Charts ‘n Graphs

Posted on March 13, 2007 by dutcherstiles

From Pogo, this article from Physorg on the classic Evil Hacker v. Evil Suit dilemma. From the article:

If Phil Howard’s calculations prove true, by year’s end the 2 billionth personal record – some American’s social-security or credit-card number, academic grades or medical history – will become compromised, and it’s corporate America, not rogue hackers, who are primarily to blame. By his reckoning, electronic records in the United States are bleeding at the rate of 6 million a month in 2007, up some 200,000 a month from last year.

Goodness. This article seems to do more damage than good in increasing awareness of the privacy issue. The key bit of data that seems to be missing is the damage. More from the article:

Malicious intrusions by hackers make up a minority (31 percent) of 550 confirmed incidents between 1980 and 2006; 60 percent were attributable to organizational mismanagement such as missing or stolen hardware; the balance of 9 percent was due to unspecified breaches

So, how many fraudulent charges were made, fake IDs manufactured or reputations horribly disfigured by each category? The author of the study adds:

“And the surprising part is how much of those violations are organizationally prompted – they’re not about lone wolf hackers doing their thing with malicious intent.”

So, would you rather Big Nameless Credit Card Company notify you:

A. that your name/credit card/SSN/date of birth were lost at an airport while stored on an encrypted laptop hard drive

OR

B. that Lone Wolf Hacker sniped your digits of their server (running unpatched IIS 2.0 on unpatched Win98)

Of course I can’t prove that either scenario is inherently more dangerous for the consumer. I can just shake my angry fist at the data.

Posted in Uncategorized | Tagged , , , , | Leave a comment

SSN Panic, Texas Style

Posted on March 8, 2007 by dutcherstiles


Here’s the Computerworld run-down. And here’s the Attorney General’s letter (worth reading) and the proposed bill to change the law Texas HB 2061 so as all the county clerks don’t get thrown in jail.

The AG letter says it in fourteen different ways NO, YOU CANNOT RELEASE SSNs, quoting an imperial raftload of laws, state and federal, why, and why you should even be asking the question. The clerks need to grab a big ol Sharpie and start their redactin’. Shut down your infonet tube, and stop selling your goods to some skanky information brokers from the desolate wasteland known as “Not Texas.” Good on the OAG. Shame on collective elected doofi that are trying to find them an out.
I can only take solace in knowing the traditional efficiency and effectiveness of Our Lege.

This fiasco is an example of why privacy principles rather than mere compliance is important to an organization. Even if the Ft. Bend clerks were ignorant of the law, they reflected a disregard for the citizens they are charged to serve.

Posted in Uncategorized | Tagged , , , , | Leave a comment

Learn to Play Sonic Reducer

Posted on March 8, 2007 by dutcherstiles


I was going to write about this article on Dark Reading, that includes this power-quote of insight and mind-blowitude:

“A lot of blogs now have become very big on the Internet,” noted OSC Director Douglas Naquin in an interview with The Washington Times.


…but I figured my time (and yours) would be better spent learning to play “Sonic Reducer” with Cheetah Chrome.

E flat, C sharp, and lots of feedback.

Photo of Mr. Chrome from John Santanello

Posted in Uncategorized | Tagged , , , , | Leave a comment

It’s the Crime, Not the Tool

Posted on March 6, 2007 by dutcherstiles


Tim Wilson at Dark Reading on IT Security: The New Big Brother:

“To identify potential insider threats, IT must monitor end users’ behavior by scanning email, tracking network activity, and even watching employees for “trigger” events that might cause disgruntlement. Right now, I’m working on a story about ways corporations might monitor their employees outside the workplace to determine whether their out-of-office conduct might cause data leaks.”

This is how the TSA dealt with the “insider threat” (i.e., passengers) on airplanes. Like the TSA, Mr. Wilson’s focus appears to be on the tools that commit the crime (box cutters, e-mail, 3 oz. containers of fluid, USB drives) rather than the crime itself. Schneier has harped on this non-stop since 9/11. The proposed regime of surveillance will result in myriad false positives and employees as happy as your average passenger who has to remove his shoes and toss his shampoo and nail clippers into the trash at the security checkpoint.

In addition, what qualifies your IT Security department to be skilled in identifying what is legitimate and what is suspicious? How many eyes does the CEO want looking at legitimate confidential traffic? This filtering and monitoring scheme seems to be increasing risk of exposure rather than decreasing it.

Part of the solution does not involve any IT at all. Supervisors supervise. Their job is to monitor the employee activities. Managers should insure this happens.

Another part is development of an ethical culture within the corporation, where people have a channel to report if someone is acting “hinky.” Internal and external auditors and ethics officers play an important role in an ethical environment. All the monitoring software in the world couldn’t have prevented Enron, but an internal auditor put a stop to it.

