Chris Mark speaking at Secura Risk Management Fall Forum (Oct 28-29) October 24, 2015Posted by Chris Mark in Uncategorized.
Tags: Chip and Pin, Chris Mark, cyber, cybercrime, DarkNet, Deepweb, EMV, PCI, Secura, security, TOR
add a comment
If you are a bank, credit union, or work for one and want to listen to me (Chris) speak and are looking for a reason to go to beautiful Charleston, South Carolina..check out the Secura Fall Risk Management Forum! Yours Truly will be speaking on CyberCrime and the DarkNet as well as EMV “Chip & PIN” (a misnomer but…I will not discuss here). Should be a great event and will be in one of my favorite US cities…Charleston, South Carolina!..I have not had an opportunity to speak at a Secura event yet but they appear to be very well put together and the agenda looks very compelling. Also, if you didn’t have a chance to attend the AT&T Cyber Security Conference in NYC, you can watch a replay of the event here! You can see me on the ‘big stage’ talking with Jamie Wallace on Mobile Security. It was a great event with top shelf speakers…(notice that I am rocking my Recon Jack to represent the USMC Recon Community!)
Tags: CEO, Coalfire, PCI, Rick Dakin
add a comment
I just learned that a fine man and information security visionary passed away this summer. Rick Dakin was the co-founder and CEO of Coalfire, a well-respected information security company. Over the years I have had numerous opportunities to work with Rick and interface with him. I am truly saddened to have learned that our industry has lost such a fine man and fine leader. Under Rick’s leadership as CEO, Coalfire grew from a regional security company into an internationally known security firm.
Rest In Peace Rick…your influence in the information security and business arena cannot be overstated.
EMV- CHIP & Choice..not Chip & PIN…Start Moving! March 23, 2015Posted by Chris Mark in Uncategorized.
Tags: Chip & PIN, Chris Mark, data breach, EMV, EMVCO, fraud, Liability Shift, mastercard, PCI, visa
add a comment
After deviating from my ‘security’ theme, I am back to talk about InfoSec. Last week I had the opportunity to attend Visa Accredited EMV Consultant Training at Visa’s Headquarters in Foster City, CA. As always, Visa put on a top tier program with numerous experts in Payment Card ‘chip’ technology. Since the topic was EMV most of the experts were from Across the Pond. Thanks to Mark, Chris and the others for great training!
For those who are new, EMV or “Europay, MasterCard, Visa” is a technology where a microprocessor ‘chip’ is embedded in a payment card (credit card, debit card, etc.). It is often erroneously referred too as “Chip & PIN” but EMV really only applies to the Chip technology. If a region or issuer wants to prefer PIN, they are able. Visa has a “Chip and Choice” model where they allow Chip with signature, no signature, or PIN depending upon the issuer, the risk and type of transaction (ie. Debit for Cash or ATM require a PIN). There was too much information over 2 days to talk about in this post but there was one point I learned and wanted to pass on..
In October 2015, Visa is offering a ‘liability shift’ for merchants who adopt EMV. My belief (it was wrong) until I attended the training was that the EMV liability shift only affected those merchants who 1) accepted a ‘chip’ card and on ‘chip’ transactions. These are known as ‘chip on chip’. It is critical that Merchants understand that the liability shift occurs for merchants who accept transacitons over a dual interface terminal (Chip and NFC) who accept transactions of ANY form. As an example, if you accept 99% mag stripe transactions but you have dual interface terminals…the fraudulent transacion due to counterfeit have liability shifted to the issuer! It does NOT have to be a Chip on Chip transaction.
The Second important point to remember is that Visa is offering a Technology Incentive Program (TIP) that states if a Level 1 Merchant accepts 75% of transactions over a Dual Interface terminal, they do not have to validate compliance with an onsite assessment. There are some caveats to this so make sure you read the rules!
To get ready for implementation, ensure you download the Visa Merchant Readiness Acceptance Guide here.
Chris Mark speaking at COMTEC 2014 by TouchNet August 27, 2014Posted by Chris Mark in Uncategorized.
Tags: AT&T, Breach, cardholder, Chris Mark, compromise, COMTEC, Data, data security, education, higher, PCI, TouchNet
add a comment
Chris Mark will be presenting at the 2014 COMTEC TouchNet Client Conference on PCI DSS and data security within the payment card industry. The title of the presentation will be Hitting the PCI Bullseye. COMTEC is the premier conference for Higher Education organizations. I was invited to speak in 2012 but found myself delayed returning to teh US as I was in the Gulf of Aden providing maritime security. Below is a description from the TouchNet website.
“Join us for the COMTEC pre-conference PCI Workshop: Hit the Bullseye on November 10th. This power-packed day of PCI and security training is vital for business, security, compliance, audit, and IT professionals who want to stay on target with changes in payment security rules in the coming year. You’ll get real-world advice on compliance and best practices from industry experts and campus leaders who are dedicated to information security.”
Chris Mark Speaking at 2014 AT&T CyberSecurity Conference August 25, 2014Posted by Chris Mark in Uncategorized.
Tags: adaptive, AT&T, Chris Mark, cyber, deterrence, hack, PCI, risk, security, threat
add a comment
At 10 am on September 3rd, 2014 Chris (that is me) will be speaking at the 16th annual AT&T CyberSecurity Conference in New York City. My particular discussion will be on the Human Element of Security. From providing armed force protection in Mogadishu to unarmed security in a psychiatric ward through information security and anti-piracy work in the Gulf of Aden, I have learned that the underpinnings of security transcend all security domains. My presentation will hit on the concepts of rationality, Knightian uncertainty, parallax, proximate reality, change blindness, deterrence, and threat adaptation to provide tools CSOs can use to make more informed decisions about security.