Standards Aren’t Security and We Shouldn’t Expect Them to Be January 11, 2012
Posted by Heather Mark in InfoSec & Privacy, PCI DSS.Tags: cybersecurity, Heather Mark, ISO, mark consulting group, markconsultinggroup.com, PCI DSS, privacy, regulatory compliance, standard
add a comment
Today I saw an article about the PCI DSS in which the author lamented that, although progress had been made, there were still significant flaws in the Payment Card Industry Data Security Standard. I have seen a great many articles centered on the same idea: Though good in theory, the PCI DSS is just too flawed to work. I would argue that, in many ways, the PCI DSS is doing exactly as it is intended. Now, I do have to take off my academia hat here a bit and admit that, without a comprehensive policy and program evaluation, it is simply not possible to accurately determine the efficacy of the standard. We cannot determine that a certain population of individuals has been spared identity theft as a result the implementation of PCI DSS or rising compliance rates. What we have is anecdotal evidence that, despite the best efforts of the card brands, the Qualified Security Assessors and everyone involved in the payment transaction chain, data breaches continue to occur and may even be growing, in terms of frequency and magnitude. Since anecdotal evidence seems to be the central data point in these arguments, I’d like to share some anecdotal evidence of my own.
I’ve been involved in the payment card industry, and specifically in the security side of it, for too many years to admit. When we began working with Visa’s Cardholder Information Security Program (CISP), the predecessor to the PCI DSS, many companies had no data security programs in place. In fact, we would often see global ecommerce companies that didn’t run anti-virus or have properly configured firewalls. It was not uncommon to ask about incident response plans and have the IT supervisor respond with “we unplug.” Literally, they would pull the Cat 5 cable from the wall and pull their entire site down until they could figure out the issue.
In the intervening years, we’ve seen the industry make significant strides in their understanding and awareness of security issues. Merchants, third-party service providers, even consumers, have come light years in terms of knowing the questions to ask, the technologies to employ and the policies to implement. Security discussions around the protection of cardholder data have evolved to a very sophisticated place. Ten years ago, discussion about what is or is not cardholder data were unheard of, whereas today they are almost commonplace. In that regard, the PCI DSS has been successful. Has it stopped any data compromises? It’s difficult to judge that, but it has certainly driven companies to take security seriously and the ensuing noise around the standard has driven, and continues to drive, technological innovation in the security space.
Yet the most significant flaw in the standard is not with the standard, per se. It’s with the dependence on the standard as a comprehensive security program. It is certainly up to the discretion of each company to determine how far beyond the standard they need to reach in order to address the threats in their environment. Yet each time a compromise occurs, the first thing we hear is that it is another failure of the standard. No standard, regulation, law or best practice, regardless of how well written it may be, is going to address every contingency. Certainly there is room for debate about whether a compliant company can be compromised, but let’s remember that the standard is necessarily vague in some areas to account for the wide variety of business models in the industry. If it were otherwise, we’d certainly hear about how the standard is too prescriptive (and that charge has been leveled at the standard with equal ferocity as the too vague accusation) and still does not prevent all the compromises.
The important thing to remember is the objective of the standard is the protection of cardholder data. If you, as an individual responsible for data security or compliance, recognize an area of risk to the company or its customers that is not addressed by the PCI DSS, it is your (and your company’s) fiduciary duty to act. Court cases are now wending their way through courts to determine whether or not there is an implied contract between companies and their customers. If such a decision is made, then PCI DSS or no, companies will be held responsible for the loss of that data, and likely for a broader swath of data than is contemplated in the PCI DSS. Compliance is not an excuse to cede control of your security program. While the PCI DSS has a lifecycle of three years, companies should be constantly evaluating their threat environment and ensuring that their security program adequately addresses the risks to the data.
UK House of Commons Report: “Piracy off the coast of Somalia” January 7, 2012
Posted by Chris Mark in Laws and Leglslation, Piracy & Maritime Security.Tags: Anti Piracy, Chris Mark, maritime piracy, Maritime Security, mark consulting group, markconsultinggroup.com, PIracy off the coast of somalia, somali pirates, Somalia
add a comment
The UK’s House of Commons Foreign Affairs Committee (FAC) published a report this week titled “Piracy off the coast of Somalia”. You can read the report here. The 72-page report set out the findings of the FAC enquiry into the efforts of the Foreign and Commonwealth Office (FCO) and the UK Government to combat the increasing levels of piracy off Somalia.
