Cloud Computing Köln - Seite 1823 von 7141 - Neues zu Cloud Computing, Internet of Things und Technologien

Enterprises and hobbyists alike have been using Azure Computer Vision’s Image Analysis API to garner various insights from their images. These insights help power scenarios such as digital asset management, search engine optimization (SEO), image content moderation, and alt text for accessibility among others.

Newly improved features including read (OCR)

We are thrilled to announce the preview release of Computer Vision Image Analysis 4.0 which combines existing and new visual features such as read optical character recognition (OCR), captioning, image classification and tagging, object detection, people detection, and smart cropping into one API. One call is all it takes to run all these features on an image.

The OCR feature integrates more deeply with the Computer Vision service and includes performance improvements that are optimized for image scenarios that make OCR easy to use for user interfaces and near real-time experiences. Read now supports 164 languages including Cyrillic, Arabic, and Hindi.

Tested at scale and ready for deployment

Microsoft’s own products from PowerPoint, Designer, Word, Outlook, Edge, and LinkedIn are using Vision APIs to power design suggestions, alt text for accessibility, SEO, document processing, and content moderation.

You can get started with the preview by trying out the visual features with your images on Vision Studio. Upgrading from a previous version of the Computer Vision Image Analysis API to V4.0 is simple with these instructions.

We will continue to release breakthrough vision AI through this new API over the coming months, including capabilities powered by the Florence foundation model featured in this year’s premiere computer vision conference keynote at CVPR.

Additional Computer Vision services

Spatial Analysis is also in preview. You can use the spatial analysis feature to create apps that can count people in a room, understand dwell times in front of a retail display, and determine wait times in lines. Build solutions that enable occupancy management and social distancing, optimize in-store and office layouts, and accelerate the checkout process. By processing video streams from physical spaces, you're able to learn how people use them and maximize the space's value to your organization.

The Azure Face service provides AI algorithms that detect, recognize, and analyze human faces in images. Facial recognition software is important in many different scenarios, such as identity verification, touchless access control, and face blurring for privacy. Face service access is limited based on eligibility and usage criteria in order to support our Responsible AI principles. Face service is only available to Microsoft managed customers and partners. Use the Face Recognition intake form to apply for access. For more information, see the Face limited access page.

Computer Vision and Responsible AI

We are excited to see how our customers use Computer Vision’s Image Analysis API with these new and updated features. Our technology advancements are also guided by Microsoft’s Responsible AI process, and our principles of fairness, inclusiveness, reliability and safety, transparency, privacy and security, and accountability. We put these ethical standards into practice through the Office of Responsible AI (ORA)—which sets our rules and governance processes, the AI Ethics and Effects in Engineering and Research (Aether) Committee—which advises our leadership on the challenges and opportunities presented by AI innovations, and Responsible AI Strategy in Engineering (RAISE)—a team that enables the implementation of Microsoft Responsible AI rules across engineering groups.

Get started

Start improving how you analyze images with Image Analysis 4.0 with a unified API endpoint and a new OCR Model.

Computer Vision documentation.
Image Analysis documentation.
Quick Start for Image Analysis.
Vision Studio for demoing product solutions.

Quelle: Azure

26. Oktober 2022

da Agency

Resolve Vulnerabilities Sooner With Contextual Data

OpenSSL 3.0.7 and “Text4Shell” might be the most recent critical vulnerabilities to plague your development team, but they won’t be the last. In 2021, critical vulnerabilities reached a record high. Attackers are even reusing their work, with over 50% of zero-day attacks this year being variants of previously-patched vulnerabilities.

With each new security vulnerability, we’re forced to re-examine our current systems and processes. If you’re impacted by OpenSSL or Text4Shell (aka CVE-2022-42889), you’ve probably asked yourself, “Are we using Apache Commons Text (and where)?” or “Is it a vulnerable version?” — and similar questions. And if you’re packaging applications into container images and running those on cloud infrastructure, then a breakdown by image, deployment environment, and impacted Commons-Text version would be extremely useful.

