By Jack M. GermainE-Commerce Times 09/02/08 4:00 AM PT
New PCI regulations are just around the corner, and retailers dealing with credit cards will need to tighten up their standards in order to comply. For instance, your firewall performance will be reviewed more often, and you'll have to use anti-virus protection even on non-Windows platforms. Also, if you're still using WEP encryption, better get ready to chuck that and move to something better ASAP.
The Payment Card Industry (PCI) regulation changes that take affect Oct. 1 will mean some additional work by IT departments -- and some new spending.
But the PCI Data Security Standard (DSS) version 1.2 will allow the Payment Card Industry a phase-in period to meet the new rules, according to two security firms that provide compliance tools.
The PCI Data Security Standard, first adopted by the PCI Security Standards Council in 2005, contains 12 rules with several sub-sections. The council amended some of those regulations with Version 1.1 in September of 2006. The PCI DSS standards are a set of comprehensive requirements for enhancing payment account data security.
The standards were developed by the founding payment brands of the PCI Security Standards Council, including American Express (NYSE: AXP) , Discover Financial Services, JCB International, MasterCard Worldwide and Visa International, to help facilitate the broad adoption of consistent data security measures on a global basis.
In version 1.2, "there are two dozen small changes, some with fairly significant implications," Mike Loyd, chief scientist for RedSeal Systems, told the E-Commerce Times.
Mostly Clarifies
The primary purpose behind Version 1.2 is to provide clarification of the standards brought into play with the last version release. These clarifications remove the vague configurations and specify data time frames.
"Often there is a discrepancy between what you have to do and what you should do. Now the new regulations try to bring those two factors closer together to true best practices," said Loyd.
All 12 rules have clarifications, but only a few of them are real changes, according to Loyd. The most significant changes call for more auditing of the network infrastructure and how security patches are handled.
"The new version is making me trust the PCI standards more. It started as an actual deployment created by the industry for the industry. It is now very straightforward," said Amichia Shulman, CTO of Imperva.
A Growth Process
The latest rules show a good evolutionary process, noted Shulman. Others involved in providing compliance tools to vendors agree.
"The old ways didn't take into effect the priority of security. Now PCI is saying that we can take in other properties," Tom Rabaut, director of product management for RedSeal Systems, told the E-Commerce Times.
The new rules show that the PCI Council really wants to become more than a watchdog. It is becoming one of the top three motivators for compliance, he added.
"It's not just a document on a slide that nobody pays attention to," Loyd noted.
Most Significant
Version 1.2 will require networks follow firewall rules on perimeter routers. The firewall performance will now be reviewed every six months rather than quarterly, Shulman said.
Two other changes involve security settings and encryption levels. IT cannot use vendor-supplied defaults for passwords and other security parameters. Also, WEP (wired equivalent privacy) will no longer be allowed. IT must configure a stronger encryption vehicle no later than March 1.
Antivirus treatment takes on a more demanding role under the Version 1.2 regulations. Networks trafficking in cardholder information must be protected by an antivirus system regardless of the operating system used.
"Until now, antivirus was only required for Windows," Shulman said. "Now the network protections must address all known types of malware."
This change reflects a shift in computing accesses, he explained. Until about two years ago, few -- if any -- antivirus options were available for other platforms.
Checking Risks
Another key rule change focuses on system security. The existing rules require IT to apply all security patches to operating systems and application software.
The new rules allow IT to perform a risk assessment of the patches before blindly applying them. This will allow IT to determine the relative stability of the patch before it causes other problems.
"This mitigates the risk of faulty patches," Shulman said.
Change Highlights
Other tweaks in the PCI DDS require those companies that hold and work with card payment data to apply specific new security and access procedures to their networks. For instance, each worker who has access to the computer system must have a unique ID. Also, the company must test the password to ensure that is is unreadable.
Additional security will kick in regarding restricting access to card holder information. This will be accomplished by better tracking and monitoring all access to network resources and cardholder data.
"Now it will not be enough to produce an audit trail. The audit must be copied to an internal log server and must be immediately available for analysis," Shulman said.
Companies will also be required to visit off-site data storage facilities of its sensitive cardholder information at least annually.
Don't Panic
Implementation strategies for version 1.2 rules will closely resemble those for version 1.1, Shulman noted.
"There are not a lot of changes, so don't panic. Wireless networks will need changes, but IT will have a reasonable amount of time to comply. Deploying antivirus across all platforms will be a problem for some," he emphasized.
The two most troublesome areas for many companies having to meet the new PCI standards will be in the areas of wireless and network encryption, he said.
Failure Not an Option
Starting Oct. 1, the new assessment standards must be used in measuring a company's PCI compliance, Rabaut warned. Vendors with a lower priority rating for the type of customer data they handle will only need to have a security scan completed by a licensed company, such as Verisign, and complete a questionnaire for self assessment, he said.
"About 80 percent of merchants are higher priority," Loyd added.
Depending on the type of compliance failure, fines could range from US$1,000 to tens of thousands, he said.
"If a data breach occurs, the severity of the fines can be much worse. The credit card companies could stop the offending company's processing rights. It depends on the weight of the vendor," Loyd said.
zaterdag 20 september 2008
New PCI Security Standards: Lock It Down, Lock It Tight
By Jack M. GermainE-Commerce Times 09/02/08 4:00 AM PT
New PCI regulations are just around the corner, and retailers dealing with credit cards will need to tighten up their standards in order to comply. For instance, your firewall performance will be reviewed more often, and you'll have to use anti-virus protection even on non-Windows platforms. Also, if you're still using WEP encryption, better get ready to chuck that and move to something better ASAP.
The Payment Card Industry (PCI) regulation changes that take affect Oct. 1 will mean some additional work by IT departments -- and some new spending.
But the PCI Data Security Standard (DSS) version 1.2 will allow the Payment Card Industry a phase-in period to meet the new rules, according to two security firms that provide compliance tools.
The PCI Data Security Standard, first adopted by the PCI Security Standards Council in 2005, contains 12 rules with several sub-sections. The council amended some of those regulations with Version 1.1 in September of 2006. The PCI DSS standards are a set of comprehensive requirements for enhancing payment account data security.
