Branden R. Williams, Business Security Specialist

Equifax is only half the problem, your SSN needs a redesign! standard

The Social Security Number in the United States is the closest thing we have to a national identification system. It’s widely used to deal with the government, open lines of credit, and serves as the unique ID for a tax payer. It’s effectively your financial and governmental digital footprint identifier from which all actions are compared. Great, right? We can use it to ensure people pay their taxes, connect bank records and large financial transactions to an identity, ferret out money laundering and illicit business, and get a personal balance sheet on anyone who has credit. Except, once that number is disclosed, it’s disclosed. Unlike a payment card number, there is no wide-scale method to reissue a social security number. Like ...

Orfei Steps Down standard

In a rather surprise announcement, admittedly from a guy who is farther and farther removed from the PCI DSS ecosystem with each passing day, The PCI Council announced that Steven Orfei is stepping down as GM. His tenure was rather brief, in comparison to Russo, but it’s a thankless job that probably gets even more thankless every passing day. I wonder who will be next to steer the ship? Possibly Related Posts: PCI DSS 4.0 Released plus BOOK DETAILS! PCI Council Loses $600K in Revenue, PO Population on the Decline Why PCI DSS 4.0 Needs to be a Complete Rewrite Equifax is only half the problem, your SSN needs a redesign! Should you be a PCI Participating Organization?

Blockchain Fun standard

Two posts in one week? What is this, 2009? I’ve always been interested in payment and commerce. Blockchain and crypto-currencies have really captured my attention lately as the business applications are many and game-changing. I just published an article on the topic in this month’s Tactics & Preparedness that reviews some of the basics for folks who are not familiar with the technology. When people talk about the future of payments, you can’t leave the topic out. It’s certainly more exciting than anything PCI DSS can throw out there! For those looking for more, check out this great literature review by Peter Bailis, Arvind Narayanan, Andrew Miller, and Song Han. Blockchain isn’t just for Bitcoin! Possibly Related Posts: pgMail 1.5 Released! Let’s ...

Should you be a PCI Participating Organization? standard

What does it cost to be a PO? As if this writing it costs US$3,750 annually (originally US$2,000), For most companies, $3,750 per year is a drop in the bucket. Originally, the big benefit of being a PO was getting involved in the shaping of the Standard when the program was launched. Big changes meant huge benefits from collaboration as firms were dramatically overhauling their technology stack to comply with PCI DSS. The Standard was new, generated lots of questions, and early adopters needed collaboration. PO Benefits Review Let’s take a look at the current benefits on the PCI Council’s website. […] the opportunity for advance review of standards and supporting materials before release, with the opportunity to provide comments directly to the ...

Did you pre-order a Plastc? You might be able to recover your money! standard

Anyone who participates in a pre-order situation like Kickstarter or IndieGoGo is playing a little bit of a game of chance with their money. The most recent example is from a company called Plastc, which I have written about here in this blog before. Unfortunately, it appears they have run out of money and vanished with $9M of pre-orders and no product to deliver. Depending on how you paid for this order, you may be able to recover the $135 to $155 you put in as a deposit. Companies like American Express stand behind their consumers and I know of one person who was able to get his deposit back. Other companies may have different policies. Regardless, I hope that ...

Is All Good News REALLY Good News? standard

Have you noticed that there has not been too much (well, really any) bad press around the PCI ecosystem lately? Perhaps everything is great! Doesn’t seem like we’ve had the same string of retail breaches that we saw in 2014 (which lead to this piece of research), even though 2016 was bad (good?) in general for cybercrime. A quick data dump from PrivacyRights.org says there are around 100 related to cards since 2016, but some appear to be duplicates (Wendy’s is reported multiple times). Of course, we found out about more problems at IHG last week. Seems like big security bloggers still talk about breaches, but we don’t see the same questions around PCI DSS that we did in 2014-2015. Individuals certified or ...

The PCI Council’s Revenue Generation Capability standard

The other day I was thinking about all the programs that the Council currently maintains and I wondered if it was possible to see how much money the Council actually brings in every year. I mean, every year seems to see more programs with more fee collection opportunities for the Council, but had anyone ever added all that up? So I got to researching. I started with the usual sources: LexisNexis, Hoovers, Dun & Bradstreet, and found very little information. Only one report by Dun & Bradstreet, who is notoriously inaccurate when dealing with privately held firms, of around $3.7M in 2016. Then I headed over to the IRS’s website to see if the Council had ever filed a form ...

More Printer Security Talk standard

If you don’t have the context, read my previous post on comparing printers to VoIP—i.e., it’s another computer on our network. Now that you are in the right mindset, look around your office and see if you see a printer sitting somewhere. It might even do copies, scanning, and faxing. Super fancy ones might even connect to WiFi networks to make things easy for interoperability. So many of them have hard drives in them for document storage, logs, configuration, and the operating system that powers the device itself. When is the last time you upgraded the operating system on that printer? Are you using a default configuration or have you locked down all the things you don’t need? Better yet, ...

That Printer is gonna GIT ya! standard

Of all of the devices we have out there on our networks, is it going to be printers, cameras, and thermostats that cause our undoing? “Wait… did you say, PRINTERS!?! Are you off your rocker, Brando?” That was one of the key warnings that came from HP, Inc. in January of this year. I was one of a dozen individuals invited to a day long summit at HP, Inc., where their product leaders and various security experts talked to us about hidden security problems in the enterprise, provided live demonstrations, a tour of the facility, and the highlight, an evening at the HP Garage in Palo Alto. Let’s take a moment and think back to the advancement of Voice over ...

More EMV Bypass Fun standard

So I’m sitting here in San Diego, which we all know is German for… never mind. As I pay for my lunch, I present my chip card and there is some kind of error. I know I entered my PIN correctly, but it immediately came back as failed. The bartender taught me a neat trick that I am sure we all need to be aware of as people capture magstripes and write them to new cards. “Oh, no problem on bypassing that. Just turn the card around and insert it, it will fail, and you can swipe!” The Verifone VX-675 terminal this place used detected that a card was inserted without a valid chip read, and immediately told me to ...