Red Hat has announced it’ll acquire container and Kubernetes-native security provider StackRox in a bid to boost the security of its OpenShift Kubernetes platform. 

StackRox offers native security solutions to Kubernetes containers by directly deploying components for enforcement and deep data collection into the Kubernetes cluster infrastructure. The StackRox policy engine includes hundreds of built-in controls to enforce security best practices; industry standards, such as CIS Benchmarks and NIST; configuration management of containers and Kubernetes; and runtime security. 

Red Hat said the purchase would help it focus on securing cloud-native workloads by expanding and refining Kubernetes’ native controls and shifting security left into the container build and CI/CD phase. This will help provide a cohesive solution for enhanced security up and down the entire IT stack and throughout the lifecycle.

«Securing Kubernetes workloads and infrastructure cannot be done in a piecemeal manner; security must be an integrated part of every deployment, not an afterthought,» said Red Hat CEO Paul Cormier. 

«Red Hat adds StackRox’s Kubernetes-native capabilities to OpenShift’s layered security approach, furthering our mission to bring product-ready open innovation to every organization across the open hybrid cloud across IT footprints.»

Red Hat said it plans to open source StackRox’s technology post-acquisition. It’ll also continue to support the KubeLinter community and new communities as Red Hat works to open source StackRox’s offerings.

In addition to Red Hat OpenShift, StackRox will continue supporting multiple Kubernetes platforms, including Amazon Elastic Kubernetes Service (EKS), Microsoft Azure Kubernetes Service (AKS), and Google Kubernetes Engine (GKE).

In a company blog post announcing the acquisition, StackRox CEO Kamal Shah said his company made a strategic decision to focus exclusively on Kubernetes and pivoted its entire product to be Kubernetes-native.

“Over two and a half years ago, we made a strategic decision to focus exclusively on Kubernetes and pivoted our entire product to be Kubernetes-native. While this seems obvious today; it wasn’t so then. Fast forward to 2020 and Kubernetes has emerged as the de facto operating system for cloud-native applications and hybrid cloud environments,” Shah said.

IBM has appointed its former chief financial officer, Martin Schroeter, as the boss of its newly separated infrastructure business.

Schroeter will be initially tasked with oversing the formation of the ‘NewCo’ unit, following the company’s decision to spin off its managed infrastructure services business in October.

Following the appointment of Arvind Krishna, and 2019’s Red Hat acquisition, IBM will now focus its attention on the cloud market, with its new business, which has still yet to be named, focusing on the management and modernisation of global IT infrastructure.

«Martin is a world-class leader and is uniquely qualified to drive the long-term success of the new, independent company,» said Krishna. «Martin has the strategic vision and business judgement to realise NewCo’s enormous potential as the global leader in managed infrastructure services. He is an inspiring, results-driven executive and the right CEO to lead NewCo through the spin-off process and beyond.»

IBM have a history of promoting executives from within. Like Krishna, and his predecessor Ginni Rometty, the role of CEO has often gone to company veterans that have held a number of positions over a period of decades.

Schroeter, who joined in 1992, is returning to the company having left in June 2020. Before his departure, he held a number of executive roles in sales and marketing, most notably CFO of the company.

Dell has launched a new lineup of monitors that puts Microsoft Teams at the forefront as the company looks to capitalise on businesses’ continued reliance on video conferencing.

With the Dell 24, 27, and 34 Video Conferencing Monitors, the company claims it has created the “world’s first video conferencing monitors certified for Microsoft Teams».

​

This comes after Microsoft started certifying displays, webcams, and headsets last year in a bid to ensure a range of devices could be offered to both consumers and business that required no additional configuration to interact with Microsoft Teams and Skype for Business.

The monitors’ dedicated Microsoft Teams button will let users quickly launch the app to make and receive video calls, while the onboard 5MP infrared camera, noise-cancelling microphone and dual 5-watt integrated speakers promise to deliver high-quality video calls.

The Dell 24, 37, and 34 Video Conferencing Monitors, with the numbers reflecting the size of each monitor in inches, will launch in the US on 16 February, priced at $519.99, £719.99 and $1,149.99. UK availability details have not yet been announced.

Dell has also updated its business laptop lineup ahead of next week’s all-digital CES conference. The new Dell Latitude 9420 and 9520 add Intel’s 11th Gen vPro chips, optional 5G support, and a new automated webcam shutter to physically shut off the camera when not in use.

The «SafeShutter», which Dell claims is an «industry-first», can open and close automatically when the webcam is in use, but the laptops also feature dedicated “mute” keys to manually disable the microphone or camera as needed.

The 14-inch Dell Latitude 9420 will be available this month, while availability details for the 15.6-inch Latitude 9520 have not yet been announced.

Dell has also unveiled the Latitude 7520 with a 15-inch 4K UHD display and an optional full high-definition camera, and has updated its Latitude 5000 series and Precision 3560 PCs with new bioplastic designs that the company claims will help it to achieve its moonshot goal to have half of its products’ content be made of recycled materials by 2030.

