Viewing posts from January, 2009
value-protection-and-information-security
Posted by: admin 14 years, 4 months ago
There is a very interesting article (and old one - sorry, I'm running behind) on CSO Online called Value Made Visible about how American Water's Bruce Larson has developed a security metric call Value Protection:
The basic Value Protection metric is a ratio that looks like this: Value Protection = Normal Operations Cost ($) – Event Impact ($) / Normal Operations Cost ($). In formula:
version-3-0-of-the-wikid-strong-authentication
Posted by: admin 14 years, 4 months ago
Thanks to everybody for all the hard work. I would especially like to thank the various people that have done bug-testing, submitted patches and written documentation.
vint-cerf-et-al-on-internet-security
Posted by: admin 14 years, 4 months ago
I had the pleasure to attend the recent security summit at the Georgia Tech Information Security Center (webcast is available, but only if you have quicktime and IE7 apparently, which ain't me) and getting to hear Vint Cerf and a very strong group of panelists. Here are my take-aways:
- When you sell your company for big bucks, you get to be on panels at colleges. Maybe this is because the event was held in the Chris Klaus building.
- The internet needs better, stronger authentication - and not just the user, but better Damballa a local Atlanta start-up spun out of Georgia Tech to help ISPs address the bot problem. Good luck to those guys. Seems like cool technology.
visa-adds-carrot-to-stick-for-pci-goulash
Posted by: admin 14 years, 4 months ago
This will be interesting to look back on in a year: Visa is creating a $20,000,000 bonus pool to incent their members to be PCI compliant. :
Visa's new Visa PCI Compliance Acceleration Program is designed to spur entities that are covered by PCI rules to comply in a speedy fashion, said Jennifer Fischer, a director with Visa USA. "This program is part of our larger strategy for protecting card holder data and to ensure that we are doing everything we can to protect it from compromise," she said.Why is it needed? Because:
Though nearly 18 months have passed since PCI rules went into full effect, only 36% of Tier 1 merchants and 15% of Tier 2 merchants are currently compliant with the requirements, according to Visa.I think this might be the more effective bit:
At the same time, acquiring banks that fail to ensure compliance by Sept. 30, 2007 will be assessed fines starting at $5,000 a month for each non-compliant merchant. The fines increase to $25,000 per month for each non-compliant merchant after Dec. 31, 2007. Until now, fines have only been assessed in cases where actual data breaches occurred.That will get them going!
visibility-and-pci-security
Posted by: admin 14 years, 4 months ago
I'm a fan the PCI security standard from Visa, Mastercard and American Express. It is a tight in all the right ways and loose in the right ways. It tells credit card processors and merchants explicity that they must use two-factor authentication for remote access, but nothing more. If PCI has a problem, it is that it will be too little too late to protect card holder data and stave off regulation. The structure of the credit card industry makes it tough for it to be otherwise. Will making retailers liable for credit card breaches help? I'm not sure.
Recent Posts
- WiKID 6 is released!
- Log4j CVE-2021-44228
- Questions about 2FA for AD admins
- WiKID Android tokens had their data deleted over the weekend by Google Chrome bug
- Scalability improvements in version 5.0 of the WiKID Strong Authentication server
Archive
2022
- December (1)
2021
2019
2018
2017
2016
2015
2014
- December (2)
- November (3)
- October (3)
- September (5)
- August (4)
- July (5)
- June (5)
- May (2)
- April (2)
- March (2)
- February (3)
- January (1)
2013
2012
- December (1)
- November (1)
- October (5)
- September (1)
- August (1)
- June (2)
- May (2)
- April (1)
- March (2)
- February (3)
- January (1)
2011
2010
- December (2)
- November (3)
- October (3)
- September (4)
- August (1)
- July (1)
- June (3)
- May (3)
- April (1)
- March (1)
- February (6)
- January (3)
2009
- December (4)
- November (1)
- October (3)
- September (3)
- August (2)
- July (5)
- June (6)
- May (8)
- April (7)
- March (6)
- February (4)
- January (427)
2008
- December (1)
Categories
- PCI-DSS (2)
- Two-factor authentication (3)
Tags
- wireless-cellular-mobile-devices (7)
- Two-factor authentication (10)
- Wireless, cellular, mobile devices (6)
- NPS (1)
- Phishing and Fraud (111)
- Active Directory (1)
- pam-radius (3)
- privileged access (2)
- Cloud Security (10)
- Mutual Authentication (60)
- Web Application Authentication (1)
- Authentication Attacks (99)
- pci (50)
- Security and Economics (97)
- WiKID (133)
- pam (2)
- VPN (1)
- Installation (2)
- RADIUS Server (1)
- Open Source (64)
- Tutorial (2)
- Strong Authentication (35)
- Information Security (137)
- Transaction Authentication (13)
- Miscellaneous (100)
- Linux (2)
- transaction-authentication (6)
- Two Factor Authentication (254)