Author: Matthew Miller

body {font-family: Arial, sans-serif; line-height: 1.6;}
h2 {color: #333;}
h3 {color: #555;}
ul {list-style-type: disc; margin-left: 20px;}
img {max-width: 100%; height: auto;}

Incident Overview

The code hosting service GitHub is actively working to address an incident that compromised several services overnight, at one point hindering nearly half of all archive and raw repository downloads. The Microsoft-owned platform raised awareness of the situation on August 17 at 11:40pm AEST, indicating that it was looking into reports of performance issues across various services.

Extent and Effects

In under 20 minutes, GitHub included API requests, Actions, webhooks, Issues, and pull requests on the affected services list. By 12:04am on August 18, the error rate had surged to approximately 20 percent for web and API traffic, with archive downloads and raw repository content experiencing a failure rate of about 50 percent. This elevated error frequency presented considerable difficulties for users who depend on the platform’s essential functionalities.

Impact on Enterprise Services

Enterprise clients were similarly impacted at the identity level, with GitHub acknowledging that SAML and OIDC authentication, SCIM provisioning, and Team Sync faced disruptions. These identity services are vital for smooth user authentication and provisioning processes.

Restoration Efforts

During the night, GitHub informed that the issues affecting API requests, Actions, Git operations, Issues, Pages, pull requests, and webhooks had been alleviated, and it was observing for consistent performance. Nevertheless, recovery has been inconsistent, with Git operations, Issues, and the API failing again within two hours of GitHub’s declaration of mitigation.

Ongoing Issues

“We are persistently examining ongoing authentication failures,” GitHub stated in an update, noting that it had partially disabled retries for authentication tokens, observed improvements, and was assessing the impact before fully implementing the mitigations. As per the latest information, neither the root cause nor the specific component responsible for the issue has been identified.

Conclusion

This week’s incident marked the 14th for GitHub this month, underscoring the persistent challenges in maintaining stable service. While GitHub aims for total recovery, users still encounter sporadic issues.

Q: Which services were impacted during the outage?

A: The outage influenced numerous services including API requests, Actions, webhooks, Issues, pull requests, and identity solutions like SAML and OIDC.

Q: How long did the outage persist?

A: The incident was initially reported on August 17, and while efforts to mitigate started promptly, full restoration was not immediate, with ongoing sporadic issues.

Q: What triggered the GitHub outage?

A: As of the latest update, GitHub has not revealed the underlying cause of the outage.

Q: How many outages has GitHub recorded this month?

A: The incident was the 14th documented by GitHub this month.

Q: Were enterprise users impacted differently?

A: Yes, enterprise users faced challenges at the identity level, impacting authentication and provisioning services.

Q: What measures is GitHub implementing to resolve the issue?

A: GitHub is actively monitoring the situation, has partially disabled authentication token retries, and is applying mitigations as improvements are detected.

(L-R) Greg Johnstone and Stephen Bombardiere.

Consolidating Vendor Risk Management

The Commonwealth Bank of Australia (CBA) is in the concluding phases of shifting 5000 suppliers to a newly consolidated third-party risk management system facilitated by ServiceNow. This strategic initiative, discussed during the ServiceNow World Forum in Sydney, aims to unify vendor risk management processes and utilize AI capabilities for improved supervision and compliance.

ServiceNow and AI Synergy

CBA began the integration of ServiceNow into its procurement activities several years back with the rollout of the Sourcing and Procurement Operations (SPO) module. Greg Johnstone, executive product owner, stated that the module was launched to address the difficulties associated with supplier onboarding. Following the implementation of the CPS230 prudential standard, which requires solid vendor risk oversight, CBA broadened its adoption of ServiceNow to further encompass third-party risk management.

Emphasis on Non-Supplier Third-Parties

The primary focus of CBA’s move to ServiceNow was on non-supplier third-parties, such as professional service firms. Stephen Bombardiere, crew lead for business platforms, highlighted that, while the bank had a solid supplier-centric risk management system, managing non-supplier third-parties was disjointed among various teams. This consolidation through ServiceNow’s TPRM module last April enabled CBA to fulfil CPS230 requirements and bolster its organisational assurance in the third-party risk sector.