​

Starting April 1, Microsoft plans to update its service level agreement (SLA) for Azure AD user authentication to 99.99%. Hitting this four-nine uptime will be an improvement over the current 99.9% SLA.

A multi-tenant identity management service, Azure AD processes tens of billions of authentications per day. To deliver on its ‘99.99% uptime’ promise, Microsoft aims to drop service credit for administrative features and include only vital user authentication and federation features under Azure AD’s new SLA. 

Any period of time when users can’t log in to the service, access applications on the Access Panel and reset passwords, accounts to service downtime. Furthermore, organisations can avail service credits if Azure AD’s uptime drops below the SLA. For instance, Microsoft offers a full-service credit when uptime falls below 95% per month.

Microsoft attributed the enhanced SLA to its ongoing program of resilience investment to improve reliability in all areas of its identity services. 

To increase the reliability of its Azure AD, Microsoft centralised architecture to scope and isolated the impact of failures to a minimum number of users; included a backup authentication service that transparently and automatically handles authentications for participating workloads; integrated Azure infrastructure authentication with regional authentication endpoints; and provided instant enforcement of policy changes with continuous access evaluation (CAE) protocol for critical Microsoft 365 services. 

“In conversations with our customers, we learned that the most critical promise of our service is ensuring that every user can sign in to the apps and services they need without interruption,’’ said Nadim Abdo, vice president of engineering at Microsoft.

“To deliver on this promise, we are updating the definition of Azure AD SLA availability to include only user authentication and federation (and removing administrative features). This focus on critical user authentication scenarios aligns our engineering investments with the vital functions that must stay healthy for customers’ businesses to run.”

The Emotet Trojan was used to target over 100,000 users per day over December, placing it at the top of a list of the most dangerous malware threats facing businesses today.

That’s according to a new global index from security research firm Check Point, which revealed the malware has impacted 7% of organisations around the world during the last month of 2020, closely followed by banking trojan Trickbot and information-stealing virus Formbook, both impacting 4% of global companies.

All three viruses made a return to the index for December, although the sudden uptake of Emotet should be a cause for concern among businesses, Check Point has warned. It was originally developed as a banking malware, sneaking onto a target’s computer to steal sensitive information, but it has since evolved into one of the most costly and destructive malware variants available, according to Maya Horowitz, director of threat intelligence and research products at Check Point.

«It’s imperative that organisations are aware of the threat Emotet poses and that they have robust security systems in place to prevent a significant breach of their data,» said Horowitz.

Emotet was at the top of the Global Threat Index in September and October, and is best known as being a tool for opening access to infected computers for further ransomware operations. It is also thought to have been used by the criminal group known as Ryuk, said to be responsible for a number of attacks on healthcare facilities throughout the autumn.

Researchers believe that a brief lull in activity during November was the moment the Emotet malware was updated with new payloads and improved detection capabilities. The Check Point team believes the malware is now far more dangerous as a result.

The same is true for Hiddad, an Android malware variant which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the operating system.

The most exploited vulnerability of the month was the MVPower DVR Remote Code Execution flaw, which affected 42% of organisations around the world during the month.

Amazon Web Services can no longer use the abbreviation ‘AWS’ as a logo in China after a Beijing court ruled in favour of a local software company.  

ActionSoft Science & Technology Development (AWS in China) have the rights to the trademark, according to a court verdict published 30 December, The Wall Street Journal reports. 

The verdict, made in May last year but only released in December, has decreed that Amazon can no longer use the term ‘AWS’ or any similar logos in China. The tech giant has also been ordered to pay compensation of 76.5 million Yuan (£812.5 million) to ActionSoft. 

Amazon still had ‘AWS’ on its Chinese cloud services website as of Tuesday, according to the WSJ. However, a disclaimer at the bottom of the page notes that ‘AWS’ is used as an abbreviation and «is not displayed herein as a trademark».

In a statement, Amazon said it invented cloud services and made them popular around the world under the AWS name long before «any other company».

«Amazon was the first to use the AWS logo in China to sell cloud services by many years,» a spokesperson for the company said. «We strongly disagree with the court’s ruling and have appealed the case to the Supreme People’s Court.»

However, this is disputed by the court ruling which cites China’s official trademark database. It states that ActionSoft registered ‘AWS’ for cloud computing services in 2004, while Amazon only did so in China in 2012. 

Despite being the biggest cloud provider in the world, Amazon is only the fifth largest in China, far behind the likes of Alibaba and Tencent, with a market share of only 7.2%.

Trademark disputes between US and Chinese companies are quite common; Apple settled an iPad dispute in 2012 that allowed it to continue selling the tablet in China, while Facebook, Starbucks and even basketball legend Michael Jordan have battled with Chinese firms over naming rights.

The majority of IT leaders in the US and UK don’t believe their company’s infrastructure is fit for the future, according to a survey by IBM. 

The company’s ‘The State of IT Transformation’ study found that 60% of CIOs and CTOs in America and the UK felt their company’s modernisation programme wasn’t ready yet. 

