Security Report Warns of New Vulnerabilities

MJ: = "Is it really cheaper to cover the loss?"

apparently it has been.  reports I've seen have stated loss to fraud at 20 cents per $100 commerce generally but 50 cents per $100 for electronic commerce

a credit card today simply uses a magnetic stripe reader instead of the old 'embosser'. remember those?  you put your card on the embosser, laid a ticket on top and rammed the handle across the card -- which would then imprint the card nuber via carbon paper onto the tickets.  the merchant could then deposit the ticket to his account -- which would be processed against your credit card account as if it were a check: a simple automation of the process that has existed since the 1960s  ( checks well before that )

my proposal will require replacing all the plastic\magnetic strip cards with 'smart cards' AND all of the Point of Sale terminals ( POSTs ) -- in order to create a system that can be secured in our electronic environment

"Because that's where the money is"

according to urban legend when the police asked Willie Sutton: "Why do you rob banks?" Willie replied: "Becuase that's where the money is."

There is a lesson for all of us in this: you can't steal what isn't there

if the merchant does not have your account number the hackers cannot steal it even if they do break into the merchant's system

my proposal has the additional advantage in that you not only do not give your account number to the merchant you don't give him any other information, either-- which will be a + for Privacy

Great ideas here, Mike. How likely is it that a strategy like this would be adopted by credit card processing firms? I'm surprised they aren't already doing this.

Is it really cheaper to cover the loss?

an interesting article on C/Net this morning discusses the cost of the Global Payments Hack ( revelaed last week )

another essay noted

As a result of the breach, Visa removed Global Payments from its list of approved service providers. Visa told The Wall Street Journal (subscription required) that the move was in response to "Global Payments' reported unauthorized access." Visa said it has invited Global Payments to re-apply for validation by submitting evidence that its security is in compliance with Visa's standards.

The message should be clear: get serious about seciurity or you are going to get nailed for huge costs and a big hit on your reputation

either hit can put your company out of busness

hacking goes on and on. but there is a single persistent method to it: malware. hacking is accomplished by getting unauthorized programming into an endpoint computer -- either the customer's or the vendor's servers. while the methods for doing this are as varied as a Game of Chess the last move is always the same: PWNED: i.e. your computer is controlled by the hacker's software.

putting an end to un-authorized programming is the right answer but this must be backed up with detection and response: the software inventory audit is required to verify the effectiveness of any software protection plan.

the most difficult key to controlling unauthorized software will be the question of executable documents.  we know we can control an executable document by running it only in a 'sandbox' ( restricted user; RING3 ) but a deeper question about these must be answered: what do you do when an executable document, e.g. an excel sheet, must be moved out of the sandbox to another working directory ??

Google\Chrome solution is : strip the executable code from the document.

executable documents were a bad idea to begin with and i think i'll put them on my list of the 13 worst products in modern history.

MJ = "A depressing reminder that enterprise security is an ongoing fight."

that's the problem Mary: there is no fight. as long as it's cheaper to just cover the loss than to fix the problem that is the response we will continue to get

but when you or a personal friend get hit by the hackers PCI\industry response will no longer be adequate and hacking will be more than messages on the 'Net to you: it will be personal

~

interestingly an analyst on NPR last night reported what I've been saying for a year here on IEv: PCI process of giving card data to merchant is incorrect: it facilitates large scale hacking as is being reported this morning: 10,000,000 Master Card \ Visa Accounts -- stolen

current PCI processing is a vestage of the Pen and Ink procedures of the 1950s

what should be done:

• use Smart Card not magnetic stripe
• customer does not give account data to merchant, rather
• merchant must submit invoice to customer's smart card
• customers smart card encrypts invoice with authorization for payment and returns this as cipher text to the merchant point of sale terminal (POST)
• POST forwards cipher text to PCI
• on approval PCI forwards paid invoice and EFT to merchant
• POST prints sales receipt for customer

at no time did the merchant have the customer's PII; in fact merchant doesn't even need to know who the customer was. YEA!!

hackers will now need to get malware into either (a) the customers smart card or (b) PCI processing center.  the attack surface is drastically reduced

customer must not use mobil phone for this: those are hackable.  smart card must be non-modifiable.  these expire and are re-issued periodically

Seems there's been another credit card data breach. A depressing reminder that enterprise security is an ongoing fight.

Well I guess it's a double-edged sword. Most organizations probably believe that they can have full trust in their employees so they don't need the extra layers within the network. BUT once that trust gets compromised, that's the wakeup call.

That's a fair point, pcharles.  But that's no excuse for implementing a "piece of metal" solution and then ignoring fundamental security principles.

Sort of like buying the world's most uncrackable safe, and then leaving the combination at 0-0-0-0.

OR they haven't found out yet that something was taken. I have seen organizations where the breaches were from internal users. It took hours of surveillance to figure out what was happening only after the suspicions arose. But I could only imagine how long it was going on before an eyebrow was even raised.

Enterprises should learn that, not only if there a thief in the neighborhood, but the thief has probably visited them already.  If it's not obvious, then that's probably because there wasn't really anything worth taking.

I've found that when it comes to technology, security is what you want it to be. No one leaves there front door open if there's news of a thief in the neighborhood. But every day, business owners claim they are not concerned with security as a practice while they are fully aware that a breach of any sort would be a disaster. In the end, it's all about education.