Supplier Migration Ahead

With the non-supplier migration finished, CBA is now deeply engaged in transferring its suppliers, with completion anticipated within five to six weeks. Once finalized, all risk management workflows for both suppliers and non-suppliers will be streamlined onto the unified ServiceNow platform.

The Role of AI in Risk Evaluation

After the migration, CBA intends to leverage AI, particularly Now Assist, to facilitate risk evaluation processes. AI will assist in reviewing compliance reports and provide insights during risk assessments. As Bombardiere mentioned, the integration of AI will reduce the manual workload involved in interpreting reports and formulating controls, equipping risk professionals with pre-analyzed data.

Conclusion

CBA’s transition to a centralised third-party risk management platform represents a crucial advancement in enhancing its vendor risk oversight in line with the CPS230 standard. The integration of AI tools is projected to further optimise processes, rendering risk assessments more efficient and thorough.

Questions & Answers

Q: What does the CPS230 prudential standard entail?

A: CPS230 is a guideline that necessitates financial institutions to manage vendor and third-party risk with the same diligence as internal systems.

Q: Why did CBA opt for ServiceNow for this transition?

A: CBA chose ServiceNow because of its pre-existing use in procurement and its capability to expand into third-party risk management.

Q: In what way will AI enhance CBA’s risk management workflows?

A: AI, such as Now Assist, will facilitate compliance report evaluation and provide direction during risk assessments, thereby minimizing manual workload.

Q: What is the expected timeframe for completing the supplier migration?

A: The migration of 5000 suppliers to the new platform is projected to be finalized in about five to six weeks.

Q: What obstacles did CBA encounter with non-supplier third-party management?

A: CBA faced disjointed management across teams, which has been addressed through the centralisation in ServiceNow’s TPRM module.

Q: How does the new platform bolster organisational confidence?

A: By centralising the risk management process, CBA enhances its organisational confidence from sourcing and procurement into third-party risk management.

Movement Towards Improved Security and Coverage

Komatsu Australia is undertaking crucial measures to bolster security and network coverage for its automated heavy machinery. By moving from Telstra’s SIMs to Zscaler’s secure and network-agnostic options, the organization seeks to strengthen its Smart Construction and Smart Quarry product lines. This tactical initiative encompasses the transition of about 1800 equipment units to Zscaler Cellular SIMs.

Standardization and Future Adaptability

In the future, these SIMs will be standardized in new product releases, including Intelligent Machine Control, Smart Construction 3DMG, and Smart Quarry Site devices. This effort forms a part of Komatsu’s larger strategy to establish a foundation for its subscription management systems, essential for upcoming technological expansions in the South Pacific region.

Benefits of Zscaler’s Network-Agnostic MVNO

As a network-agnostic Mobile Virtual Network Operator (MVNO), Zscaler permits devices to connect to the strongest signal present, providing redundancy against network interruptions. This functionality is especially valuable considering the recent network issues faced by Telstra. Brent Parker, Komatsu’s national operations manager, highlighted the significance of this adaptability for their clients and future technological integrations.

Syncing with Zero Trust Security Approach

This transition is in alignment with Komatsu’s developing network security strategy, utilizing Zscaler’s zero trust access framework. This protocol manages internet access via Zscaler’s cloud-based Zero Trust Exchange (ZTE), assuring stringent security measures for Komatsu’s devices.

Effects on the Telecommunications Sector

While Telstra has traditionally led IoT deployments in industries such as mining and farming, this action by Komatsu may indicate a transformation. The recent scaling back of Telstra’s coverage maps, due to more stringent labeling regulations, could create openings for other players in the remote cellular market.

Summary

Komatsu Australia’s choice to implement Zscaler Cellular SIMs signifies a strategic transition towards improved security and network adaptability. By standardizing these SIMs in forthcoming equipment, Komatsu is preparing for technological growth and responding to the demand for reliable connectivity solutions in the South Pacific area.

Q & A

Q: Why is Komatsu Australia making the switch from Telstra to Zscaler Cellular SIMs?

A:

Komatsu is focused on enhancing security and network coverage while establishing the groundwork for future subscription management systems.

Q: What advantages do Zscaler Cellular SIMs offer?

A:

They provide enhanced network coverage, redundancy against network outages, and enable devices to connect to the strongest available signal.

Q: How does this transition relate to Komatsu’s security approach?