Posted in Uncategorized | Tagged , , , , , | Leave a comment

Privacy and Security Lessons from Criminal Enterprises: The Corner & PCI

Posted on March 6, 2007 by dutcherstiles


Either you have heard the stories, or encountered first hand the difficulty in convincing an organization’s leaders to take adequate precautions to insure the privacy of identity related data, and maintain the integrity, confidentiality and availability of their information assets. Privacy and security have to be marketed to management since privacy and security are “non-functional” without a “ROI.” As a last ditch effort, privacy and security can be pitched as a compliance effort; these activities must be performed to satisfy the requirements of an
independent, potentially hostile third party.

Nonetheless, criminal organizations, which by definition care not one whit about compliance, and have a vigorous appreciation of the bottom line, focus significant efforts on the privacy of personal data and the security of transactions and communications. For example the following story of touts, runners, ground stashes* and the electronic processing of credit cards.

The typical drug transaction occurs thusly:

  • Junkie finds slinger. Junkie’s selection may be based on the Slinger’s reputation, effectiveness of the Touts, past business practices or location.
  • Slinger takes order, collects cash from Junkie.
  • Slinger signals the order to a Runner.
  • Runner distributes product to Junkie, either from minimum amount on person, or collected from ground stash.
  • Junkie moves on to consume product.

So the slinger is the payment processor, and the merchant is the runner. Both will be held accountable for inventory, and separation of duties not only minimizes the compliance risk (i.e., being observed by law enforcement), but also provides an accounting control. The corner boy who put out the package knows that even if the slinger and the runner collude, the collusion will result in a wrong count at the end of the day.

So what part of this transaction is so hard for folks like TJX to understand? A couple items to consider:

  • Although the merchant may mitigate risk by gaining distance from the transaction (Verified by Visa, PayPal), the merchant is more interested in the customers than the Slinger is in the Junkies. The merchant and the processor want to keep all that secondary data and compile it, and convert it into cash. The Slinger wants only not to get burned by a counterfeit bill.
  • No one is responsible for the “count” on credit card transactions. Unlike the corner, the matching of goods, customer and payment is out of order in electronic commerce, with each party shirking responsibility for the transaction.
  • Each has to deal with impostors, though. The seller of baking soda is the “phisher” of the drug trade.

Next, yelling “5-0” as an intrusion detection mechanism.

*taken largely from Simon & Burns terrific book The Corner
or on most episodes of Simon’s The Wire.

Posted in Uncategorized | Tagged , , , , , | Leave a comment

Impacted Molars: Insurance, Banks and Godzilla

Posted on March 3, 2007 by dutcherstiles
A Risk Management & Assessment Deathmatch

Gunnar Peterson’s interpretation of Warren Buffet’s risk management.

vs.
The Bank Lawyer’s outstanding post on bank risk managers and regulators

vs.

Alex’s Godzilla pandemic risk deflation.

Posted in Uncategorized | Leave a comment

One, but he gets 3 hours credit.

Posted on March 2, 2007 by dutcherstiles


The official TAMU account of a hack into their authentication system.

The Eagle has the most entertaining coverage of Aggie Hack 07.

“We learn from our mistakes,” said Pierce Cantrell, vice president and
associate provost for information technology. “These are complicated
systems, and there is a huge learning curve. It’s a computer
cat-and-mouse game in this business, and I think we do a really good
job handling account security.”

Provost Cantrell is a member of Tom & Jerry school of threat assessment.
It’s all about cheese and butcher knives and tails in light sockets. You get some soot on your face after the mouse hands you dynamite, sure, but what can you do? Despite what Tom may say, Jerry is really doing a heckuva job.

From the trenches comes another approach:

[Executive director of computing and information services] Putnam said
he’s unsure why anyone would want to break into the university computer
system, but hackers try to test their limits and see how far they can
get into a secure system.

“You can speculate, but that’s all you can do,” he said. “It’s like why
do you climb a mountain? Because it’s there.”

Director Putnam is more of the Edmund Hilary school of threat assessment. It’s so effing ineffable why these meddling kids would want to monkey with the authentication mechanism of Aggie U, you are just spinning your wheels looking into it. To paraphrase Nigel Tufnel, some mysteries are better left unsolved.

The appropriate aggie joke is left as an exercise for the reader.

Posted in Uncategorized | Leave a comment

Privacy & Security Sing-a-long: Monster Hospital

Posted on February 28, 2007 by dutcherstiles

(Medical privacy sing-a-long with Metric)

Monster hospital, can you please release me?
You hold my hands down, I’ve been bad.
You hold my arms down, I’ve been bad.
I’ve been bad, I’ve been bad.
I fought the war but the war won’t stop for the love of god.
I fought the war but the war won

(Watch the video)

Posted in Uncategorized | Tagged , , | Leave a comment

Impacted Molars: Misguided Ninja Dudes and PCI Awareness

Posted on February 26, 2007 by dutcherstiles

MESIAL
Dark Reading continues its obsession with physical security:
Network dude rassels potential bad guy, followed by a stern warning on what a scary world it is out there, cause physical attacks hurt.
Forgive me if I’m out of line, but why would I hire a network security guy to dress up as a maintenance dude to steal a laptop out from under an executive? Especially since there are skilled investigators who could get a signed confession and all his passwords from just talking to the accused. I wouldn’t going to hire an investigator to secure my network, and I shouldn’t ask a network security guy to conduct fraud investigations. I’m not going to hire the network guy to run my HR department either.

