Connect with us

Tech

Lloyds admits coding fault exposed customer transactions | Computer Weekly

Published

on

Lloyds admits coding fault exposed customer transactions | Computer Weekly


Lloyds Banking Group’s response to a request from the UK government’s Treasury Committee shows that a programming error was the root cause of a breach that exposed details of more than 114,000 mobile banking customers.

The bank said it has made goodwill payments totalling just over £139,000 to around 3,625 customers as of 23 March. It said it also submitted a formal notification to the Information Commissioner’s Office within 72 hours after the breach, in line with statutory timelines.

As Computer Weekly has previously reported, on the morning of 12 March, a fault in the Lloyds banking app enabled some customers to see the transactions of other customers. Customers of the group’s Halifax, Bank of Scotland and Lloyds Bank apps were affected by the security breach.

While the bank resolved the breach quickly, Meg Hillier, chair of the Treasury Committee, sent an email to Lloyds Banking Group’s group CEO, Charles Nunn, with the subject line “Improper disclosure of individuals’ account information”. In the email, Hillier described the incident as “an alarming breach of data confidentiality.”

The information she requested from the bank’s boss included details of the breach, how many customers were affected, whether customers could be identified and what steps Lloyds Banking Group has taken to encourage those who may have taken copies of data – of which they were not entitled – to delete those copies.

Jasjyot Singh, CEO of consumer relationships at Lloyds Banking Group, has now responded to the Treasury Committee’s questions. Singh stated that the incident was caused by an IT change made overnight between 11 and 12 March which introduced a software defect.

“The defect meant that when a customer requested to view their current account transactions, their transaction data was potentially visible to other customers who were simultaneously – within small fractions of a second – requesting access to their own transactions,” Singh said.

The bank has now established that the defect was in the design of the code used to update the application programming interface (API) used by the app. Singh said the bank is reviewing why this individual defect was not detected by its design, quality assurance and testing processes.

According to Singh, a maximum of 447,936 customers who viewed their transaction list during the affected time period may have been presented with other people’s transactions or may have had some of their transactions presented on another customer’s transaction list. The bank has estimated that 114,182 customers clicked through to view the detail behind individual current account transactions during that time and may have been presented with information about individual payments.

Singh assured the Treasury Committee that the bank’s fraud and cyber monitoring processes has seen no evidence of misuse or malicious activity as a result of the incident. “Based on our assessment of this incident, we have not identified evidence that customers have suffered financial loss, and no customer has reported a financial loss arising from the incident at this stage. Accordingly, we have not made compensation payments on this basis,” he stated in the letter.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

The Backward Logic of Chickenpox Parties

Published

on

The Backward Logic of Chickenpox Parties


Anyone who has had chickenpox shares one distinct memory: the relentless, all-consuming itch.

Ciara DiVita was only 3 years old when she caught the virus, but she remembers it well—along with the oven mitts she was made to wear to stop herself scratching. She also recalls being taken to hang out with her cousin while covered in blisters, in the hopes of deliberately infecting them.

DiVita, now 30, was actually the second in the chain, having been taken by her parents to catch chickenpox from an infectious friend. “I imagine the chain continued and my cousin gave it to someone else at a chickenpox play date,” she says.

A lot has changed over the past three decades, most notably the development of a chickenpox vaccine, meaning the virus is no longer the childhood rite of passage it once was.

Thanks to the vaccine’s success, children today are much less likely to be exposed to the infection at school or on the playground.

Chickenpox parties are also largely considered a relic of the past—a strategy many Gen X and millennial children were subjected to before vaccines became routine. But much like the virus itself—latent, opportunistic—they haven’t disappeared entirely.

Before a vaccine existed, chickenpox, which is caused by the varicella-zoster virus, felt unavoidable. In temperate countries like the UK and the US, around 90 percent of children caught the virus before adolescence (in tropical countries the average age of infection is higher).