Tackling the use PASGs, the report concluded that “the evidence in support of the use of armed guards is compelling” (emphasis added) but that the “Government must provide clearer direction on what is permissible and what is not”.
The report also said that the risk to pirates of encountering serious consequences is still too low to outweigh the lucrative rewards, and simply returning suspected pirates to their boats or their land provides little long-term deterrence.
SomaliaReport.com January 7, 2012
Posted by Chris Mark in Laws and Leglslation, Piracy & Maritime Security.Tags: Anti Piracy, Chris Mark, mark consulting group, somali pirates, Somalia, somaliareport.com
add a comment
I came across a good reference that is worth sharing. SomaliaReport.comhas great info on hijacked ships, ransoms, released vessels, and currently held vessels. It also provides a weekly piracy report. If you have a chance, take a look and see if there is any valuable info.
US Navy Rescues 13 Iranians from Somali Pirates January 6, 2012
Posted by Chris Mark in Industry News, Piracy & Maritime Security.Tags: Chris Mark, Iranian Sailors kidnapped, John C. Stennis, kidnapping, maritime piracy, Maritime Security, mark consulting group, USS Kidd
add a comment
In a move that illustrates the brotherhood of the sea and the disdain for piracy wherever it may be, the US rescued 13 Iranian sailors who had been kidnapped by Somali Pirates. According to MSNBC, a helicopter from the USS John C. Stennis, responding to a distress call from a merchant ship under attack, chased the pirates to their “mother ship”. The mothership was an Iranian flagged dhow that had been hijacked earlier. A counterpiracy team from the USS Kidd then boarded the mothership where they found 15 armed pirates and the 13 Iranian crewmen. The pirates were taken into custody and the Iranians were released in their dhow. Interestingly, the USS John C. Stennis is the same carrier that Iran had threatened to never allow back into the Persian Gulf. It is a good day that the Iranian sailors are headed back to their families.
The Geopolitical Context of Piracy by Dr. Heather Mark January 3, 2012
Posted by Chris Mark in Failed States, Laws and Leglslation, Piracy & Maritime Security, Risk & Risk Management.Tags: Dr. Heather Mark, geopolitical context of piracy, mark consulting group, Piracy & Maritime Security, Somalia
add a comment
This is a guest post by Dr. Heather Mark. This is a short article of a larger whitepaper titled “Understanding Modern Piracy: Geopolitical and Regulatory Considerations” which is found here.
“Executive Summary
The scourge of modern piracy is often unrecognized by the general public. However, those involved in the Maritime industries are all too familiar with the danger, both physical and economic, posed by pirates. Modern pirates hearken less to the romantic imagery of the swashbuckling adventurer than they do to the violent, mercenary gangsters that they more closely resemble. Such imagery, however, does little to explain the pirates’ motivations, their impact on shipping and the reaction of the governments whose economies are threatened by their actions.
The following paper will provide a brief analysis of the current impact of piracy on shipping, and the geopolitical context that allows these criminals to thrive. Further, the paper will provide an overview and analysis of some of the international efforts to curtail piratical activity and their effectiveness.
“Absolute freedom of navigation upon the seas, outside territorial waters, alike in peace and in war…”
-Woodrow Wilson, The 14 Points
Introduction
Modern piracy can best be described as a hidden plague on the economies of the world. While most are unaware of, or perhaps simply do not understand, the pervasiveness and impact of piracy on international shipping lanes, the phenomenon is very real and has a tangible impact, not only on the maritime industry, but also on the global economy. As the global economy struggles with worldwide recession, failing and failed states are acting as a breeding ground for organized piratical activity – from “muggings” at anchor to armed hijackings while underway.
The lack of awareness of the piracy issue, however, does not mean that this is a victimless crime or even one that has little to no impact on the public. There are very tangible costs to the crime wave for which everyone pays. For example, should a ship be the victim of a pirate attack, the owner can choose to report the incident to the appropriate authorities. If the owner does so, it must absorb not only the cost directly associated with the attack (delays and interruptions to name just a few) but must also bear the legal costs that are associated with the attack investigation.[1] This also invariably leads to higher insurance premiums, as well.
Given the costs associated with choosing to report acts of piracy, it should come as no surprise that as many as 50% of incidents are unreported. Over the last five years, incidents of piracy have grown increasingly common. In 2009 alone there were over 400 incidents of reported piracy. According to statistics from the International Maritime Bureau, acts of piracy are growing more and more violent as pirates learn from their experience, re-invest their ill-gotten gains to strengthen their criminal enterprise and widen their area of operations.