The standards were developed by the founding payment brands of the PCI Security Standards Council, including American Express (NYSE: AXP) , Discover Financial Services, JCB International, MasterCard Worldwide and Visa International, to help facilitate the broad adoption of consistent data security measures on a global basis.
In version 1.2, "there are two dozen small changes, some with fairly significant implications," Mike Loyd, chief scientist for RedSeal Systems, told the E-Commerce Times.
//-->
Mostly Clarifies
The primary purpose behind Version 1.2 is to provide clarification of the standards brought into play with the last version release. These clarifications remove the vague configurations and specify data time frames.
"Often there is a discrepancy between what you have to do and what you should do. Now the new regulations try to bring those two factors closer together to true best practices," said Loyd.
All 12 rules have clarifications, but only a few of them are real changes, according to Loyd. The most significant changes call for more auditing of the network infrastructure and how security patches are handled.
"The new version is making me trust the PCI standards more. It started as an actual deployment created by the industry for the industry. It is now very straightforward," said Amichia Shulman, CTO of Imperva.
A Growth Process
The latest rules show a good evolutionary process, noted Shulman. Others involved in providing compliance tools to vendors agree.
"The old ways didn't take into effect the priority of security. Now PCI is saying that we can take in other properties," Tom Rabaut, director of product management for RedSeal Systems, told the E-Commerce Times.
The new rules show that the PCI Council really wants to become more than a watchdog. It is becoming one of the top three motivators for compliance, he added.
"It's not just a document on a slide that nobody pays attention to," Loyd noted.
Most Significant
Version 1.2 will require networks follow firewall rules on perimeter routers. The firewall performance will now be reviewed every six months rather than quarterly, Shulman said.
Two other changes involve security settings and encryption levels. IT cannot use vendor-supplied defaults for passwords and other security parameters. Also, WEP (wired equivalent privacy) will no longer be allowed. IT must configure a stronger encryption vehicle no later than March 1.
Antivirus treatment takes on a more demanding role under the Version 1.2 regulations. Networks trafficking in cardholder information must be protected by an antivirus system regardless of the operating system used.
"Until now, antivirus was only required for Windows," Shulman said. "Now the network protections must address all known types of malware."
This change reflects a shift in computing accesses, he explained. Until about two years ago, few -- if any -- antivirus options were available for other platforms.
Checking Risks
Another key rule change focuses on system security. The existing rules require IT to apply all security patches to operating systems and application software.
The new rules allow IT to perform a risk assessment of the patches before blindly applying them. This will allow IT to determine the relative stability of the patch before it causes other problems.
"This mitigates the risk of faulty patches," Shulman said.
Change Highlights
Other tweaks in the PCI DDS require those companies that hold and work with card payment data to apply specific new security and access procedures to their networks. For instance, each worker who has access to the computer system must have a unique ID. Also, the company must test the password to ensure that is is unreadable.
Additional security will kick in regarding restricting access to card holder information. This will be accomplished by better tracking and monitoring all access to network resources and cardholder data.
"Now it will not be enough to produce an audit trail. The audit must be copied to an internal log server and must be immediately available for analysis," Shulman said.
Companies will also be required to visit off-site data storage facilities of its sensitive cardholder information at least annually.
Don't Panic
Implementation strategies for version 1.2 rules will closely resemble those for version 1.1, Shulman noted.
"There are not a lot of changes, so don't panic. Wireless networks will need changes, but IT will have a reasonable amount of time to comply. Deploying antivirus across all platforms will be a problem for some," he emphasized.
The two most troublesome areas for many companies having to meet the new PCI standards will be in the areas of wireless and network encryption, he said.
Failure Not an Option
Starting Oct. 1, the new assessment standards must be used in measuring a company's PCI compliance, Rabaut warned. Vendors with a lower priority rating for the type of customer data they handle will only need to have a security scan completed by a licensed company, such as Verisign, and complete a questionnaire for self assessment, he said.
"About 80 percent of merchants are higher priority," Loyd added.
Depending on the type of compliance failure, fines could range from US$1,000 to tens of thousands, he said.
"If a data breach occurs, the severity of the fines can be much worse. The credit card companies could stop the offending company's processing rights. It depends on the weight of the vendor," Loyd said.
New PCI regulations are just around the corner, and retailers dealing with credit cards will need to tighten up their standards in order to comply. For instance, your firewall performance will be reviewed more often, and you'll have to use anti-virus protection even on non-Windows platforms. Also, if you're still using WEP encryption, better get ready to chuck that and move to something better ASAP.
The Payment Card Industry (PCI) regulation changes that take affect Oct. 1 will mean some additional work by IT departments -- and some new spending.
But the PCI Data Security Standard (DSS) version 1.2 will allow the Payment Card Industry a phase-in period to meet the new rules, according to two security firms that provide compliance tools.
The PCI Data Security Standard, first adopted by the PCI Security Standards Council in 2005, contains 12 rules with several sub-sections. The council amended some of those regulations with Version 1.1 in September of 2006. The PCI DSS standards are a set of comprehensive requirements for enhancing payment account data security.
The standards were developed by the founding payment brands of the PCI Security Standards Council, including American Express (NYSE: AXP) , Discover Financial Services, JCB International, MasterCard Worldwide and Visa International, to help facilitate the broad adoption of consistent data security measures on a global basis.
In version 1.2, "there are two dozen small changes, some with fairly significant implications," Mike Loyd, chief scientist for RedSeal Systems, told the E-Commerce Times.
//-->
Mostly Clarifies
The primary purpose behind Version 1.2 is to provide clarification of the standards brought into play with the last version release. These clarifications remove the vague configurations and specify data time frames.
"Often there is a discrepancy between what you have to do and what you should do. Now the new regulations try to bring those two factors closer together to true best practices," said Loyd.
All 12 rules have clarifications, but only a few of them are real changes, according to Loyd. The most significant changes call for more auditing of the network infrastructure and how security patches are handled.
"The new version is making me trust the PCI standards more. It started as an actual deployment created by the industry for the industry. It is now very straightforward," said Amichia Shulman, CTO of Imperva.
A Growth Process
The latest rules show a good evolutionary process, noted Shulman. Others involved in providing compliance tools to vendors agree.