A:

The shift aligns with Komatsu’s zero trust access methodology, guaranteeing regulated internet access through Zscaler’s Zero Trust Exchange.

Q: What implications might this have for Telstra?

A:

It could indicate a shift in the industry, potentially opening doors for competitors in the remote cellular sector as Telstra’s coverage is scrutinized.

Q: Will this change impact all of Komatsu’s equipment?

A:

At present, the adjustment is confined to the Smart Construction and Smart Quarry product lines, with no immediate plans for autonomous mining machinery.

Apple’s Pledge to Fair Competition

Apple plans to revamp its App Tracking Transparency (ATT) framework, which has been examined by Germany’s federal cartel authority (FCO). The investigation uncovered that Apple’s applications received more advantageous consent messages compared to those provided to third-party developers, raising potential issues with competition law.

Regulatory Scrutiny and Compliance

The FCO’s conclusions have prompted Apple to promise significant changes within a four-month period. These adjustments will be maintained for seven years and will be overseen by an independent supervisor. The corporation seeks to rework consent notices for third-party applications, ensuring they are neutral both visually and textually, eliminating any discouraging phrases or symbols.

European Landscape and Sanctions

Apple’s ATT framework has encountered criticism and financial penalties throughout Europe. France and Italy have imposed fines totaling over €248 million against the tech company due to comparable issues with the framework. The announced changes will be applicable across nearly all countries within the European Union, fostering a more equitable environment for app developers.

Effects on Third-Party Developers

Third-party developers, including major entities like Meta Platforms, depend heavily on precise user data to facilitate targeted advertising. This information is vital for achieving higher revenues compared to untargeted campaigns. Apple’s updated framework is anticipated to give these developers more equitable access to user consent, possibly enhancing their advertising effectiveness.

Overview

Apple has agreed to revise its App Tracking Transparency framework in response to a German regulatory inquiry. The modifications aim to promote fair competition by providing neutral consent prompts for third-party applications. This initiative follows significant fines from France and Italy and will influence app developers throughout the European Union.

Q: Why is Apple revising its App Tracking Transparency framework?

A: Apple is implementing changes following a German investigation that identified its consent prompts as more favorable towards its own applications in comparison to those of third-party developers, raising competition concerns.

Q: What are the primary changes Apple will introduce?

A: Apple will overhaul consent notifications for third-party applications to ensure they are more neutral, removing any discouraging language or symbols.

Q: How long will Apple’s commitments remain in effect?

A: Apple’s commitments to these changes will persist for seven years and will be supervised by a trustee.

Q: What penalties has Apple encountered concerning the ATT framework?

A: Apple has faced fines exceeding €248 million from France and Italy relating to the ATT framework issues.

Q: How will these changes impact third-party app developers?

A: The changes are expected to offer third-party developers fairer access to user consent, potentially enhancing their capacity for targeted advertising.

Q: Will these modifications be applicable outside of Europe?

A: At present, the changes are intended to be applicable in nearly all European Union nations.

Brief Overview

• The US prompts nations to select sides in the AI contest with China.
• Pax Silica initiative strives to secure AI supply chains and essential minerals.
• Kazakhstan stands as the sole country involved in both US and Chinese AI efforts.
• China’s AI systems are quickly rivaling those based in the US.
• The US aims to restrict China’s assets to lead in AI technology.

AI Contest Intensifies

The United States is intensifying its campaign to gather global backing against China’s expanding sway in artificial intelligence (AI). A recent draft letter from Washington highlights the pressing need for nations to select between supporting the US-led Pax Silica initiative or China’s alternative framework.

Pax Silica Initiative

Initiated last year, the Pax Silica initiative seeks to strengthen supply chains critical for AI development, encompassing semiconductors and vital minerals. This US-led coalition has engaged approximately two dozen nations, including Australia, Japan, and South Korea, underscoring a collective commitment to technological progress and security.

The Importance of AI Leadership

The global contention to develop advanced AI capabilities is not merely about technological progress but also economic and military supremacy. The US contends that by restricting China’s access to resources, it can preserve a strategic edge. This was emphasized when Chinese President Xi Jinping announced the “World Artificial Intelligence Cooperation Organization,” contesting US dominance.

