“NSA Says – Largest Transfer of Wealth…EVER”; CyberAttacks rose 44% in 2011 July 10, 2012
Posted by Chris Mark in cybersecurity, Industry News.Tags: cybersecurity, data breach, data security, deterrence theory, Keith Alexander, mark consulting group, NSA, PCI DSS, risk, security
add a comment
Parroting what many in the payments industry have known for years, the NSA released a statement about the dire state of cybersecurity. According to the head of the National Security Agency cyberattacks increased 44% in 2011 and now account for the largest “transfer of wealth in history”. According to FoxNews:
“NSA chief Keith Alexander was speaking Monday at an American Enterprise Institute event in Washington, D.C. He said that for every company that knows it has been hacked, another 100 do not know their systems have been breached. (emphasis added) The warning came on the same day that thousands of computer users were at risk of losing Internet access, due to malware that spread more than a year ago. Citing public and unclassified statistics, Alexander said Monday there are now 75 million unique pieces of malware on the loose.”
Those of use who have been in the industry for years have said that we are ‘losing the war’. I have personally been chastised for making such doom and gloom statements. The facts are the facts however. Hiding our head in the sand will not change the fact that “The criminals are absolutely ripping us to shreds,” and that “We’re losing the battle…That’s the reality of it.” (Chris Mark quoted in Salt Lake Tribune...pic at top). In yet another push at self promotion..you can read one reason we are losing the battle in the IDGA research brief: “A Failed State of Security”.
“Are You Eating a Rotten Apple?” – Personal Data May have Been Exposed in Global Payments Breach July 9, 2012
Posted by Chris Mark in cybersecurity, Data Breach, Industry News, InfoSec & Privacy, PCI DSS, Risk & Risk Management.Tags: compliance, cybersecurity, data breach, Global Payments, mark consulting group, PCI DSS, PII, risk management, security
add a comment
Let me preface this post by saying this is not intended to take shots at either Global Payments or the PCI DSS. Rather, this post is intended to generate discussion and discourse on the topic of compliance and risk management.
According to reports, it seems that the Global Payments data breach may have exposed more than payment card data. n a June 12 update posted to its breach microsite, Global says hackers may have gained access to servers containing personal information collected from a subset of merchant customers.
“The company will notify potentially affected individuals in the coming days with helpful information and make available credit monitoring and identity protection insurance at no cost,” Global says. “The notifications are unrelated to cardholder data and pertain to individuals associated with a subset of the company’s U.S. merchant applicants.”
Based upon this statement it seems fair to assume that Personally Identifiable Information (PII) such as Social Security number and Bank Account information may have been exposed, as well.
This situation exposes the danger of using a narrowly focused, static standard as a baseline of security management rather than adopting a risk based approach to data security. I have personally conducted over 100 PCI DSS audits and have seen first hand the resources consumed by the standard. Companies often appear so laser focused upon protecting payment card data that other systems and data may take a back seat in the pursuit of “PCI DSS compliance.” As there are significant penalties associated with non-compliance that it is difficult to blame the merchant or service provider. The penalties are designed to compel compliance with the standard. As such, companies are going to give precedent to the PCI DSS over any other standard that does not have equivalent penalties associated with non compliance.
As a reminder, the PCI DSS is ONLY focused protection of Cardholder Data. Surely some are going to say that the PCI should be applied across all systems etc.etc. This is great in theory but does not happen in practice. Companies take great pains to minimize their cardholder data environment specifically to lessen the compliance burden.
I am sure we will continue to see breaches of payment card companies having PII exposed as companies focus on PCI to the exclusion of risk based security management.
“Let’s Talk Data Security” – Heather Mark in July 2012 Greensheet & TransactionWorld July 9, 2012
Posted by Chris Mark in cybersecurity, Data Breach, Laws and Leglslation, News, PCI DSS.Tags: cybersecurity, data breach, data security, greensheet, Heather Mark, mark consulting group, security, transactionworld
add a comment
Heather Mark is interviewed in the July 2012 issue of Greensheet in the article titled: “Expert Advice on Security Defense and Planning”. The article discusses strategies for preventing and dealing with data breaches with the payment card industry. Additionally, Heather has an article in TransactionWorld titled: “New School vs. Old School: Security and Emerging Technologies”. You can catch Heather’s articles every month in Transaction World Magazine.
“This is the American Express Fraud Department” – Two Dozen Carders Arrested on 4 Continents June 26, 2012
Posted by Chris Mark in cybersecurity, Industry News.Tags: Amex, BOA, Carders, data theft, DSS, Fatal System Error, fbi, mark consulting group, PCI, Sting, visa
1 comment so far
Lnight my wife received an email about a suspcious transaction on our Amex card. Turns out it was a fraudulent transaction and my wife’s card had been stolen. I was writing a blog post on this very subject when a Google alert informs me of this article on Foxnews. “Two Dozen Arrested in Online Financial Fraud Sting”. According to the article: “Two dozen people on four continents have been arrested in an elaborate sting targeting a black market for online financial fraud, federal officials in New York said Tuesday.
U.S. officials called the crackdown in United States, Europe, Asia and Australia the largest enforcement effort ever against hackers who steal credit card, bank and other information on the Internet — a practice known as “carding.” The officials claimed the two-year FBI sting protected more than 400,000 potential victims and prevented losses of around $205 million.”
On that note, I recommend that you take a look at the book “Fatal System Error”…gives very good insight into the underworld of Carding.
“Pinky and the Brain” – Chris & Heather Mark’s Articles in Transaction World Magazine June 21, 2012
Posted by Chris Mark in cybersecurity, Industry News, InfoSec & Privacy.Tags: compliance, credit card, cybersecurity, data breach, information security, PCI DSS, privacy, transaction world
add a comment
I heard yesterday from the EIC of Transaction World Magazine that they will be publishing one of my articles in their August 2012 issue. Stay tuned! I have written for TW numerous times over the past 7 years or so and Heather has written for them consistently since about 2005. You can read her current article here and see archives of Heather’s articles at this link. If you are not in the payments industry and want to know about the exciting world of credit card issues, check out TransactionWorld. It has great articles covering everything from compliance, to security, interchange, and more. Here are two links to a couple of my previous TW articles..1) Why Regulation Cannot Prevent CyberCrime and 2) Lessons from the Heartland Breach…clearly in this relationship Heather is the Brain and I am Pinky 😉
Global Security, Privacy, & Risk Management 