"The old ways didn't take into effect the priority of security. Now PCI is saying that we can take in other properties," Tom Rabaut, director of product management for RedSeal Systems, told the E-Commerce Times.
The new rules show that the PCI Council really wants to become more than a watchdog. It is becoming one of the top three motivators for compliance, he added.
"It's not just a document on a slide that nobody pays attention to," Loyd noted.
Most Significant
Version 1.2 will require networks follow firewall rules on perimeter routers. The firewall performance will now be reviewed every six months rather than quarterly, Shulman said.
Two other changes involve security settings and encryption levels. IT cannot use vendor-supplied defaults for passwords and other security parameters. Also, WEP (wired equivalent privacy) will no longer be allowed. IT must configure a stronger encryption vehicle no later than March 1.
Antivirus treatment takes on a more demanding role under the Version 1.2 regulations. Networks trafficking in cardholder information must be protected by an antivirus system regardless of the operating system used.
"Until now, antivirus was only required for Windows," Shulman said. "Now the network protections must address all known types of malware."
This change reflects a shift in computing accesses, he explained. Until about two years ago, few -- if any -- antivirus options were available for other platforms.
Checking Risks
Another key rule change focuses on system security. The existing rules require IT to apply all security patches to operating systems and application software.
The new rules allow IT to perform a risk assessment of the patches before blindly applying them. This will allow IT to determine the relative stability of the patch before it causes other problems.
"This mitigates the risk of faulty patches," Shulman said.
Change Highlights
Other tweaks in the PCI DDS require those companies that hold and work with card payment data to apply specific new security and access procedures to their networks. For instance, each worker who has access to the computer system must have a unique ID. Also, the company must test the password to ensure that is is unreadable.
Additional security will kick in regarding restricting access to card holder information. This will be accomplished by better tracking and monitoring all access to network resources and cardholder data.
"Now it will not be enough to produce an audit trail. The audit must be copied to an internal log server and must be immediately available for analysis," Shulman said.
Companies will also be required to visit off-site data storage facilities of its sensitive cardholder information at least annually.
Don't Panic
Implementation strategies for version 1.2 rules will closely resemble those for version 1.1, Shulman noted.
"There are not a lot of changes, so don't panic. Wireless networks will need changes, but IT will have a reasonable amount of time to comply. Deploying antivirus across all platforms will be a problem for some," he emphasized.
The two most troublesome areas for many companies having to meet the new PCI standards will be in the areas of wireless and network encryption, he said.
Failure Not an Option
Starting Oct. 1, the new assessment standards must be used in measuring a company's PCI compliance, Rabaut warned. Vendors with a lower priority rating for the type of customer data they handle will only need to have a security scan completed by a licensed company, such as Verisign, and complete a questionnaire for self assessment, he said.
"About 80 percent of merchants are higher priority," Loyd added.
Depending on the type of compliance failure, fines could range from US$1,000 to tens of thousands, he said.
"If a data breach occurs, the severity of the fines can be much worse. The credit card companies could stop the offending company's processing rights. It depends on the weight of the vendor," Loyd said.
New PCI Security Standards: Lock It Down, Lock It Tight
By Jack M. GermainE-Commerce Times 09/02/08 4:00 AM PT
New PCI regulations are just around the corner, and retailers dealing with credit cards will need to tighten up their standards in order to comply. For instance, your firewall performance will be reviewed more often, and you'll have to use anti-virus protection even on non-Windows platforms. Also, if you're still using WEP encryption, better get ready to chuck that and move to something better ASAP.
The Payment Card Industry (PCI) regulation changes that take affect Oct. 1 will mean some additional work by IT departments -- and some new spending.
But the PCI Data Security Standard (DSS) version 1.2 will allow the Payment Card Industry a phase-in period to meet the new rules, according to two security firms that provide compliance tools.
The PCI Data Security Standard, first adopted by the PCI Security Standards Council in 2005, contains 12 rules with several sub-sections. The council amended some of those regulations with Version 1.1 in September of 2006. The PCI DSS standards are a set of comprehensive requirements for enhancing payment account data security.
The standards were developed by the founding payment brands of the PCI Security Standards Council, including American Express (NYSE: AXP) , Discover Financial Services, JCB International, MasterCard Worldwide and Visa International, to help facilitate the broad adoption of consistent data security measures on a global basis.
In version 1.2, "there are two dozen small changes, some with fairly significant implications," Mike Loyd, chief scientist for RedSeal Systems, told the E-Commerce Times.
Mostly Clarifies
The primary purpose behind Version 1.2 is to provide clarification of the standards brought into play with the last version release. These clarifications remove the vague configurations and specify data time frames.
"Often there is a discrepancy between what you have to do and what you should do. Now the new regulations try to bring those two factors closer together to true best practices," said Loyd.
All 12 rules have clarifications, but only a few of them are real changes, according to Loyd. The most significant changes call for more auditing of the network infrastructure and how security patches are handled.
"The new version is making me trust the PCI standards more. It started as an actual deployment created by the industry for the industry. It is now very straightforward," said Amichia Shulman, CTO of Imperva.
A Growth Process
The latest rules show a good evolutionary process, noted Shulman. Others involved in providing compliance tools to vendors agree.
"The old ways didn't take into effect the priority of security. Now PCI is saying that we can take in other properties," Tom Rabaut, director of product management for RedSeal Systems, told the E-Commerce Times.
The new rules show that the PCI Council really wants to become more than a watchdog. It is becoming one of the top three motivators for compliance, he added.
"It's not just a document on a slide that nobody pays attention to," Loyd noted.
Most Significant
Version 1.2 will require networks follow firewall rules on perimeter routers. The firewall performance will now be reviewed every six months rather than quarterly, Shulman said.
Two other changes involve security settings and encryption levels. IT cannot use vendor-supplied defaults for passwords and other security parameters. Also, WEP (wired equivalent privacy) will no longer be allowed. IT must configure a stronger encryption vehicle no later than March 1.
Antivirus treatment takes on a more demanding role under the Version 1.2 regulations. Networks trafficking in cardholder information must be protected by an antivirus system regardless of the operating system used.
"Until now, antivirus was only required for Windows," Shulman said. "Now the network protections must address all known types of malware."
