Chris Mark in Jan 2013 TransactionWorld: “Only Certainies are Death, Taxes, and PCI DSS.” January 2, 2013
Posted by Chris Mark in Uncategorized.Tags: Chris Mark, data breach, Heather Mark, InfoSec, mastercard, PCI DSS, security, transactionworld, TSYS, visa
add a comment
Chris Mark (this guy with two thumbs) is in the January 2013 edition of TransactionWorld Magazine. You can read my article titled: “In 2013 the only certainties are Death, Taxes, and the PCI DSS” in which I opine about the need for PCI DSS and other security standards as we enter 2013. The bio on the article is not accurate and still references an old position I had at ProPay. That being said, ProPay is a great company for which I was fortunate and proud to have worked, a company at which my illustrious wife, Dr. Heather Mark still works, and a company who deserve a big Congrats for being acquired by TSYS!..all in all…no harm, no foul.
“Why does the FBI have your UDID (and 12.4 million more)?” FBI Laptop Hacked…1 million Apple IDS posted online September 4, 2012
Posted by Chris Mark in cyberespionage, cybersecurity.Tags: anonymous, Apple, Christopher Stangl, Cyber Action Team, data breach, fbi, Hacked, mark consulting group, UDID
add a comment
*UPDATE* It was reported yesterday that the FBI laptop was not, in fact, the source of UUIDs that were hacked. A company called Blue Toad revealed that it was the source of the stolen ids. It’s not clear how the data was stolen from Blue Toad or what, if any relationship exists between the company and the laptop that was first identified as the source of the breach.***
According to NBC News, hackers associated with the anti-government group AntiSec have hacked an FBI Agent’s laptop and posted over 1 million Apple Unique Device Identification Number or UDIDs online. The Apple UDID is used by Apple to determine what applications are running and to lock down the phones, IPads and computers from other applications. Alone, they do not represent personally identifiable information but However, New Zealand-based security researcher Aldo Cortesi has shown that thanks to disregard of Apple’s security guidelines by iOS game and app developers, it’s possible to determine a user’s identity through an UDID alone. According to the story:
“The Pastebin post claims that the UDIDs were stolen thanks to an Anonymous hack into the laptop of FBI agent Christopher Stangl, a member of a New York-based cybercrime task force. “During the second week of March 2012, a Dell Vostro notebook, used by Supervisor Special Agent Christopher K. Stangl from FBI Regional Cyber Action Team and New York FBI Office Evidence Response Team was breached using the AtomicReferenceArray vulnerability on Java,” the posting states. “During the shell session some files were downloaded from his Desktop folder one of them with the name of ‘NCFTA_iOS_devices_intel.csv’ turned to be a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zipcodes, cellphone numbers, addresses, etc. the personal details fields referring to people appears many times empty leaving the whole list incompleted on many parts.”
Why the FBI has such a list of over 12 million UDIDs is an interesting question. Why the list would be on a laptop is another interesting question. To check whether your iPhone, iPad or iPod Touch’s UDID might be among those affected, a Unix developer based in Florida has already posted a tool: http://kimosabe.net/test.html
“Here I (we) go Again…”; GlobalCerts.net hacked August 27, 2012
Posted by Chris Mark in cybersecurity.Tags: anonymous, cyber war news, data breach, globalcert.net, hack, mark consulting group, PCI DSS, security
add a comment
On this lovely Monday morning on the opening week of College Football (WAR EAGLE!)…I open with some classic Whitesnake and their awesome song from 1987: “Here I go Again”. It seemed appropriate since here ‘we’ go again with another hack and data compromise. According to Cyber War News, GlobalCert.net was hacked and their data posted to Pastebin..according to the report, GlobalCert.net’s web database was hacked and over 1000 clients’ data posted online by Anonymous. GlobalCert.net’s website says the following about their website:
“GlobalCerts provides a comprehensive solution that meets a full range of secure messaging needs—including an automatic, transparent, inter-organizational secure messaging product, the SecureMail Gateway. GlobalCerts also offers a trusted, scalable, user friendly solution to overcome the hurdle obstructing many organizations from deploying a standards-based, secure messaging solution. SecureTier is a hands-off global, certificate management solution for key creation, discovery, and revocation. No other key distribution and discovery system is as effortless and efficient as GlobalCerts’ solution.”
