November | 2009 | Branden R. Williams, Business Security Specialist

The Gobble-Gobble of Public Networks standard

Here in the US we celebrate and give thanks for the harvest on the fourth Thursday of November, one month after our Canadian brethren did. Does security stop just because most companies in the US are closed? Nope, in fact, I’d like to give a shout out to all of you folks taking the overtime pay to spend time babysitting your networks. For you, I am thankful. The PCI Europe meeting has been the topic of several blog posts recently, and here’s yet another one inspired by the Q/A session at that meeting. The Technical Working Group (TWG) must cringe when the definition of public networks is asked in a crowd. I believe that this was one of those phrases ...

Multi-Function Service Providers, What To Do? standard

Service providers have dealt with compliance-driven information security mandates for much longer than merchant’s have. The catalyst for Visa’s CISP program was reportedly service providers, but enforcement ultimately expanded to all stakeholders. Regardless of its origins, a certain class of service provider has significant challenges complying with these requirements without shuttering portions of their business. Let’s say that a financial service provider is processing credit card transactions as an acqurier, as well as doing issuer processing for other third-party banks. How can the business comply with PCI if they also must store prohibited data in order to process on behalf of their issuer customers? That, my friends, is one of the big questions in the industry today. Attendees from both ...

E2E Encryption Reduces Probability, Not Eliminates Liability standard

Ahh, back to thinking about Prague. I can almost taste the goulash! End to End Encryption (E2EE) is widely discussed, but its effects are largely misunderstood by merchants looking for relief from the burdens of complying with PCI or government rules and regulations. Merchants have approached me asking if implementing E2EE will eliminate their liability and PCI responsibility. This exact question was asked in Prague during the Q&A session. The first issue here is E2EE is not likely a reality we will see anytime soon. Remember the ends we are dealing with here. End the first is the device reading the payment instrument, and the other end is the issuing bank (or issuing processor) that ultimately approves the transaction. All ...

To New Beginnings standard

Yep, it’s true. Today is my last day at AT&T/VeriSign where I’ve absolutely enjoyed the last six years of my career. I started thinking back to the last job I left. It was an internet service provider that was local to Dallas (long since gone belly up and litigated to pieces). It was my second job while building one of those small, two man dot-com start-ups in the mid 1990s. I left the job in 1998 when we sold our startup. That’s just over eleven years ago! I’ve been with Guardent/VeriSign/AT&T for six years. Prior to that I was with the investment company that acquired our little startup in 1998 until management decided to unwind it. Things are moving fast. ...

More Fun with Hashed PANs standard

Hashed PANs are a double edged sword. Hashes seem to be coming up quite a bit lately, and in fact there was a question about hashed PANs at the PCI Europe meeting. Luther Martin at Voltage discusses one of the two main issues with hashing, and that is the ability to create rainbow tables whereby you can easily take a known hash value and back your way to the input used to create it. Granted, one of the issues that exacerbates this for cardholder data is the limited keyspace in which card numbers are valid. Remember they all start with published six digit BINs, and any number must pass a Luhn check. But, before we dance on hashing’s grave, let’s ...

Herding Cats November: got sprintf()? standard

Ahh, everyone loves some good programming humor, right? RIGHT?!? Yeah, that’s what I thought. This month I talk about one of the hardest tech jobs out there… the Application Developer. I used to be one, and I remember the stress of getting projects completed on time, under budget, and with minimal bugs. It’s a thankless job. So go check out this month’s edition of Herding Cats here! Possibly Related Posts: Selective Domain Filtering with Postfix and a SPAM Filtering Service Preventing Account Takeover, Enable MFA! Proofpoint Patches URL Sandbox Bypass Bug Improve Outbound Email with SPF, DKIM, and DMARC Life after G-Suite/Postini

Too Much Process, the Corporate Lobotomy standard

Process is a good thing. Some corporate citizens might disagree with that basic statement based on conversations like the following: “You mean I have to go to some website to enter a request for paper clips, and then someone in another office can just reject it because they want to?” Sometimes it doesn’t work. When you are in situations like this, remember this little saying from a very wise man: “Don’t confuse logic with the process.” Process in other examples can be a really good thing. Consider the actions you might take to promote code from a test or Q/A environment into production. The steps you take to do this should be the same every time, and any deviation from ...

October 2009 Roundup standard

Taking a hint from Anton Chuvakin’s blog, I thought I’d start posting the five most popular posts from the previous month. If you have not had a chance to read everything here, give these five a try! Here are the five most popular posts from last month: MasterCard/Visa Remove Reciprocity. This post details changes made on payment brand websites that appear to remove level reciprocity on merchants. Regardless of your level, most acquirers (or acquiring functions of payment brands) will accept a higher level of validation. You should not be forced to complete a ROC and SAQ, submitting only a ROC should suffice. The Problem with Logging. Which kind of logging are you guilty of doing most? Over-logging? Under-Logging? Check ...

Will PCI Mandate the Use of Data Discovery Tools? standard

The PCI Europe Community meeting was set in the beautiful Marriott in Old Town Prague last week, and even though there were fewer attendees than the meeting in Vegas, there was no shortness of intensity and well researched questions. One individual asked about the use of Data Discovery tools as a mandate to assist in the scoping of PCI assessments. Imagine as a QSA walking into a customer, running a tool, and knowing EXACTLY the scope of the PCI assessment you need to perform! There would be little chance that you under- or over-scoped it, and all those little nooks and crannies that scare the bejeebus out of a QSA would be documented right there for review. If you are ...

Monthly ArchivesNovember 2009