Developers need contextual data to help cut through the noise and answer these questions, but gathering information takes time and significantly impacts productivity. An entire day is derailed if developers must context switch and spend countless hours researching, triaging, and fixing these issues. So, how do we stop these disruptions and surface crucial data in a more accessible way for developers?

Start with continuously examining images

Bugs, misconfigurations, and vulnerabilities don’t stop once an image is pushed to production, and neither should development. Improving images is a continuous effort that requires a constant flow of information before, during, and after development.

Before images are used, teams spend a significant amount of time vetting and selecting them. That same amount of effort needs to be put into continuously inspecting those same images. Otherwise, you’ll find yourself in a reactive cycle of unnecessary rework, wasted time, and overall developer frustration.

That’s where contextual data comes in. Contextual data ties directly to the situation around it to give developers a broader understanding. As an example, contextual data for vulnerabilities gives you clear and precise insights to understand what the vulnerability is, how urgent it is, and its specific impact on the developer and the application architecture — whether local, staging, or production.

Contextual data reduces noise and helps the developer know the what and the where so they can prioritize making the correct changes in the most efficient way. What does contextual data look like? It can be…

A comparison of detected vulnerabilities between images built from a PR branch with the image version currently running in productionA comparison between images that use the same custom base imageAn alert sent into a Slack channel that’s connected to a GitHub repository when a new critical or high CVE is detected in an image currently running in productionAn alert or pull request to update to a newer version of your base image to remediate a certain CVE

Contextual data makes it faster for developers to locate and remediate the vulnerabilities in their application.

Use Docker to surface contextual data

Contextual data is about providing more information that’s relevant to developers in their daily tasks. How does it work?

Docker can index and analyze public and private images within your registries to provide insights about the quality of your images. For example, you can get open source package updates, receive alerts about new vulnerabilities as security researchers discover them, send updates to refresh outdated base images, and be informed about accidentally embedded secrets like access tokens.

The screenshot below shows what appears to be a very common list of vulnerabilities on a select Docker image. But there’s a lot more data on this page that correlates to the image:

The page breaks the vulnerabilities up by layers and base images making it easy to assess where to apply a fix for a detected vulnerability.Image refs in the right column highlight that this version of the image is currently running in production.We also see that this image represents the current head commit in the corresponding Git repository and we can see which Dockerfile it was built from.The current and potential other base images are listed for comparison.

An image report with a list of common CVEs — including Text4Shell

Using Slack, notifications are sent to the channels your team already uses. Below shows an alert sent into a Slack channel that’s configured to show activity for a selected set of Git repositories. Besides activity like commits, CI builds, and deployments, you can see the Text4Shell alert providing very concise and actionable information to developers collaborating in this channel:

Slack update on the critical Text4Shell vulnerability

You can also get suggestions to remediate certain categories of vulnerabilities and raise pull requests to update vulnerable packages like those in the following screenshot:

Remediating the Text4Shell CVE via a PR and comparing to main branch

Find out more about this type of information for public images like Docker Official Images or Docker Verified Publisher images using our Image Vulnerability Database.

Vulnerability remediation is just the beginning

Contextual data is essential for faster resolution of vulnerabilities, but it’s more than that. With the right data at the right time, developers are able to work faster and spend their time innovating instead of drowning in security tickets.

Imagine you could assess your production images today to find out where you’re potentially going to be vulnerable. Your teams could have days or weeks to prepare to remediate the next critical vulnerability, like the OpenSSL forthcoming notification on a new critical CVE next Tuesday, November 1st 2022.