It is important that these criminals and their intentions not be underestimated. There is an apparent tendency to discount the sophistication of modern pirates. The fact that they often attack in traditional fishing vessels, dhows and skiffs often belies the shrewd organization and violent intentions of those orchestrating the attacks. In order to better understand the phenomenon of modern piracy, one must understand the origins of the crimes. What may have begun as a desperate turn by individuals seeking to supplement their dwindling incomes has become a serious plague on the international Sea Lines of Communications (SLOC).
Despite the growing impact of piracy on the shipping industry, the general public has yet to demonstrate a sustained interest in combating piracy on an ongoing basis. American public opinion has been singularly focused on issues of terrorism since the attacks of September 11, 2001. Though many scholars have theorized about a connection between piracy and terrorism there has yet to arise a substantive, tangible relationship between the two criminal acts. At their core, the two acts have very different aims – piracy is undertaken for purely economic reasons and requires secrecy and anonymity so that the criminals can continue their activities, while terrorism is undertaking for ideological reasons requires an audience to be effective[2].
Looking at the activities of piracy only tells part of the story, however. In order to understand the phenomenon of modern piracy, one must understand the underlying causes. These individuals and, in many cases, organizations, do not exist in a vacuum and are a product of the environment in which they exist. There are certainly variables that give rise to conditions favorable to crime. This paper will examine some of those conditions, including the geopolitical and economic contexts that may give rise to piracy.
Geopolitical Context
There are a number of factors that must be addressed when examining modern piracy from a geopolitical perspective. Not only must one examine the constraints facing states in fighting piracy, but one must also examine the features that allow piracy to thrive. There is a discussion of law enforcement that cites three critical elements in the prevention of crime. Of the three elements deterrence is perhaps the most important. In other words, the criminals must perceive greater danger to themselves in perpetrating the crime (ie. getting caught, wounded or killed in the act)than they see reward in committing the crime and escaping. In geopolitical terms, the deterrence of crimes becomes increasingly complex, particularly when dealing with issues of sovereignty and failed, or failing, states. For the sake of brevity, this paper will not attempt to examine every possible cause of international piracy, but will simply highlight those issues that best demonstrate the roots of the issue and the complexity associated with combating piracy.
State Sovereignty
Efforts to address international issues often give rise to conflicts of state sovereignty. The very existence of the United Nations still leads to heated debate in a variety of circles. While it is certain that international cooperation is beneficial for a number of reasons, there are those that feel that belonging to the cooperative necessarily results in the dilution of sovereignty. If countries cannot, or are at least discouraged from, taking unilateral action, one must question the degree to which they are maintaining their sovereignty in light of the communal pressures.
Contrast the need to maintain state sovereignty with the need for collective security agreements, however. Collective security agreements remain a fact of international life, the driving notion being that there is safety in numbers, for states as well as individuals. Alliances are necessary to mitigate the threat of hostility. Security and sovereignty are two fundamental requirements for the longevity of the state. These two competing needs require states to master the delicate balance of maintaining their independence and sovereignty while cooperating with neighboring states to the extent necessary to achieve stability and security.
Inis Claude describes the challenge of collective security: “Collective security requires the relinquishment of the sovereign free hand in the most vital issues of foreign policy, the abandonment of national biases for and against other states, and a consequent willingness to follow the lead of organs of the community in taking action in opposition to any aggressor, on behalf of any victim[3].” With this description in mind, one can begin to see the struggles that face the collective efforts to combat piracy, particularly in littoral regions bordered by states that are taking pains to project themselves as a strong, sovereign power. One of the most piracy prone areas in the world, the Malacca Straits, provides ample illustration.
The Trilateral Coordinated Patrol, introduced in 2004, was a joint effort among Indonesia, Malaysia and Singapore to patrol the littoral waters along the coast in an effort to deter piracy. However, in its initial implementation, the Patrol failed to produce a significant reduction in piratical acts in the area. This was at least partially attributed to the fact that the Patrol failed to allow for cross-border pursuit[4]. Issues of state sovereignty discouraged the presence of foreign navies in state waters, even in the pursuit of dangerous criminals and for the purposes of collective security.
Recent reports, from the Indonesian embassy, estimate that the Trilateral Coordinated Patrol has succeeded in reducing piracy in the area by 70%[5]. That being said, the International Maritime Bureau still cites the Malacca Straits as one of the most piracy prone areas in the world and advises ships to use extreme caution when moving through the region. Indonesia and Malaysia in particular are wary of international assistance for the Trilateral Coordinated Patrol, while Singapore has been is more welcoming.