The survey questioned 380 IT decision-makers, with almost a quarter (24%) admitting that their company had only just started its migration programmes. 

CIOs and CTOs around the world have been under significant pressure to maintain or modernise their IT systems amid the coronavirus outbreak. Cloud migrations have been at the forefront of most business plans throughout the pandemic and this has ramped up demand for skilled professionals and greater security controls. 

60% of respondents suggested they expected this increased demand for cloud infrastructure to be permanent, and nearly all (95%) said they were looking for public, hybrid or private cloud strategies. Most of those also said they were doing so ‘aggressively’, according to IBM. 

However, the study highlighted a stark difference in attitude between IT leaders in the US and the UK. Approximately 56% of American respondents said they were ‘aggressively’ moving their IT infrastructure to hybrid cloud models, while British respondents appeared to be less active in the market, with only 38% describing their approach as ‘aggressive’. 

There were also contrasting answers when it came to changes brought about by COVID-19. Around 56% of US CIOs and CTOs said their infrastructures were ‘completely prepared’ for the challenges of lockdowns and remote working, but only 23% of those based in the UK could say the same.

A shortage of skilled workers seems to be a large part of the issue, with 40% of the respondents revealing that they didn’t feel their teams had the right skillsets to meet their company’s IT ambitions. As a result, more than 75% said they will be relying more on trusted partners to provide managed infrastructure services.

Around 67% of CIOs and CTOs also cited a need for increased ‘infrastructure flexibility’ in the digital transformation plans. This was followed by the need for a competitive advantage (61%), meeting client demands (45%) and general cost savings (58%). 

Adobe has officially killed off Flash Player, the browser plugin that helped define the early internet.

The iconic plug-in was discontinued on 1 January, almost 25 years after it was first launched. Adobe will not be rolling out any further security updates and the company is set to block all Flash content from 12 January.

Despite the sunset date being scheduled for 2020, the majority of browsers had already jumped ship. As of 2018, less than 5% of worldwide websites used Flash, with most favouring Javascript for running multimedia features. Other, more secure alternatives also included HTML5, WebAssembly and WebGL.

The decision to sunset the plug-in was first announced in July 2017 due to dwindling demand, as browser makers opted to integrate the software’s capabilities within their own offerings.

Flash was also plagued by various security concerns. In 2015, for example, security firm Recorded Future discovered that Flash Player comprised eight out of 10 top vulnerabilities leveraged by exploit kits, with more than 100 exploit kits and vulnerabilities affecting the technology. There were also reports of Flash being exploited by North Korean hackers, who used it to access Microsoft Office documents, web pages, and spam emails.

Nevertheless, Flash Player managed to write itself into internet history. The software’s unprecedented capabilities shaped the way users interact with multimedia content offered by an array of industries, such as gaming, education, and video.

The final nail in the coffin for Flash came in October 2020, when Microsoft rolled out an optional update for Windows 10 that permanently removed Adobe Flash from the operating system and prevented it from being re-installed. The company released the removal tool prior to 1 January 2021 in order to help customers test and validate their environments for any impact that might occur by the removal of the software.

Starting later in 2021, all APIs, group policies and user interfaces that govern the behaviour of Adobe Flash Player are expected to be removed from the legacy Microsoft Edge and Internet Explorer 11. 

US web infrastructure firm Cloudflare has devised its own tool that lets web developers build and host websites.

Taking advantage of the company’s global infrastructure network, Cloudflare Pages is a hosting service that supports platforms built directly on the edge using the JAMstack architecture.

The firm has described this as “the next breakthrough in the web performance battle” due to the way it takes advantage of edge computing, with Cloudflare claiming performance will be almost twice as fast as other platforms.

Beyond this, Cloudflare also suggests its Pages service will be secure and scalable, saving developers time on integrated disparate systems, as well as benefitting from seamless GitHub integration to ease the development process.

“From day one Cloudflare was built to service developers. Over the last ten years, millions of developers have counted on us for our network performance and security services,” said Matthew Prince, Cloudflare CEO and co-founder. “With Cloudflare Pages, we’re now providing them with a scalable, fast, secure, cost-effective platform to build next-generation applications that they can deploy globally. 

“Internally, we believe it’s only a matter of time before an individual developer builds a billion-dollar company on their own. We hope Cloudflare Pages will provide the building blocks to help make our belief a reality.”

Its scalability can be attributed to the fact it’s built on Cloudflare’s global network of more than 200 cities, the company added, while running on the edge means Pages will be within 100 milliseconds of 99% of the internet-connected population.

The firm is also hoping to soon integrate Cloudflare Pages with its Cloudflare Workers serverless development platform, so users can integrate third-party APIs into their own platforms. This will allow frontend developers versed in JavaScript to build scalable backends to their applications in the same language.

The security of the platform, meanwhile, is being assured with free SSL as standard, alongside the firm’s Web Application Firewall (WAF). The company will also provide support for the latest web standards with HTTP/3, the QUIC transport layer network protocol, and image compression.