It’s nothing to do with chickens. The splotchy, scratchy, highly contagious disease is possibly named after the French word for chickpea, pois chiche, according to one theory, because the round bumps caused by the virus resemble their size and shape. While most infant cases are mild, adolescents and adults are more likely to develop severe complications.

This is where the idea of “getting it over and done with” emerged from, according to Maureen Tierney, associate dean of clinical research and public health at Creighton University in Omaha, Nebraska.

“You were trying to have your child get the disease when they were at the greatest chance of not having complications,” Tierney says, explaining that, generally speaking, the older the patient, the more severe the infection can be.

While varicella-zoster is usually a mild, self-limiting disease in children, it can be much more severe—and sometimes life-threatening—in adults.

“I had an otherwise healthy adult patient who died of chickenpox pneumonia when I was first practicing,” Tierney says. “You never forget those scenarios.”

The virus spreads rapidly through respiratory droplets and contact with fluid from its characteristic blisters, meaning if one child contracts it, siblings and classmates are likely to be next, if unvaccinated.

Before the existence of social media, the idea that children should deliberately infect each other spread just as rapidly around communities—in conversations in the school yard, church groups, and pediatric waiting rooms—leading to the popularity of so-called chickenpox parties.

Parents swapped advice about oatmeal baths and calamine lotion and arranged to bring children together when one was thought to be infectious—despite the practice never being an official medical recommendation.

“They thought, well, if it’s going to happen to my kid anyway, it might as well happen in a controlled environment,” says Monica Abdelnour, a pediatric infectious disease specialist at Phoenix Children’s Hospital. “The families were ready to encounter this infection, deal with it, and then move on.”

While the majority of children who develop chickenpox feel well again within a week or two, around three in every 1,000 infected experience a severe complication such as pneumonia, serious bacterial skin infections, encephalitis (inflammation of the brain), or meningitis.



Source link

Continue Reading

Tech

A Danish Couple’s Maverick African Research Finds Its Moment in RFK Jr.’s Vaccine Policy

Published

on

A Danish Couple’s Maverick African Research Finds Its Moment in RFK Jr.’s Vaccine Policy


In 1996, Guinea-Bissau seemed like an ideal research post for budding pediatrician Lone Graff Stensballe. Her supervisor, a fellow Dane named Peter Aaby, had spent nearly two decades collecting data on 100,000 people living in the mud brick homes of the West African country’s capital.

Aaby and his partner, Christine Stabell Benn, believed that the years of research in the impoverished country had yielded a major discovery about vaccines—and what they described as “non-specific effects”: The measles and tuberculosis vaccines, which were derived from live, weakened viruses and bacteria, they said, boosted child survival beyond protecting against those particular pathogens.

But, the scientists said, shots made from deactivated whole germs, or pieces of them, such as the diphtheria-tetanus-pertussis (DTP) shot, caused more deaths—especially in little girls—than getting no vaccine at all.

The World Health Organization repeatedly and inconclusively examined these astonishing findings. They tended to elicit shrugs from other global health researchers, who found Aaby’s research techniques unusual and his results generally impossible to replicate.

Then came Donald Trump, Covid, and the administrative reign of anti-vaccine advocate Robert F. Kennedy Jr.

Suddenly, Aaby and Benn weren’t just sending up distant smoke signals from a far corner of the planet. They were confidently voicing their views and policy prescriptions online and in medical journals. The “framework” for “testing, approving, and regulating vaccines needs to be updated to accommodate non-specific effects,” their team wrote in a 2023 review.

And the Trump administration has taken notice.

“They became more strident in saying that their findings were real and that the world needed to do something about it,” said Kathryn Edwards, a Vanderbilt University vaccinologist who has been aware of Aaby’s work since the 1990s. “And they became more aligned with RFK.”

Kennedy, as secretary of the Department of Health and Human Services, cited one of Aaby’s papers to justify slashing $2.6 billion in US support for Gavi, a global alliance of vaccination initiatives. The cut could result in 1.2 million preventable deaths over five years in the world’s poorest countries, the nonprofit agency has estimated. Kennedy has frozen $600 million in current Gavi funding over largely debunked vaccine safety claims.

