Branden R. Williams, Business Security Specialist

Apple Pay is Here, First Notes standard

12:01 hits and I hit my Software Update menu item to see if I can snag me some Apple Pay, and BAM! There it is! 20 minutes later, I am ready to go with iOS 8.1. Here are a few notes for those of you who may be using it as well. Apple Pay is a part of Passbook, and acts like any other Passbook integration. You can open Passbook and add ONE card, but any additional cards must be added under Settings -> Passbook & Apple Pay. For each card that is enrolled, you may be asked to validate your identity. Make sure that your banks have current email addresses and phone numbers for you. They will send you ...

Facelift Friday! standard

For those of you who have not noticed yet, the website has gotten a much needed update! For those of you who have been around here for a while, you will remember that the last time I did something was in 2009, right before the 2nd edition of the book published (4th edition coming soon!). Quite a bit has happened since then, including new design styles and ways to present information. I contacted Spellbrand to help put a fresh look on things! All of the old information is still here, it’s just presented a bit differently. You will also notice that I will be updating my Herding Cats column as well as I got out of habit of doing this ...

Enable 2-Factor Everywhere standard

Dropbox is the latest victim to announce that a third party (Snapchat was last week) integration caused a ton of their usernames and passwords to be leaked on Pastebin. At this point, most of our super-useful cloud services (Evernote, Twitter, Facebook, Google, and Dropbox to name a few) all have the ability to turn on some kind of stepped-up authentication. Some of these use Google Authenticator, which couldn’t be any easier to use than it already is (probably). So after you go change your Dropbox password (to something unique, not used on any other website), take a few moments to step up your authentication with 2-factor authentication. It will only take you a few minutes, and it will provide much ...

Incentives in PCI DSS standard

ETA’s Transaction Trends publication recently featured an article by Darrel Anderson entitled Why PCI Compliance Isn’t Working. In it, he describes one of the problems that we’ve been exploring here over the last month or so—incentive structures for PCI DSS. At the ETA Strategic Leadership Forum, the CEO of a prominent payments company echoed this sentiment by suggesting that his peers in the industry should be invested in taking the bite out of processing payments. Darrel touches on this in his article when he discusses the complexity of PCI DSS and how merchants struggle with it. His first carrot is to make this process easy. But we shouldn’t be focusing on making PCI easier, we should be focusing on making ...

ETA Strategic Leadership Forum standard

It’s that time of year again, and several of us are headed out to this fantastic event put on by ETA. Look me up when you are there so we can chat about some of the interesting events over the last few months. Some of those include: POS Malware Scoping Challenges with PCI DSS 3.0 Apple Pay (and P2PE) Shellshock Side channel attacks on PINs Looking forward to discussing the future of payments with some of the most influential people in the industry!

The Right Way to Present your Security Initiative standard

Going through my RSS the other day, I found this blog post on HBR that everyone in our field should bookmark for future reference. It’s entitled, The Right Way to Present your Business Case, by Carolyn O’Hara. As I was reflecting on the successful (and not so successful) pitches in my career, I thought that this type of message also works perfectly for information security. We have all had that moment in our careers where we knew something needed to be done, but we struggled to communicate it effectively. I distinctly remember a conversation early in my career about adding a security product to a company I worked for and the CEO said, “Until Amazon gets hacked, nobody is going ...

September 2014 Roundup standard

The Orlando community meeting came and went, DerbyCon came and went, and we saw a security vulnerability that rivals Heartbleed . I hope this sets us up for a great discussion in a couple of weeks at the PCI Community Meeting in Orlando! Here’s what you folks liked the most last month: The Only Customer Service Script You Will Ever Need. The economy is humming along quite nicely. How do we know? Because people are getting poor customer service and reading posts like this one. Is customer service is less important now that customers are easiser to come by? Check out this diversion from security that will make you think about how you interact with your customers. Is PCI DSS ...

30th of September, 2014
In: Consumer Security, Enterprise Security
2
0

Shellshock and the Cyber Safety Program standard

I recently had a conversation with Josh Corman of IAmTheCavalry where he shared with me his open letter to the automotive industry. Entitled, the Five Star Automotive Safety Program, it outlines five specific areas that affect information security, and thus will affect the safety of humans that rely on those systems. The five areas are: Safety by Design Third-Party Collaboration Evidence Capture Security Updates Segmentation & Isolation When Josh and I first chatted, I was wary of number 4. Not the fact that security updates are needed, but that there must be a mechanism by which updates can be automatically deployed (not by taking a car to the repair shop). Could someone create a cyber-zombie army by taking over an ...

SSL Issues with this Blog? standard

Due to Google’s policy change that all certificates must be signed with a minimum of SHA256, I recently replaced the cert on this site. Some of you have let me know that SSL errors were popping up. One was due to a missed “https” on the MailChimp signup form, the other was due to Symantec (VeriSign)’s new root cert that is also signed using SHA256. If you are currently using a certificate on your SSL site that is signed using the SHA-1 algorithm, you should consider replacing that cert soon. Chrome will soon be configured to warn users going to those sites about the weak signature. Enterprise customers, this is going to be as painful as Heartbleed if you had ...

23rd of September, 2014
In: Consumer Security, Enterprise Security, PCI
0
7

Apple Pay is Not P2PE, and Does Not Replace PCI Compliance standard

Apple Pay’s announcement two weeks ago caused a flurry of activity—some of it right here on this blog. I had a chance to catch up with someone who is very close to the design of Apple Pay. I was able to get a few questions answered and I wanted to share those answers here with you all. Apple Pay’s NFC uses EMV. EMV is a standard which was implemented in both the chip and contactless variants for payments. It is effectively the first wide-scale system that uses the EMV Token standard released this year. Apple Pay is software that uses the NFC radio built into the iPhone 6/6+. Why did I make this distinction? Each technology (for example, PayWave and ...