This change reflects a shift in computing accesses, he explained. Until about two years ago, few -- if any -- antivirus options were available for other platforms.
Checking Risks
Another key rule change focuses on system security. The existing rules require IT to apply all security patches to operating systems and application software.
The new rules allow IT to perform a risk assessment of the patches before blindly applying them. This will allow IT to determine the relative stability of the patch before it causes other problems.
"This mitigates the risk of faulty patches," Shulman said.
Change Highlights
Other tweaks in the PCI DDS require those companies that hold and work with card payment data to apply specific new security and access procedures to their networks. For instance, each worker who has access to the computer system must have a unique ID. Also, the company must test the password to ensure that is is unreadable.
Additional security will kick in regarding restricting access to card holder information. This will be accomplished by better tracking and monitoring all access to network resources and cardholder data.
"Now it will not be enough to produce an audit trail. The audit must be copied to an internal log server and must be immediately available for analysis," Shulman said.
Companies will also be required to visit off-site data storage facilities of its sensitive cardholder information at least annually.
Don't Panic
Implementation strategies for version 1.2 rules will closely resemble those for version 1.1, Shulman noted.
"There are not a lot of changes, so don't panic. Wireless networks will need changes, but IT will have a reasonable amount of time to comply. Deploying antivirus across all platforms will be a problem for some," he emphasized.
The two most troublesome areas for many companies having to meet the new PCI standards will be in the areas of wireless and network encryption, he said.
Failure Not an Option
Starting Oct. 1, the new assessment standards must be used in measuring a company's PCI compliance, Rabaut warned. Vendors with a lower priority rating for the type of customer data they handle will only need to have a security scan completed by a licensed company, such as Verisign, and complete a questionnaire for self assessment, he said.
"About 80 percent of merchants are higher priority," Loyd added.
Depending on the type of compliance failure, fines could range from US$1,000 to tens of thousands, he said.
"If a data breach occurs, the severity of the fines can be much worse. The credit card companies could stop the offending company's processing rights. It depends on the weight of the vendor," Loyd said.
New PCI regulations are just around the corner, and retailers dealing with credit cards will need to tighten up their standards in order to comply. For instance, your firewall performance will be reviewed more often, and you'll have to use anti-virus protection even on non-Windows platforms. Also, if you're still using WEP encryption, better get ready to chuck that and move to something better ASAP.
The Payment Card Industry (PCI) regulation changes that take affect Oct. 1 will mean some additional work by IT departments -- and some new spending.
But the PCI Data Security Standard (DSS) version 1.2 will allow the Payment Card Industry a phase-in period to meet the new rules, according to two security firms that provide compliance tools.
The PCI Data Security Standard, first adopted by the PCI Security Standards Council in 2005, contains 12 rules with several sub-sections. The council amended some of those regulations with Version 1.1 in September of 2006. The PCI DSS standards are a set of comprehensive requirements for enhancing payment account data security.
The standards were developed by the founding payment brands of the PCI Security Standards Council, including American Express (NYSE: AXP) , Discover Financial Services, JCB International, MasterCard Worldwide and Visa International, to help facilitate the broad adoption of consistent data security measures on a global basis.
In version 1.2, "there are two dozen small changes, some with fairly significant implications," Mike Loyd, chief scientist for RedSeal Systems, told the E-Commerce Times.
Mostly Clarifies
The primary purpose behind Version 1.2 is to provide clarification of the standards brought into play with the last version release. These clarifications remove the vague configurations and specify data time frames.
"Often there is a discrepancy between what you have to do and what you should do. Now the new regulations try to bring those two factors closer together to true best practices," said Loyd.
All 12 rules have clarifications, but only a few of them are real changes, according to Loyd. The most significant changes call for more auditing of the network infrastructure and how security patches are handled.
"The new version is making me trust the PCI standards more. It started as an actual deployment created by the industry for the industry. It is now very straightforward," said Amichia Shulman, CTO of Imperva.
A Growth Process
The latest rules show a good evolutionary process, noted Shulman. Others involved in providing compliance tools to vendors agree.
"The old ways didn't take into effect the priority of security. Now PCI is saying that we can take in other properties," Tom Rabaut, director of product management for RedSeal Systems, told the E-Commerce Times.
The new rules show that the PCI Council really wants to become more than a watchdog. It is becoming one of the top three motivators for compliance, he added.
"It's not just a document on a slide that nobody pays attention to," Loyd noted.
Most Significant
Version 1.2 will require networks follow firewall rules on perimeter routers. The firewall performance will now be reviewed every six months rather than quarterly, Shulman said.
Two other changes involve security settings and encryption levels. IT cannot use vendor-supplied defaults for passwords and other security parameters. Also, WEP (wired equivalent privacy) will no longer be allowed. IT must configure a stronger encryption vehicle no later than March 1.
Antivirus treatment takes on a more demanding role under the Version 1.2 regulations. Networks trafficking in cardholder information must be protected by an antivirus system regardless of the operating system used.
"Until now, antivirus was only required for Windows," Shulman said. "Now the network protections must address all known types of malware."
This change reflects a shift in computing accesses, he explained. Until about two years ago, few -- if any -- antivirus options were available for other platforms.
Checking Risks
Another key rule change focuses on system security. The existing rules require IT to apply all security patches to operating systems and application software.
The new rules allow IT to perform a risk assessment of the patches before blindly applying them. This will allow IT to determine the relative stability of the patch before it causes other problems.
"This mitigates the risk of faulty patches," Shulman said.
Change Highlights
Other tweaks in the PCI DDS require those companies that hold and work with card payment data to apply specific new security and access procedures to their networks. For instance, each worker who has access to the computer system must have a unique ID. Also, the company must test the password to ensure that is is unreadable.
Additional security will kick in regarding restricting access to card holder information. This will be accomplished by better tracking and monitoring all access to network resources and cardholder data.
"Now it will not be enough to produce an audit trail. The audit must be copied to an internal log server and must be immediately available for analysis," Shulman said.
Companies will also be required to visit off-site data storage facilities of its sensitive cardholder information at least annually.
Don't Panic
Implementation strategies for version 1.2 rules will closely resemble those for version 1.1, Shulman noted.