Kennedy described the 2017 paper as a “landmark study” by “five highly regarded mainstream vaccine experts” that found that girls who received a diphtheria-tetanus-pertussis, or DTP, shot were 10 times more likely to die from all causes than unvaccinated children.

In fact, the study was far too small to confidently make such assertions, as Benn acknowledged. In a study of historical data that included 535 girls, four of those vaccinated against DTP in a three-month period of infancy died of unrelated causes, while one unvaccinated girl died during that period. A follow-up published by the same group in 2022 found that the DTP shot by itself had no effect on mortality. Critics say the 2017 study, rather than being a landmark, exemplified the troubling shortfalls they perceive in the Danish team’s research.

As Aaby and Benn’s US profile has risen, scientists in Denmark have set upon the work of their compatriots. In news and journal articles published over the past 18 months, Danish statisticians and infectious disease experts have said the duo’s methods were unorthodox, even shoddy, and were structured to support preconceived views. A national scientific board is investigating their work.

Stensballe, who worked with Aaby and Benn for 20 years, has been among those voicing doubts.

“It took years to see what I see clearly today, that there is a strange concerning pattern in their work,” Stensballe said in a phone interview from Copenhagen, where she treats children at Rigshospitalet, the city’s largest teaching hospital. She said their work is full of confirmation bias—favoring interpretations that fit their hypotheses.



Source link

Continue Reading

Tech

Gartner: How AI will transform managed network services | Computer Weekly

Published

on

Gartner: How AI will transform managed network services | Computer Weekly


In 2024, nearly all the service providers Gartner profiled in its Magic Quadrant for global WAN services report and the Magic Quadrant for managed network services report said they had started leveraging artificial intelligence (AI) in several ways to support the operation of enterprise networks. Areas of usage include AI for IT operations (AIOps), generative AI (GenAI) as a network assistant, enhanced service delivery, and AI in secure access service edge (SASE) and network security.

AIOps has emerged as a foundational capability in managed networking. Leading service providers, such as HCLTech, Microland and NTT Data, have begun to integrate AIOps capabilities and network automation for service onboarding and customer experience improvements. Also, service providers are deploying AI and/or machine learning (ML) to monitor network health, detect anomalies and automate routine tasks in network operations centres (NOCs).

The goal is to shift from reactive troubleshooting to proactive assurance. For example, if latency on a wide-area network (WAN) link starts spiking intermittently, a machine learning model might recognise the pattern as a precursor to link failure and alert engineers or trigger failover before a major outage occurs.

One such service provider is Tata Communications, which has invested in AI-based fault diagnosis using AI/ML for 85% accuracy, while AI-driven telemetry predicts and addresses issues for proactive network monitoring.

Also, many network equipment suppliers now embed AI features to support service providers for network monitoring.

GenAI as a network assistant

Over the past year, Gartner has seen a great deal of interest from managed network service (MNS) providers in applying GenAI to IT operations, including network management. The vision is to provide a network AI assistant that can interact with the provider’s operations teams via a natural language chat interface, help troubleshoot issues, document networks and even implement changes by generating configurations from intent.

One example is HCLTech, which is focusing on leveraging GenAI integrations with software-defined wide-area networking (SD-WAN) to deliver complete automation for lifecycle operations. It is building a supplier-focused GenAI large language model (LLM) as part of its service delivery platform (SDP).

Enhanced service delivery

AI is also leveraged in customer-facing aspects of MNS. Service providers are increasingly using AI to improve support and transparency for clients. This includes AI-powered customer service bots, service portals, and AI-generated reports or insights.

For example, many MNS providers profiled in the Gartner Magic Quadrant for managed network services report use bots, which are increasingly enhanced with AI capabilities, to automate repetitive tasks. Some have thousands of bots as part of their network automation codebases.

