.com.

HDMI Licensing, the administrator of the High-Definition Multimedia Interface (HDMI) spec, has decided that the time has come to do away with dongles and given the thumb’s up to USB-C.

“The HDMI cable will utilize the USB Type-C connector on the source side and any HDMI connector on the display side,” HDMI licensing says. “Unlike the other Alt Mode display technologies which require various adapters or dongles to connect to HDMI displays, HDMI Alt Mode enables an easy connection via a simple USB Type-C to HDMI cable.”

Only one side of this cable can be reversed. So good luck with that

HDMI Licensing says it’s made the decision to hook up with USB-C because gazillions of devices will use it any month now, so it makes sense to give the people what they want and just let their new kit plug straight into tellies and monitors rather than making them pfaff about with dongles.

The new cables will support HDMI 1.4b features such as resolutions up to 4K, Audio Return Channel, 3D, HDMI Ethernet Channel, and Consumer Electronic Control.

All of which is good news for punters and handy for business device-buyers who can now plan on HDMI as a pretty sensible display standard. The news may be less well-received by Intel, which jumped through a lot of hoops to make its own Thunderbolt standard USB-C compatible but kept its own distinctive connector. ®

Sponsored:
Application managers: What’s keeping you up at night?

With Ubuntu 16.04LTS (Xenial Xerus), Canonical has introduced incremental improvements to the popular server and cloud versions of its operating system, but if you were looking for exciting changes to desktop Ubuntu, this version isn’t it.

The 16.04 release is an iterative, not necessarily massive improvement. But this is an Long Term Service (LTS) version, which means that there’s a team working on keeping it solid for five years. So, into the next decade, 16.04 gets patched and fixed, as other versions continue to be released on a regular basis.

In this new release, Ubuntu further strays from the RedHat/SUSE/CentOS/Oracle school of software packaging by officially supporting an important new tool: Snap, a package manager.

Ubuntu is based on Debian, and any Ubuntu/Debian/LinuxMint user has finger memory to use `apt-get’ and `wget’ to obtain and install software. Canonical would rather you source through them, using Snap.

Snap can be used alongside the current Debian-friendly software package updating processes. It’s important to note that in order to install packages wrapped by Snap you’ll need an Ubuntu One account.

+ MORE ON NETWORK WORLD Mark Shuttleworth: ‘Ubuntu keeps GNU/Linux relevant’ +

You might remember when Ubuntu One had personal repository features that were closed, but as a store, Ubuntu One never closed and that’s where Snaps will be examined and downloaded. We tried it and decided that it’s an improvement worth using, if you can tolerate the sense of being tracked.

The second major change is that Ubuntu now allows its installations to use supported ZFS and Ceph filing systems.

Invented by Sun prior to its acquisition by Oracle, ZFS was, at the time, a visionary replacement to a number of journaling filing systems, like Andrews Filing System, NTFS. It was thought to be a potential replacement for the ext3, ext4, and Reiser filing systems.

The idea was to prevent a number of maladies that caused systems failures, like power-interruptions during read/write processes, disk errors, storage cache errors, timing issues, and other disk and storage maladies.

While Apple was rumored to be implementing ZFS, they didn’t, and the FreeBSD community picked up ZFS — the OpenSolaris version — and used the port successfully in many NAS versions. A Linux port of ZFS followed the BSD port, and has been around for a while. The inclusion into Ubuntu gives it a seal of approval.

Cloud considerations

Ceph is a filing system of a different feather. Its first stable release coincides with the release of Ubuntu 16.04. What makes it different is that Ceph is not unlike software-based Reduced Array of Inexpensive Disks (RAID) as a software service and filing system.

Ceph can store files and folders in the traditional desktop way, but Ceph can also store as a block device (e.g. arbitrary or standardized chunks of data) or data as objects — all of which are compatible with cloud computing.

Ceph is a well-known member of various OpenStack cloud deployments, and Canonical’s deployment of OpenStack in turn, becomes a part of their services structure, somewhat rubbing competitively against initiatives by Red Hat.