Issues of state sovereignty are further involved due to the fact that most acts of piracy occur within the “12 nm territorial seas or the 200nm exclusive economic zones (EEZ) claimed by most states, according to Richard O’Meara. O’Meara ascribes the complications in deterrence and prosecution of pirates to the fact that they must be dealt with according to the “vagaries of local criminal codes, administration processes, resource allocation, and corruption[6].”
Consider that piracy takes place in stages, many of which begin on land. Planning, supplying and orchestrating the attack are often carried out on land. In addition, the pirates may attack domestic ports or steal ships at port with which they can then use to carry out their operations at sea. These domestic issues fall under the jurisdiction of the local governments and law enforcement agencies. For many states, allowing international law to determine the extent of deterrence and enforcement that takes place domestically is akin to sacrificing sovereignty. For that reason, anti-piracy conventions and collaborative efforts are necessarily constrained to the activities at sea. While international cooperation and regulations may be prescribed, and will be discussed later, there is no enforcement mechanism by which states can coerce others into abiding by those regulations.
Failing and Failed States
Failing states, those defined by the Failed States Index as “vulnerable to collapse” are understandably more sensitive to issues of state sovereignty than others may be. These states may act in a manner such that the international community continues to perceive them as being capable of projecting their power both domestically and abroad. In fact, the Failed States Index the definition of a failed state is one in which the state has lost physical control of its territory[7].
Using that definition in the context of piracy, one can easily see why states like Indonesia might be reluctant to accept assistance from foreign powers in dealing with the domestic components of piracy. Using the Malacca Straits and the Trilateral Coordinated Patrol as an example, one could likely have predicted the reluctance to accept foreign assistance by simply looking at the failed states index. Indonesia has a “failure” index score of 83.1 while Malaysia scored a 69.2. Both of these states fail solidly into the “warning” category and both are resistant to taking on a great deal of direct foreign assistance in fighting piracy in their littoral waters. Contrast that with Singapore, a state that has been more willing to accept such assistance. Singapore scores a 160 on the Index, which places it almost in the “sustainable” category[8].
Adam Young also concludes that weak states often exacerbate conditions that may lead to piracy. According to Young, “ these problems are in part created, and exacerbated, by weak state control of political hegemony, i.e. the means of a state’s legitimacy: the monopolistic control over violence within defined territorial borders. Numerous gaps in this control have allowed piracy the operational space to re-emerge…[9]”
The Gulf of Aden provides ample illustration of how failing and failed states have allowed piracy to take root and flourish. Somalia is a failed state. In fact, it ranks at number one on the Failed States Index. Its governmental organs are non-existent. There is no recognized law, nor is there any means to enforce that law if it did exist. Somali pirates often claim to be members of the Somali Navy or Coast Guard enforcing fishing rights in the region. Since no actual Somali Navy or Coast Guard exists, there is no one to prevent such acts from occurring. One might suggest then that regional collective security arrangements might be beneficial in taking on the problem of piracy. An examination of the surrounding states, however, once demonstrates why collective security arrangements would fail.
Dijbouti, Somalia’s neighbor to the north, is considered a “failing” state. Yemen, the state directly across the Gulf of Aden is a “failed state.” Eritrea, the Sudan, Ethiopia – all of these states bordering either Somalia or the Gulf of Aden itself top the list of Failed States. They have little or no means of enforcing laws within their own borders, let alone attempting to work together to stem the tide of Somali pirates.
The Fall of the Soviet Union
The fall of the Soviet Union provides another illustration of the ways in which the failure of a state can have impacts on a global scale. Despite the ever-present tension between the United States and the Soviet Union, the Cold War served to establish and maintain a balance of power throughout the world. As the two countries divided the world and fought wars by proxy, the support of the two powers served to contain large-scale aggression.
Several authors cite the end of the Cold War as a factor in the rise of piracy. “The proliferation of small arms among transnational criminal syndicates since the end of the Cold War who are now able to take advantage of a huge array of sophisticated weaponry left over from past wars in Afghanistan and Cambodia as well as from the former Red Army…[10]” is just one example of the widespread impact of Russia’s fall from power.
When the Cold War ended, it created a power vacuum – a uni-polar world that is too large for one power police, but in which no other power has been able fill the void. The United States, understandably, projects its power into those places that hold the most strategic importance. To date, piracy has not been a strategic concern of the United States, but has most affected those countries that were on the fringes of the power struggle between the two superpowers.”