Seems that GlobalCert.net should practice what they preach 😉
“You Can’t Unring That Bell!” – What is a”Data Breach” and When Should I Notify? August 21, 2012
Posted by Chris Mark in cybersecurity, Data Breach.Tags: cybercrime, cybersecurity, data breach, FISMA, HIPAA, HITECH, NPI, PCI DSS, PHI, PII, privacy, risk management, state breach notification
add a comment
There are currently over 45 state breach notification laws, several data protection laws, and numerous regulations including PCI DSS, HIPAA/HITECH, FISMA, and more. I frequently find myself working with companies on data breach notification plans. One of the more interesting (and heated) discussions comes when I ask them to define a “data breach” or “data compromise”. More interesting is when I ask them to define a “suspected data breach”. Visa’ rules state that “suspected” breaches must be reported within 24 hours of identification or there could be penalties. Consider the following example. You, as CSO, are informed of a malicious software outbreak in the customer service department. Does this require notification under the state breach notification laws, or relevant regulatory regimes? Maybe, maybe not. It is dependent upon a number of factors including access to data, data protections (ie. encryption), segmentation, the various laws etc. In short, it is not easy to decipher yet it is critical to be as accurate as possible.
Understanding what is, and what is NOT, a data breach or data compromise is the first step in defining your company’s data breach notification plan. The reason it is so critical is in the titled of this article. Once you notify that your company has been ‘breached’ you cannot ‘unring that bell’. The genie is out of the proverbial bottle and things start moving quickly. Most company’s would absolutely hate to make an announcement only to find that, while they may have experienced a security incident, it did not impact sensitive data (PII, CHD, NPI, PHI, etc.). It is important that you work with your compliance group, legal (don’t forget legal!), and the infosec & risk department to ensure you have a solid understanding of when, and under what conditions your company is required to notify of a breach or suspected breach. Here are some basic definitions to use as a starting point. (check with your legal council and don’t simply use these…there..that should protect me!;)
Security Incident/Event – Any event that compromises the availability, accessibility, or integrity of any asset. This includes systems, personnel, applications, services, etc.
Data Breach – Any exposure of or unauthorized access of sensitive and/or protected data to include PHI, PII, CHD, and NPI.
Suspected Data Breach– In the absence of direct evidence (identified fraud, or misuse of data, for example), any Security Incident in which it can be reasonable assumed that sensitive and/or protected data was exposed or accessed without authorization.
Remember, some state breach notification laws do not consider a breach of encrypted data as a trigger for notification…others do 😉 If you need help unraveling these issues (insert shameless marketing plug)…contact Mark Consulting Group…www.MarkConsultingGroup.com
graphic by Hippacartoons.com
“Gauss What!?” – Another CyberWeapon Discovered August 14, 2012
Posted by Chris Mark in cyberespionage, Risk & Risk Management, terrorism.Tags: cyber espionage, cybersecurity, data breach, Flame, Gauss, information security, Kaspersky, mark consulting group, Stuxnet
add a comment
According to Kaspersky labs, yet another cyberweapon was discovered last week. On August 9, 2012 Kaspersky labs released a press release stating that they had identified another cyber-weapon dubbed Gauss. According to the press release:
“…‘Gauss’, a new cyber-threat targeting users in the Middle East. Gauss is a complex, nation-state sponsored cyber-espionage toolkit designed to steal sensitive data, with a specific focus on browser passwords, online banking account credentials, cookies, and specific configurations of infected machines. The online banking Trojan functionality found in Gauss is a unique characteristic that was not found in any previously known cyber-weapons.” (more…)
Global Security, Privacy, & Risk Management 