Canonical also offers Autopilot on its website, an OpenStack control mechanism with a free trial for up to 10 servers and $750 per server per year after that. Conceptually, this allows an analyst or developer to build the control mechanisms on VMware vSphere, using MaaS (Ubuntu’s Metal-as-a-Service server/instance distribution system) with OpenStack software devices/services, such as networking, storage, KVM compute in various configurations.

This system is very simple to test for those familiar with VMware and or Linux Containers (LXC) and gives a flavor for OpenStack control to novices. It was trivial for us to deploy.

Canonical will also build and deploy an OpenStack network via their BootStack service for just $15 per server per month including support.

In a bare metal install, we were able to add Windows Server 2012 R2 Data Center Edition as an OpenStack-managed host, although recipes for this sort of hypervising aren’t easy to find. The proof of concept worked.

What this speaks to is the sheer automation speed of compute, storage, and network build-out — and potentially low cost — of OpenStack managed resources. At this writing, Ubuntu leads in both AWS instances, and also those deployed with OpenStack overall as client instances.

Desktop takes a back seat

Ubuntu’s Unity desktop is the same old stuff, although it’s grown to a 1.49GB download. We found it inconvenient that the long list of download sources are not optimized for speed; we found Tor sources to be the fastest, and the Tor sources checksummed correctly.

The Mir display server underpinnings designed to become a unified replacement for Unity’s XWindows substrate is, well, promised again for 16.10, due perhaps later this year. This apple of a user interface in Canonical’s eye has taken longer to bring to all devices than was originally planned. Although there are many under-the-hood changes, we find none particularly notable.

+ PAST REVIEW: Canonical continues cloud push with Ubuntu 15.04 +

Things that make us growl: The Desktop is missing Mir. It’s also missing initial hard password enforcement. You can still boot to a desktop that’s free and open with no password. There is no install-time SAML authentication or secondary or OAuth provider to immediately proxy users safely to an SSO provider, although there is an http proxy available at installation.

Tablet versions of Ubuntu are rarer to find. BQ, an integrator/OEM of Ubuntu on tablets sells them mainly in the EU market. We were unable to put our hands on one for purposes of this review. The same problem exists for Ubuntu Phone.

Cloud images for download were found in multiple packaging formats for 16.04, if you like i386 and x64 processor families, and most do. These images are ready to download, or can be spun up in numerous clouds.

Server images have a comparatively greater choice of processor families: x86, x86-64, ARM v7, ARM64, POWER8 and IBM s390x (LinuxONE) are available for download.

What does it all mean?

Canonical has taken Ubuntu to a very strong position, and now incrementally adds features that end up sanctioning — through its support — features that others might have not considered to be ready for production use.

ZFS and Ceph are sophisticated filing systems, and they take up more CPU for casual use, and offer broadly sophisticated architectural possibilities, now also joined to OpenStack and Ubuntu’s JuJu advocacy as rapid platform construction tools.

JuJu construction kits are now available for a number of systems platform, ranging from simple WordPress to big/fat data analysis kits. While these don’t necessarily rival Docker container farms, they can almost as easily be used as Docker, rkt, and other management substrates in prototyping.

For now, using AutoPilot and OpenStack is the supported choice, and Canonical takes the nexus of making things work upon themselves, just as Red Hat must make its supported kit work. We expect Ubuntu’s popularity to continue unabated, but there isn’t anything magnificent in the 16.04 release, except continuing breadth with depth.

How We Tested Ubuntu 16.04

We downloaded and used Ubuntu 16.04 x64 cloud, server, and desktop versions, then deployed them mostly as VMs, excepting two tests. We also tested 16.04 on AWS. The cloud versions were used on local hardware using AutoPilot, Juju, and OpenStack in the lab on an HP Microserver Gen8 (i3 chipset, 8GB of memory, 1.5TB of disk, twin Gigabit Ethernet ports) testing Ubuntu and Windows 2012 R2 as VM instances.