LINGUAL
The Bank Lawyer celebrates PCI Awareness Month early, with his take on the TJX Incident. Nice run down of all the parties involved. His characterization of the consumer is incomplete:

The consumers’ concern for nuance extends only to the following extent: “I see a sturdy live oak right over yonder. Let’s get us a rope and hang him.”

The consumer is likely to be distracted by a shiny object on the way to the noose dealership, since he or she has no loss. Credit card numbers are becoming more a disposable commodity, unlike SSNs, HDL levels or Sudafed consumption. Coming this summer: Retailers v. Credit Cards v. Banks Smackdown at the Legislative Arenadome.

Photo from Henrier.

Posted in Uncategorized | Tagged , , , , | Leave a comment

Everyday Privacy and Security: The Drug Store

Posted on February 26, 2007 by dutcherstiles

After a conversation with a friend, I thought I’d cite some examples of how privacy and security impact day-to-day life. Here’s the first in the series; though I admit, dissecting the CMEA would take more effort than I have time to fully understand. My ear is still ringing and Battlestar is on in 20 minutes.

The scenario:
Last week I went to see the doctor about my tendinitis and a persistent ringing in my right ear. I rarely go to the doctor, so you must take my word that these were annoying, persistent and painful condititions, resulting in grouchiness, restlessness, nonsensicalitude and Irritable Spouse Syndrome (ISS). I was processed through the HMO machine like a burger at Jack in the Box, with a shot of cortisone in my arm and an Rx for some OTC pseudo-ephedrine.

At Walgreens, I scan the aisles for Sudafed, a rare purchase since I’m not normally an allergy sufferer. I pick up a card for the store-branded Wal-Phed and head over to the pharmacy. The pharmacist asked for my drivers license. I show it to her, figuring it was an age requirement. She asks me to take it out of my wallet. I hand it to her, and she types my information into the cash register. She asks me to sign what looks like a receipt. What for? I’m paying cash. It’s the law. It’s for the Wal-Phed. So I pay her the $3.50 or so, grab the receipt, my license and leave.

What Just Happened Here:
An ingredient in the Wal-Phed is used to manufacture bathtub methamphetamines (speed/crank). To stem this scourge, the Combat Methamphetamine Epidemic Act (CMEA: part of the USA PATRIOT Act Reauthorization of 2005) placed additional controls on retail sale of ephedrine, pseudoephedrine, and phenylpropanolamine.
Consumers have to show ID and be tracked by retailers so they get just enough to take care of their stuffy nose, but not enough to start up a meth lab. The retailers have to protect the privacy of their congested customers according to the law, thusly:

C) PRIVACY PROTECTIONS.—In order to protect the privacy of individuals who purchase scheduled listed chemical products, the Attorney General shall by regulation establish restrictions on disclosure of information in logbooks under subparagraph (A)(iii). Such regulations shall— ‘‘(i) provide for the disclosure of the information as appropriate to the Attorney General and to State and local law enforcement agencies; and ‘‘(ii) prohibit accessing, using, or sharing information in the logbooks for any purpose other than to ensure compliance with this title or to facilitate a product recall to protect public health and safety.

The Data the Walgreens Now Has On Me:
Well, my name and my Texas Drivers License information (DOB, address, glasses wearer, motorcycle rider). According to the DEA website, I could also show my passport, or, if I were under 18, my report card. They also know that I bought Wal-Phed and paid cash.

What About the Data Now?
Good question. The CMEA states that the retailer has to keep it for 2 years. There is also a raft of conflicting state laws, some requiring the logbooks to be kept electronically. The retailers’ association raises concerns regarding HIPAA, tracking consumer behavior (e.g., can Walgreens send me a coupon for Wal-Phed now?) and real-time tracking versus logbook maintenance. Ever since it went behind the counter, pseudoephedrine sales have decreased, so does it really matter anymore?

Everyday Privacy For Me?
Walgreens knows I ride a motorcycle because my ear rings.
This data for a cash transaction will be maintained for two years.
It may or may not be subject to any privacy rules, depending on when/if the DEA writes the regulation.
I may have no recourse if Walgreens decides to use the information in a way to which I haven’t consented.
I may have no recourse if Walgreens loses, misplaces, or sells the information to unsavory third parties.

Posted in Uncategorized | Tagged , , , | Leave a comment