Searching for Debian OpenSSL on dso.docker.com

Interested in getting these types of insights and learning more about providing contextual data for happier, more productive devs? Sign up for our Early Access Program to harness these tools and provide invaluable feedback to help us improve our product!
Quelle: https://blog.docker.com/feed/

26. Oktober 2022

da Agency

Cloud makes it better: What's new and next for data security

Today’s digital economy offers a wealth of opportunities, but those opportunities come with growing risks. It has become increasingly important to manage the risks posed by the intersection of digital resilience and today’s risk landscape. Organizations around the world should be asking themselves: If a risk becomes a material threat, how can we help our employees continue to get work done efficiently and securely despite unexpected disruption, no matter where they are? This new era of “anywhere work” is not only a technology issue, but one that encompasses leadership support and cultural shifts. In a recent webinar, Heidi Shey, principal analyst at Forrester, and Anton Chuvakin, senior staff, Office of the CISO at Google Cloud, had a spirited discussion about the future of data security. They agreed that this is a moment of inflection, when smart organizations are rethinking their entire security approach and using the opportunity to take a closer look at their security technology stack at the same time. Here are some trends that they are seeing today.Greater volume, more variety. The data that organizations generate is not only increasing in volume, but in variety as well. Sensitive information can exist anywhere, including employee communications, messaging applications, and virtual meetings, making traditional techniques for classifying data such as manual tagging less effective. Organizations need to grow their risk intelligence by using artificial intelligence (AI) and machine learning (ML) to better identify and protect sensitive information. At the same time, employees are accessing enterprise data in multiple ways, on multiple devices, wreaking havoc on traditional security perimeters and anomaly detection. A more strategic approach. Multiplying threat vectors and vulnerabilities often drive organizations into a losing game of whack-a-mole as they acquire more and more point solutions, which leads to information silos and visibility gaps. While security modernization doesn’t require a rip-and-replace, its success depends on a more strategic approach to choosing and applying controls. Successful organizations are being deliberate in creating an ecosystem of controls that interoperate and reduce data silos and visibility gaps. Zero Trust. Central to any modern security strategy should be a Zero Trust approach to user and network access, not only for people but also for the growing number of internet-of-things (IoT) devices that exchange enterprise data. Zero Trust means that organizations no longer implicitly trust any user or device inside or outside the corporate perimeters — nor should they. Rather, a company must verify that attempts to connect to a network or application are authorized before granting access. Zero Trust replaces the perimeter security model between a trusted internal network and an untrusted external network – including virtual private networks (VPNs) used to access corporate data remotely. Unlike a traditional perimeter model in which a network could become compromised if a hacker breached the organization or if a malicious insider attempts to steal a company’s sensitive data, a Zero Trust approach helps ensure users only have access to the specific resources they need at a point in time.Growing supply chain networks. As organizations expand their supply chains to increase resilience and efficiency, they need a way for vendors, customers, and other third parties to securely access the data and applications necessary to conduct business. A Zero Trust approach to access can provide a scalable solution to meet this need. Enterprise security solutions with the speed, intelligence, and scale of GoogleCybersecurity is ever-evolving as new threats arise daily. Google Cloud’s approach takes advantage of Google’s experience securing more than 5 billion devices and keeping more people safe online than any other organization. Google Cloud brings our pioneering approaches to cloud-first security to enterprises everywhere they operate, leveraging the unmatched scale of Google’s data processing, novel analytics approaches with artificial intelligence and machine learning, as well as a focus on eliminating entire classes of threats. By combining Google’s security capabilities with those of our ecosystem and alliance partners — including Cybereason, IPNet, ForgeRock, Palo Alto Networks, and SADA — we’re bringing businesses a full stack of powerful and effective solutions for managing data access, verifying identity, sharing signal information, and gaining visibility into vulnerabilities and threats. In concert with our ecosystem of partners, we will be working with Mandiant and its partners to deliver an end-to-end security operations suite with even greater capabilities to help you address the ever changing threat landscape across your cloud and on-premise environments. In sum, Google Cloud brings you the tools, insight, and partnerships that can transform your security to meet the requirements of our rapidly transforming world. To get a deeper dive into the trends and research driving this change, watch the “Cloud Makes it Better: What’s New and Next for Data Security” webinar with Forrester and Google Cloud.
Quelle: Google Cloud Platform