"There are not a lot of changes, so don't panic. Wireless networks will need changes, but IT will have a reasonable amount of time to comply. Deploying antivirus across all platforms will be a problem for some," he emphasized.
The two most troublesome areas for many companies having to meet the new PCI standards will be in the areas of wireless and network encryption, he said.
Failure Not an Option
Starting Oct. 1, the new assessment standards must be used in measuring a company's PCI compliance, Rabaut warned. Vendors with a lower priority rating for the type of customer data they handle will only need to have a security scan completed by a licensed company, such as Verisign, and complete a questionnaire for self assessment, he said.
"About 80 percent of merchants are higher priority," Loyd added.
Depending on the type of compliance failure, fines could range from US$1,000 to tens of thousands, he said.
"If a data breach occurs, the severity of the fines can be much worse. The credit card companies could stop the offending company's processing rights. It depends on the weight of the vendor," Loyd said.
zondag 7 september 2008
Latest 'lost' laptop holds treasure-trove of unencrypted AT&T payroll data
Latest 'lost' laptop holds treasure-trove of unencrypted AT&T payroll data
Submitted by Paul McNamara on Thu, 06/05/2008 - 6:42am.
It's just another in a long line of stolen laptops ... unless you work in management at AT&T and you're worried about your social security number falling into the hands of identity thieves. Or, you're worried that your coworkers might find out how much -- or how little -- you actually earn.
While AT&T has declined to disclose the number of management employees put at risk by the May 15 theft from an employee's car, one manager who is among them tells me he knows of others located throughout every corner of AT&T's vast empire in the U.S. "I have found one individual who was not impacted," says the manager, who asked not to be named. "This is probably big, but not everyone."
"I'm very disappointed in my company," he adds. "Eight days passed before we were notified ... and it took up to another 10 days to be informed about requesting a fraud alert and to be given instructions for signing up for credit watch."
I've asked AT&T for comment. At the end of this post is a long excerpt from a Q&A the company provided to employees, who learned of the breach via an e-mail, which reads in part:
"This is to alert you to the recent theft of an AT&T employee's laptop computer that contained AT&T management compensation information, including employee names, Social Security numbers, and, in most cases, salary and bonus information. ... We deeply regret this incident. You will soon hear about additional steps we're taking to reinforce our policies to safeguard sensitive personal information and ensure strict compliance in order to avoid incidents like this in the future."
Regrets were not enough to allay the anger of this manager.
"It is pathetic that the largest telecom company in the world -- with more than 100 million customers -- doesn't encrypt basic personal information," he says.
Failure to encrypt and otherwise better protect such data is inexcusable at this point in time, agrees Kelly Todd, a staff member at attrition.org, a security site that maintains a database of data-breach incidents.
"Lack of encryption of personal data is generally troubling, especially when the data is being stored on any mobile device with a 'steal me' bulls-eye on it," says Todd. "According to part of the AT&T e-mail, 'It was not encrypted, but the laptop was password protected. AT&T is currently in the process of encrypting such systems.' Good for them, but larger companies can sometimes have tens of thousands of systems to identify, plan for, and then execute an encryption process. It seems to me that they should have been 'in the process' a year ago.
"Even more troubling is that AT&T mentions that the laptop was password protected in their letter," he adds. "It might make some people feel better, but just password protection alone is generally considered a security joke."
The AT&T manager whose data was exposed sees an even larger issue in play here.
"I receive company internal e-mails reminding me to contact our legislators about relieving the company of the burdens of regulation," he says. "What happened here shows the company isn't ready to have those burdens lifted."
Submitted by Paul McNamara on Thu, 06/05/2008 - 6:42am.
It's just another in a long line of stolen laptops ... unless you work in management at AT&T and you're worried about your social security number falling into the hands of identity thieves. Or, you're worried that your coworkers might find out how much -- or how little -- you actually earn.
While AT&T has declined to disclose the number of management employees put at risk by the May 15 theft from an employee's car, one manager who is among them tells me he knows of others located throughout every corner of AT&T's vast empire in the U.S. "I have found one individual who was not impacted," says the manager, who asked not to be named. "This is probably big, but not everyone."
"I'm very disappointed in my company," he adds. "Eight days passed before we were notified ... and it took up to another 10 days to be informed about requesting a fraud alert and to be given instructions for signing up for credit watch."
I've asked AT&T for comment. At the end of this post is a long excerpt from a Q&A the company provided to employees, who learned of the breach via an e-mail, which reads in part:
"This is to alert you to the recent theft of an AT&T employee's laptop computer that contained AT&T management compensation information, including employee names, Social Security numbers, and, in most cases, salary and bonus information. ... We deeply regret this incident. You will soon hear about additional steps we're taking to reinforce our policies to safeguard sensitive personal information and ensure strict compliance in order to avoid incidents like this in the future."
Regrets were not enough to allay the anger of this manager.
"It is pathetic that the largest telecom company in the world -- with more than 100 million customers -- doesn't encrypt basic personal information," he says.
Failure to encrypt and otherwise better protect such data is inexcusable at this point in time, agrees Kelly Todd, a staff member at attrition.org, a security site that maintains a database of data-breach incidents.
"Lack of encryption of personal data is generally troubling, especially when the data is being stored on any mobile device with a 'steal me' bulls-eye on it," says Todd. "According to part of the AT&T e-mail, 'It was not encrypted, but the laptop was password protected. AT&T is currently in the process of encrypting such systems.' Good for them, but larger companies can sometimes have tens of thousands of systems to identify, plan for, and then execute an encryption process. It seems to me that they should have been 'in the process' a year ago.
"Even more troubling is that AT&T mentions that the laptop was password protected in their letter," he adds. "It might make some people feel better, but just password protection alone is generally considered a security joke."
The AT&T manager whose data was exposed sees an even larger issue in play here.
"I receive company internal e-mails reminding me to contact our legislators about relieving the company of the burdens of regulation," he says. "What happened here shows the company isn't ready to have those burdens lifted."
AT&T Security Manager (092008)
AT&T security guru talks DoS attacks, tomorrow’s hackers
Botnets, protection of personal information pose biggest challenges, CSO Edward Amoroso says
Edward Amoroso is the chief security officer at AT&T in Florham Park, N.J., as well as a professor who has written several textbooks on information security. Amoroso spoke with Network World’s Jon Brodkin this week in Boston, where he delivered a keynote about network security during Forrester’s Security Forum.