We also deployed 16.04 server and desktop on the following platforms in our network operations center: VMware ESXi 5.1, 5.5, and 6.0, as well as Hyper-V 3.1, and XenServer 6.5.0. Additionally, we installed 16.04 desktop and server versions as virtual machines under Parallels for Mac 11.

We noted that little has changed from a deployment context from the last LTS version, 14.04, and scripts for 14.04 work with 16.04 in terms of PxE and Ubuntu’s Metal-as-a-Service — now enhanced by the OpenStack management plane. The versions are interchangeable for one-off install scripts, such as PxE loads.

The NOC is powered by HP Gen8 and Gen9 servers, a Lenovo multi-core server, and a Dell 730xd multicore server, all connected via Extreme Summit Series 10GBE switches to Expedient Data Center’s core network in Indianapolis.

Based on an extensive review of publicly reported internet of things (IoT) device vulnerabilities, the Online Trust Alliance (OTA) today announced that all of the problems could have been easily avoided.

“In this rush to bring connected devices to market, security and privacy is often being overlooked,” Craig Spiezle, executive director and president of the OTA, said in a statement today. “If businesses do not make a systematic change, we risk seeing the weaponization of these devices and an erosion of consumer confidence impacting the IoT industry on a whole due to their security and privacy shortcomings.”

If only they had listened …

The OTA, a nonprofit group comprised of academics and representatives from the public and private sector, is dedicated to developing and advocating best practices and policy concerning security and privacy. Researchers from the OTA recently analyzed publicly reported vulnerabilities for consumer connected home and wearable technology products from November 2015 through July 2016. They found that in each case, if device manufacturers and developers had implemented the security and privacy principles outlined in the OTA IoT Trust Framework, the vulnerabilities would not have occurred.

[ Related: Connected medical device makers need to step up security ]

“Security starts from product development through launch and beyond, but during our observations we found that an alarming number of IoT devices failed to anticipate the need of ongoing product support,” Spiezle said. “Devices with inadequate security patching systems further opens the door to threats impacting the safety of consumers and businesses alike.”

Most glaring security flaws

OTA revealed its findings today at the American Bar Association’s 2016 Business Law Section Annual meeting in Boston.

OTA said the most glaring failures it found were attributed to the following causes:

• Insecure credential management, including making administrative controls open and discoverable
• Not adequately and accurately disclosing consumer data collection and sharing policies and practices
• The omission or lack of rigorous security testing throughout the development process, including but not limited to penetration testing and threat modeling
• The lack of a discoverable process or capability to responsibly report observed vulnerabilities
• Insecure or no network pairing control options (device to device or device to networks)
• Not testing for common code injection exploits
• The lack of transport security and encrypted storage including unencrypted data transmission of personal and sensitive information including but not limited to user ID and passwords
• Lacking a sustainable and supportable plan to address vulnerabilities through the product lifecycle, including the lack of software/firmware update capabilities and/or insecure and untested security patches/updates

“The Online Trust Alliance’s IoT Trust Framework includes valuable principles that companies should embrace to make sure consumer smart home technology is secure, private and sustainable for the future,” Tom Salomone, president of the National Association of Realtors (NAR) and broker-owner of Real Estate II in Coral Springs, Fla., said in a statement today. “Device vulnerabilities need to be understood and addressed in order to protect what is near and dear to anyone using smart and connected device technology in their home.”

[ Related: White-hat hackers key to securing connected cars ]

The OTA’s Trust IoT Framework is a global, multi-stakeholder effort to address IoT risks comprehensively. The OTA began developing the framework in February 2015 based on the feedback of nearly 100 organizations, including ADT, American Greetings, Device Authority, Malwarebytes, Microsoft, NAR, Symantec, consumer and privacy advocates, international testing organizations, academic institutions and U.S. government and law enforcement agencies. The framework includes a baseline of 31 measurable principles that OTA says device manufacturers, developers and policy makers should follow to maximize the security and privacy of the devices and data collected for smart homes and wearable technologies.

This story, “Security an afterthought in connected home, wearable devices” was originally published by

CIO.