Kazakhstan’s Dual Affiliation

Kazakhstan’s participation in both AI initiatives has raised alarm in Washington. The US considers membership in the Pax Silica as an obligation that cannot coexist with China’s initiatives. The pressure is escalating for nations to make intentional decisions that align with US interests.

Conclusion

The US and China are escalating their rivalry for AI dominance. The Pax Silica initiative illustrates America’s strategic attempt to solidify alliances and secure essential technological resources. As nations like Kazakhstan navigate their positions between these two giants, the global AI landscape is primed for notable geopolitical transformations.

Q: What is the Pax Silica initiative?

A: Pax Silica represents a US-led initiative focused on securing AI supply chains, semiconductors, and essential minerals, uniting allied nations to back the US in the AI contest against China.

Q: Why is Kazakhstan’s stance important?

A: Kazakhstan’s role in both US and Chinese AI initiatives underscores the strategic challenges faced by countries, balancing ties with two technological superpowers.

Q: How is China responding to the US initiative?

A: China has established its own “World Artificial Intelligence Cooperation Organization” to counter US influence and promote its own open-weight AI technology.

Q: In what way does the AI race affect global geopolitical relations?

A: The AI race heightens geopolitical frictions, with countries being nudged to choose sides, influencing global alliances and technological partnerships.

(L-R) Colby Rook (ServiceNow), Sam Polur (Anglicare)

Revamping IT Service Management at Anglicare

Anglicare has initiated a thorough upgrade of its IT service management (ITSM) and operations management (ITOM) systems, migrating to ServiceNow in a project referred to as ‘service ignite’. This strategic transition was necessitated by the requirement to better serve its large workforce of over 6,000 employees and to support ongoing organizational expansion.

The Urgency for Transformation

As noted by Sam Polur, General Manager of Technology Services at Anglicare, the former system was unwieldy and did not meet the demands of the staff, particularly caseworkers who struggled to decide between logging issues and addressing their clients’ requirements. The previous system’s shortcomings in accessibility and functionality catalyzed the shift to a contemporary, cloud-based solution.

ServiceNow Deployment

Initially, Anglicare planned to roll out ServiceNow across multiple business divisions, such as HR and finance. However, practical considerations necessitated a targeted execution focusing on ITSM and ITOM to secure quick milestones. The deployment, backed by Tata Consultancy Services and ServiceNow specialist Tinyloop, successfully went live in February.

Enhanced Experience and Productivity

The updated platform has greatly enhanced the user experience, allowing staff to engage with IT systems via a mobile application, virtual agent, or Teams integration. This seamless interaction has streamlined processes like employee onboarding and offboarding, delivering measurable advantages to front-line staff.

Proactive Incident Management

By integrating SolarWinds and New Relic monitoring tools with ServiceNow, Anglicare can now proactively detect 40% of incidents before they affect staff. This forward-looking strategy marks a substantial improvement over past reactive methods, facilitating quicker problem resolution and boosting overall operational efficiency.

Improved Incident Resolution

Clear service mapping and precise team routing have significantly enhanced the incident resolution process. Presently, two out of three incidents are resolved on their first assignment, decreasing the need for multiple handoffs and enriching the employee experience.

Conclusion

Anglicare’s shift to ServiceNow as part of the ‘service ignite’ initiative signifies a considerable advancement in IT service management. By prioritizing immediate IT requirements and utilizing sophisticated monitoring tools, the organization has elevated service delivery and operational effectiveness.

Q: Why did Anglicare decide to revamp its IT systems?

A: The revamp was motivated by the need to assist a growing workforce and enhance system accessibility and functionality.

Q: What were the primary advantages of the ServiceNow deployment?

A: Major advantages include an enhanced user experience, streamlined processes, proactive incident management, and effective incident resolution.

Q: How did Anglicare boost incident resolution?

A: By incorporating clear service mapping and team routing, two out of three incidents are now resolved on their first assignment.

Q: What function do SolarWinds and New Relic serve in the new system?

A: These tools integrate with ServiceNow to proactively recognize incidents prior to staff reporting, thereby facilitating more efficient operations.

Q: Was the ServiceNow deployment extended beyond IT?

A: Although initially intended to encompass HR and finance, the deployment concentrated on ITSM and ITOM for practical and readiness reasons.