What are your biggest security challenges at AT&T?
The biggest challenge right now is sensitive personal information being all over the place, Social Security numbers, credit card numbers. It’s an IT problem. I’m not even convinced it’s appropriate to call it a security problem, it’s just IT infrastructure has developed in a way where that stuff is all over the place. We’re encrypting the whole company. That’s a pretty heavy-handed approach to solving the problem, but that’s really the only option.
Have you lost any sensitive data?
We’ve had some laptops that have been lost just like anybody else. So we report those and move on. That’s been the extent of it, it could be worse.
You also spoke about network security and defending against botnets and denial-of-service attacks in your keynote.
That’s our second-biggest challenge. Keep in mind, we’re a service provider, so the availability threat is way more important than if we were selling software. If Microsoft.com is down for an hour, it wouldn’t be good but it’s not a stock-price-affecting problem. If our network services are down for an hour, that is a very big problem.
Will AT&T be able to successfully defend against these botnets?
We do it now. These things we see, a lot of them are aimed at us all the time. Any carrier that says ‘we’re not under attack’ is lying to you.
Last December, we saw some pretty significant increases in traffic aimed at our host. We think that somebody was aiming big denial of service attacks at our hosting DNS services. We just filter the traffic, we survive it. It’s just the normal course of business for that stuff to be lobbed at you, and you block it.
You’re an adjunct professor of computer science at the Stevens Institute of Technology. What can we expect from the next generation of computer scientists?
They’re good hackers, that’s for sure. They come in and they’ve been reading hacking magazines since they were little kids. There’s a lot of foolishness in youth so a lot of young people do design attack tools. They’re better [than previous generations]. But they’re also better as computer scientists. I would say there’s a general uplift in capability, good and bad. It keeps me sharp. They let me have it if I don’t know the answer to something.
If this new generation of computer scientists is smarter, what kind of impact will they have when they enter the workforce?
I’m in my 40s. When I was growing up technology wasn’t generally available. Young people today are growing up with technology and they speak it fluently the way you speak French in Paris.
My kids, I buy them these complex gaming systems. My son, he’ll go online and buy these hacking devices, and expanded memory and a way of bridging Wi-Fi to our video, and to his camera. There’s no manual, there’s no anything, he’s just sort of natively doing it, and it just works.
When he gets into the workforce, I don’t know if he’s going to be an engineer, a lawyer, a doctor or whatever. But whatever he’s doing he brings that capability to bear. If he goes bad and decides he wants to be a hacker then we’ve got a problem because that’s a kid who knows what he’s doing.
Botnets, protection of personal information pose biggest challenges, CSO Edward Amoroso says
Edward Amoroso is the chief security officer at AT&T in Florham Park, N.J., as well as a professor who has written several textbooks on information security. Amoroso spoke with Network World’s Jon Brodkin this week in Boston, where he delivered a keynote about network security during Forrester’s Security Forum.
What are your biggest security challenges at AT&T?
The biggest challenge right now is sensitive personal information being all over the place, Social Security numbers, credit card numbers. It’s an IT problem. I’m not even convinced it’s appropriate to call it a security problem, it’s just IT infrastructure has developed in a way where that stuff is all over the place. We’re encrypting the whole company. That’s a pretty heavy-handed approach to solving the problem, but that’s really the only option.
Have you lost any sensitive data?
We’ve had some laptops that have been lost just like anybody else. So we report those and move on. That’s been the extent of it, it could be worse.
You also spoke about network security and defending against botnets and denial-of-service attacks in your keynote.
That’s our second-biggest challenge. Keep in mind, we’re a service provider, so the availability threat is way more important than if we were selling software. If Microsoft.com is down for an hour, it wouldn’t be good but it’s not a stock-price-affecting problem. If our network services are down for an hour, that is a very big problem.
Will AT&T be able to successfully defend against these botnets?
We do it now. These things we see, a lot of them are aimed at us all the time. Any carrier that says ‘we’re not under attack’ is lying to you.
Last December, we saw some pretty significant increases in traffic aimed at our host. We think that somebody was aiming big denial of service attacks at our hosting DNS services. We just filter the traffic, we survive it. It’s just the normal course of business for that stuff to be lobbed at you, and you block it.
You’re an adjunct professor of computer science at the Stevens Institute of Technology. What can we expect from the next generation of computer scientists?
They’re good hackers, that’s for sure. They come in and they’ve been reading hacking magazines since they were little kids. There’s a lot of foolishness in youth so a lot of young people do design attack tools. They’re better [than previous generations]. But they’re also better as computer scientists. I would say there’s a general uplift in capability, good and bad. It keeps me sharp. They let me have it if I don’t know the answer to something.
If this new generation of computer scientists is smarter, what kind of impact will they have when they enter the workforce?
I’m in my 40s. When I was growing up technology wasn’t generally available. Young people today are growing up with technology and they speak it fluently the way you speak French in Paris.
My kids, I buy them these complex gaming systems. My son, he’ll go online and buy these hacking devices, and expanded memory and a way of bridging Wi-Fi to our video, and to his camera. There’s no manual, there’s no anything, he’s just sort of natively doing it, and it just works.
When he gets into the workforce, I don’t know if he’s going to be an engineer, a lawyer, a doctor or whatever. But whatever he’s doing he brings that capability to bear. If he goes bad and decides he wants to be a hacker then we’ve got a problem because that’s a kid who knows what he’s doing.
SOX turns 5 (092008)
Sarbanes-Oxley compliance has caused IT headaches for half a decade
Five years after the controversial Sarbanes-Oxley Act was enacted to prevent Enron-like scandals, the law’s financial control requirements are having myriad impacts: large companies have cleaned up their accounting, but at great cost; foreign businesses are dropping out of U.S. stock exchanges to avoid SOX requirements; and many small public companies are scrambling to meet a crucial compliance deadline in December.
Signed into law by President Bush on July 30, 2002, SOX forces public companies to prepare reliable financial statements and bring material weaknesses into public view, with mandated testing for integrity and ethical behavior, IT controls related to financial reporting, whistleblower programs, antifraud provisions and other requirements.