AI in SASE and network security

AI and ML are proving just as critical in the security side of MNS as they are in performance management. In fact, many service providers (for example, XTIUM and Microland) pitch AI-powered enhancements of their network security offerings, where the platform uses advanced analytics, AI and GenAI to strengthen and simplify management of local area network (LAN), WAN and cloud security.

For SASE and network security, AI can be used for automated anomaly detection. Here, the system quarantines a suspicious device or triggers multifactor authentication for a user behaving abnormally.

In policy optimisation, AI can recommend tightening or adjusting security policies, based on observed usage. For example, it can suggest zero-trust rules for an application, based on the context – location, time, company departments and so on.

Some advanced service providers, such as HCLTech, are exploring LLMs to assist security analysts – for example, summarising multistep attacks, or even writing firewall rules based on high-level descriptions of a threat.

Also, many SASE platform suppliers emphasise their AI/ML capabilities. For example, Versa Networks touts AI/ML-powered unified SASE that blends SD-WAN and cloud security, using ML to continuously adapt to network conditions and security threats. Similarly, Cato Networks highlights that it leverages AI/ML across its cloud-native SASE service to provide “reliable, accurate network security”, applying advanced data science to threat prevention and smart traffic management.

AI in MNS in 2028 and beyond

The integration of AI in MNS will increasingly enhance operational efficiency and enable more informed decision-making, ensuring that networks are robust and agile enough to adapt to changing demands and traffic patterns. Looking ahead three to five years from now, significant transformation in MNS is expected due to extensive use of AI – traditional, generative and agentic – and automation.

Widespread NOC assistants

The current rapid pace of development suggests that, by 2028, GenAI will have become a mature, trusted assistant in network operations. The experimental and nascent deployments of 2023 to 2024 will give way to robust network AI assistants embedded in MNS workflows.

These assistants will interface through natural language (text or voice) and be integrated with monitoring and ticketing systems. They will be able to answer complex queries about the network, draft change plans, and summarise incidents and problems.

Essentially, if 2023 was the introductory year for network AI assistants (see What is a network AI assistant?), by 2028, they will become a standard capability for NOCs to boost productivity.

The models behind the AI assistants are expected to be more specialised in network engineering and fine-tuned with each provider’s historical data, making them more accurate and context-aware than current tools are.

The best providers will leverage proprietary models – or at least proprietary fine-tuning – that become part of their intellectual property. For example, a provider can use a model trained on years of network event management data, which is exceptionally good at diagnosing telecoms network issues or in network security design efficacy. This will be a differentiator versus others that are using off-the-shelf network AI assistants.

By 2028, agentic AI will likely manifest as automated “Tier 0” responders in NOCs. These are AI agents capable of perceiving network incidents, understanding intent, making autonomous decisions, and executing actions for handling specific tasks and incident types end-to-end without human intervention.

By 2028, it is likely that many service providers will have enabled fully automated remediation for known issues. For example, if a branch SD-WAN router goes offline, the AI agent can perceive the incident, decide on a sequence of fixes – restart a virtual instance, fail over to backup, and so on – and execute them. It will alert a human only if those fail.

Another example could be the detection of a known bug, such as a memory leak in a firewall causing a slowdown. The AI agent, after perceiving the issue, will decide on a temporary configuration workaround or initiate a software patch, and execute these actions.

This goes beyond today’s static scripts by adding autonomous decision-making and action. The agent can verify if the issue truly matches a known pattern, using machine learning, and check if conditions are safe to execute the fix now, using policy – for example, it will reboot after business hours only if it is critical.

Fully autonomous networks will likely remain out of reach until well after 2028. But we expect that, by 2028, such self-healing actions will be accepted for narrow scopes, as service providers will have gained trust in AI for these repetitive tasks, thanks to long training and previous successful outcomes.

Nevertheless, the complexity of coordinating across domains means humans will still handle high-level decision-making. But for routine faults and performance tweaks, automated agents could become the norm, improving service reliability.


This article is based on an excerpt of Gartner’s AI will transform managed network services in the next three years report, by Gartner senior director analyst Gaspar Valdivia.



Source link

Continue Reading

Trending