Five years after the controversial Sarbanes-Oxley Act was enacted to prevent Enron-like scandals, the law’s financial control requirements are having myriad impacts: large companies have cleaned up their accounting, but at great cost; foreign businesses are dropping out of U.S. stock exchanges to avoid SOX requirements; and many small public companies are scrambling to meet a crucial compliance deadline in December.
Signed into law by President Bush on July 30, 2002, SOX forces public companies to prepare reliable financial statements and bring material weaknesses into public view, with mandated testing for integrity and ethical behavior, IT controls related to financial reporting, whistleblower programs, antifraud provisions and other requirements.
Read the latest WhitePaper - Troubleshooting Remote Site Networks - Best Practices
- The cost of SOXA sampling of SOX facts, figures and projections:
- Spending on SOX compliance will surpass $32 billion by the end of 2008.
$6 billion will be spent this year alone. - July 30, 2002, is when President Bush signed Sarbanes-Oxley into law.
- Nov. 15, 2004, is when companies with more than $75 million in market capitalization were expected to comply. 4,862 companies with market caps that high have reported under SOXÕs Section 404. 1,035 of those have failed to comply at some point.
- About 7,400 companies with market caps under $75 million face a compliance deadline of Dec. 15, 2007.
SOURCES: AMR RESEARCH, AUDIT ANALYTICSClick to see: SPX timeline
Compliance has become “pretty much routine” for large companies, who have faced SOX requirements since 2004, says Bob Benoit of Lord & Benoit, which performs SOX research and helps companies comply.
Related Content
- SOX compliance made easier with pre-configured audit reports
- Software takes aim at curbing corporate fraud
- SEC extends Sarbanes-Oxley deadlines for smaller companies
- Qualcomm shares two years of SOX experience
- Getting ahead of Sarbanes-Oxley
- US border agency says it can seize laptops
- US Air Force lets Web 2.0 flourish behind walls
- ACLU files lawsuit to challenge surveillance law
- US Senate resumes debate on surveillance bill
- Senate delays vote on surveillance bill until JulyView all related articles
It hasn’t been cheap: spending on SOX compliance was $5.5 billion in 2004 and is now more than $6 billion annually, according to AMR Research.
1,035 large public companies have at some point failed to comply with SOX, out of a total of 4,862 that have reported under the law’s Section 404, Benoit says, citing figures from Audit Analytics.
Yet many individual enterprises spent far more on SOX compliance than they had to because the federal government initially failed to issue clear instructions.
“It was millions of dollars extra that was spent. This was due to people overcomplying, doing far more testing than was necessary,” says Michael Kamens, who was global network and security manager at Thermo Electron when the $2 billion company in Waltham, Mass., had to comply with SOX.
For about a year, companies thought they had to document and put controls in for every business process they have, since almost anything can impact financial statements, says John Hagerty, an analyst for AMR Research. Later it became clear that SOX only required such oversight for matters directly related to financial processes, Hagerty says.
Want to compare security products? Visit the IT Buyer's Guides now.
“The biggest pain companies reported was they felt like they were getting conflicted advice,” he says. “People didn’t want to get caught in a situation where they didn’t do enough, so they ended up doing too much.”
Advice from the Public Company Accounting Oversight Board, created by SOX and the Big Four auditing firms was excessive at best, says Kamens, who now works for auditing firm Accume Partners. Whereas today companies focus on 31 so-called key controls, in the days after SOX, public firms were testing for as many as 200 controls, he says.
“It was extremely painful for everybody. Nobody really knew how to comply,” Kamens says. “Because there was so much pressure on public companies to pass, everybody was scared and they did exactly whatever auditors told them to do. Failure was not an option.”
Some private companies have decided to comply with SOX even though they don’t have to, either because they think they might be purchased by a public company or go public themselves, or because they want better control over financial accounting.
“There are more people who realize this is just good business practice,” Hagerty says. “The whole concept of control of your financial environment is a bedrock principle of financial accounting.”
But the cost of SOX also has driven foreign businesses out of American stock exchanges. On Wednesday, BG Group, an oil and natural gas company in the United Kingdom, became the 18th non-U.S. company to quit the New York Stock Exchange since the Securities and Exchange Commision (SEC) made it easier to delist in December, the Bloomberg news service reported. The number of foreign companies traded on the NYSE has dropped 9.5% since SOX became law.
BG Group blamed its decision to leave NYSE on “U.S.-specific obligations [that] carry a cost and administrative complexity.”
Benoit doesn’t quite understand what all the fuss is about. “Internal controls have been around a long time. It’s not rocket science. It’s just a matter of doing it,” he says.
Small companies and SOX
Small public companies face just as complex a task as do larger ones, but compliance costs will be relatively higher as a percentage of a smaller company’s revenue, Hagerty says. Smaller public companies — technically those with less than $75 million of stock in the hands of public investors — have been granted numerous extensions allowing them to postpone compliance. Currently, they are scheduled to face the requirements of SOX on Dec. 15.
Benoit criticized the SEC in a Network World interview last December for not issuing specific guidelines to smaller public companies. Now he says the SEC addressed his concerns with guidance issued May 23.
A compliance project approached correctly should cost 50% to 75% less than what companies have been spending, but many businesses insist on an inefficient, bottom-up approach that audits process-level controls like expenditures, payroll and property, Benoit says.
“Accountants are kind of used to that approach, but internal control is the opposite,” he says. “It’s looking at significant items of risk, identifying those and testing those controls. … When you approach it from the risk perspective, which is what the SEC guidance has made very clear, there are definite and huge savings.”
The SEC on Wednesday adopted a new auditing standard that encourages an even less costly approach to SOX compliance.
That’s good news for smaller public companies that may find their backs against the wall come Dec. 15. Benoit says his firm has contacted about 4,000 companies and “far less than 1%” have started the process of SOX compliance.
“We’re starting to see a small population of companies come alive and start to start their process,” he says. “There’s a small window of opportunity right now. If they start working on the projects now they’ll be OK.”
Small companies face many challenges, according to research by Lord & Benoit. Among them are accounting and disclosure controls, control of treasury functions, competency and training of accountants, revenue recognition, inadequate account reconciliation, consolidations and mergers, and information technology weaknesses.
Software vendors are champing at the bit trying to sell products that automate compliance and reduce cost by taking people out of the process as much as possible. Some built new technology to meet the law’s demands while other vendors took old technologies and repackaged them as SOX compliance tools.
Even former U.S. Attorney General John Ashcroft has gotten in on the game, advising a software company called D2C Solutions that detects internal fraud and makes SOX compliance easier.
The “software [industry] has been the primary beneficiary of this automation phase,” Hagerty says.
Overheid VS verplicht DNS voor overheid (082008)
VS verplicht DNSSEC voor overheid
Het Witte Huis voert DNSSEC in, om omleiding van webverkeer te voorkomen.
Het Witte Huis voert DNSSEC in, om omleiding van webverkeer te voorkomen.
De Amerikaanse overheid neemt maatregelen tegen het DNS-gat. De regering stelt gebruik van DNSSEC verplicht voor overheidsinstanties.
Het Witte Huis legt Amerikaanse overheidsinstanties gebruik van DNS-beveiligingsmaatregelen op. Zo moeten alle overheidsorganen voortaan DNSSEC (domain name system security extensions) gebruiken voor hun internetverbindingen. Dat is een uitbreiding van internetbasisprotocol DNS die controleert of de bron van een dataverzending en de data zelf in orde is.
De regering van de Verenigde Staten zorgt er hiermee voor dat misbruik van het grote beveiligingsgat in DNS niet langer een gevaar kan zijn voor overheidsverkeer. Het in juli onthulde gat stelt kwaadwillenden in staat internetverkeer om te leiden, zonder dat reguliere beveiligingssoftware dat doorheeft. Dit betreft niet alleen webverkeer, maar ook andere toepassingen zoals mail, FTP (file transfer protocol) en zelfs het voor internetbankieren gebruikte SSL (secure socket layer).
Niet beschermd
DNSSEC is eerder al genoemd als enige oplossing voor het DNS-gat. De patches die tegelijk met het bekend maken van het lek door leveranciers beschikbaar zijn gesteld vormen slechts een lapmiddel. Misbruik van het DNS-lek is nog altijd mogelijk.
Het lek dat Kaminsky ontdekte
Domain Name System-servers vertalen domeinnamen naar ip-adressen. Er zijn twee soorten DNS-servers: authoritative en caching nameservers. Alleen het tweede type DNS-server (ook wel ‘resolving name servers' genoemd) is vatbaar voor de kwetsbaarheid die Kaminsky ontdekte. Caching nameservers zijn namelijk niet op de hoogte van alle domeinnamen op het hele internet, en sturen daarom vertaalverzoeken aan ‘autoritieve' DNS-servers. In zo'n vertaalverzoek vraagt een DNS-server naar het ip-adres dat hoort bij een bepaald website- of mailadres.
Het huidige DNS-lek maakt het voor kwaadwillenden mogelijk zich uit te geven voor een autoritieve DNS-server. Zij kunnen daardoor de cache van DNS-servers vervuilen met verkeerde ip-adressen. Die foute adressen kunnen ervoor zorgen dat mails in verkeerde handen terecht komen en dat websitebezoekers worden omgeleid naar vervalste websites. Kwaadwillenden kunnen één website 'kapen' (van bijvoorbeeld een bank of een webmailaanbieder), maar in principe ook het hele .com-domein overnemen.
Het Witte Huis voert DNSSEC in, om omleiding van webverkeer te voorkomen.
Het Witte Huis voert DNSSEC in, om omleiding van webverkeer te voorkomen.
De Amerikaanse overheid neemt maatregelen tegen het DNS-gat. De regering stelt gebruik van DNSSEC verplicht voor overheidsinstanties.
Het Witte Huis legt Amerikaanse overheidsinstanties gebruik van DNS-beveiligingsmaatregelen op. Zo moeten alle overheidsorganen voortaan DNSSEC (domain name system security extensions) gebruiken voor hun internetverbindingen. Dat is een uitbreiding van internetbasisprotocol DNS die controleert of de bron van een dataverzending en de data zelf in orde is.
De regering van de Verenigde Staten zorgt er hiermee voor dat misbruik van het grote beveiligingsgat in DNS niet langer een gevaar kan zijn voor overheidsverkeer. Het in juli onthulde gat stelt kwaadwillenden in staat internetverkeer om te leiden, zonder dat reguliere beveiligingssoftware dat doorheeft. Dit betreft niet alleen webverkeer, maar ook andere toepassingen zoals mail, FTP (file transfer protocol) en zelfs het voor internetbankieren gebruikte SSL (secure socket layer).
Niet beschermd
DNSSEC is eerder al genoemd als enige oplossing voor het DNS-gat. De patches die tegelijk met het bekend maken van het lek door leveranciers beschikbaar zijn gesteld vormen slechts een lapmiddel. Misbruik van het DNS-lek is nog altijd mogelijk.
Het lek dat Kaminsky ontdekte
Domain Name System-servers vertalen domeinnamen naar ip-adressen. Er zijn twee soorten DNS-servers: authoritative en caching nameservers. Alleen het tweede type DNS-server (ook wel ‘resolving name servers' genoemd) is vatbaar voor de kwetsbaarheid die Kaminsky ontdekte. Caching nameservers zijn namelijk niet op de hoogte van alle domeinnamen op het hele internet, en sturen daarom vertaalverzoeken aan ‘autoritieve' DNS-servers. In zo'n vertaalverzoek vraagt een DNS-server naar het ip-adres dat hoort bij een bepaald website- of mailadres.
Het huidige DNS-lek maakt het voor kwaadwillenden mogelijk zich uit te geven voor een autoritieve DNS-server. Zij kunnen daardoor de cache van DNS-servers vervuilen met verkeerde ip-adressen. Die foute adressen kunnen ervoor zorgen dat mails in verkeerde handen terecht komen en dat websitebezoekers worden omgeleid naar vervalste websites. Kwaadwillenden kunnen één website 'kapen' (van bijvoorbeeld een bank of een webmailaanbieder), maar in principe ook het hele .com-domein overnemen.
Abonneren op:
Posts (Atom)