Slashdot Mirror
2012 Olympics Security to be Chosen by Sponsorship
denebian devil writes "In an Editorial/Blog at ITPRO, Davey Winder writes of a keynote speech at Infosecurity Europe by Member of Parliament Derek Wyatt. In this speech, which was about the IT security demands of running the 2012 London Olympics, Derek Wyatt MP dropped the bombshell that IT Security at the Olympics will hinge not on which companies show themselves to be the best in their field or to have the technology that best meets the needs of the Olympics, but rather on whether or not the companies were a 'major sponsor' of the Olympics. So who has bought their way into being the security experts of choice, and with whom our security and that of the visiting millions will rest? Visa."
Who will win the Pyrite medal?
liqbase
I look forward to seeing guards dressed as Ronald McDonald and Mayor McCheese handing out the medals.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
Business goes to those who spend the most money. It is not based on ability. Why? Because there is no accountability on either end of the process. Unless a company is threatened with the possibility of personal punishment for corporate stupidity then there are only rewards for this kind of system. If a business suffers or fails due to this kind of dumbness those responsible will just get a job somewhere else and leave the mess to someone else.
Well, in an attempt to NOT be cynical...at least Visa would have plenty of experience on the topic. Just because they are a huge, near-monopolistic entity doesn't mean they would be inept at choosing security. Granted, it's a pretty lame way to choose, but you have to admit, if anyone has experience on the subject...
;)
We always hear about the big hacks, we don't hear about the countless failed attempts though. Give credit where credit is due. (and make sure it's Visa©, as it's everywhere you want to be!)
Karma: Chameleon (mostly due to the fact that you come and go).
This should surprise nobody, as the olympics themselves are typically given to the city that spends the most $$ and bribes the most IOC officials.
This impacts none of you nerds. Everyone here has asthma.
The British Government makes a shady tech sourcing decision?
There have already been a bunch - for example, Accenture acts as a 'Premium Partner' supporting the London bid then lands a contract for the back office systems.
...brought to you by Nissan... VISA... JP Morgan Chase... Al Qaeada...
GetOuttaMySpace - The Anti-Social Network
Visa are of course an extremely qualified company to look after the IT security of the games however. Regardless of anything else they would be amongst the top couple of contenders anyway.
Zonk, your persistent use of misleading headlines to stir up the posters is unprofessional. This is only the latest in a long string.
Your headline says "2012 Olympics Security to be Chosen by Sponsorship" and with security such an issue of course the reader will at first believe that it is PHYSICAL security in question.
You know damn well this is not the case. I am just one of the many who want you to start showing a little class and write headlines that accurately reflect the story, not the inflammatory fiction that you would prefer.
This is a technology site and this is a technology story. To fancy that it is anything else is an extravagance on your part, unprofessional and in the end, juvenile.
The policy is not completely loony. The biggest sponsors have the most to lose monetarily from a serious problem. The problem is that when corporations get too big, they seem no longer capable of acting rationally in their own financial best interest (e.g. Sony, Microsoft long term), so the profit motive loses effectiveness.
I hope there's going to be some funny messages popping up on the screens on live TV.
You couldn't buy that kind of comedy...Oh, wait; nevermind.
Have you checked what industry visa is in ? Obviously they know a thing or two about both physical and electronic security.
That they succeeded in the banking business obviously means they know to strike a good balance between security and costs. And that's exactly what the olympics is looking for.
It's just business kids, get over it.
Work smarter, not harder.
No its not, its Corruption.
Corporations are an affront to the free market. Governments have allowed rich people to create legal fiction to protect themselves if there business were to do something questionable. Laws allowing people to incorporate and receive such special protection are wrong and not part of pure Capitalism.
What if something does happen.. So you think the "security company" will be head accountable for providing poor security? Unlikely.. maybe the CEO will retire with a large payout.. err.. I mean "step down"
Bringing liberty to the masses. - http://freetalklive.com/
Modern Olympics are a distant image from the virtuous competition they once were, commercialization has saturated any space it had for admiration. To the athletes kudos for enduring this, to the management shame on their lack of ethics.
Ticket for Olympics for 2012 £1500. Over priced food £200 for a hot dog. Getting nuked in the arena because there isnt any security .. PRICELESS :)
Evaluating security products effectively can be very difficult and expensive. I have no problem with them doing this by sponsorship. But they shouldn't just hand over technical security to whoever happens to be the biggest advertising sponsor, even if it's McDonalds or Microsoft or someone else who doesn't know anything about it. They should solicit bids for a security sponsor. That is, companies place bids separately to run the security services for the Olympics. These bids could be positive (they pay the Olympics) or negative (how much the Olympics has to pay them), along with a proposal explaining what they will do to keep things secure and their experience in the field, etc. They also get a certain amount of advertising on things, "Olympic IT Security Provided by Whoever." If the ads say "Olympic Security Provided by Symantec," and the headlines are "Olympic Security in Shambles; website defaced, credit card numbers stolen, official Olympic records changed," this isn't so good for the company. Realizing this potential ahead of time, in placing bids, security companies will have a very strong incentive to submit competent proposals.
Visa isn't tied in so much in this way, because their bijillion ads won't specify that they're handling security. Also, if they got this by favoritism based on advertising sponsorship, and not based on competitive bids, then the Olympics is probably paying them too much for what they're getting.
Can anyone tell me how to set my sig on Slashdot?
I, for one, get Slashdot stories via an RSS live bookmark on Firefox, and I don't know that the headline refers to a story at it.slashdot.org - I have to agree that Zonk's headline is extremely misleading, as when I see "Olympics" and "security" I immediately assume the headline refers to physical security.
I've learned that they're worthless, so I don't read AC comments anymore.
the past few decades have demonstrated empirically that huge corporations seem to do crummily at the whole security thing
It's also show that government beauracracies do just as poorly or even worse. So what is one to do? At least the corporations seem to waste a little bit less money doing security poorly.
Visa will be the general contractor. They'll do what they know how to do and farm out the rest.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
A decade ago, Mastercard came up with the Secure Electronic Transaction (SET) protocol. This protocol cryptographically ensured the security of credit card data, and was designed to be implemented in hardware at the retailers. Each one of those PIN pads is capable of participating in the SET protocol.
Visa killed it, because it rendered them irrelevant.
Visa itself isn't a credit lender. Visa is a commercialized industry group, very similar to the RIAA, providing a common badge to paste on the front of thousands of banks, and a common mode of operation for those banks. When you get a Visa card, it looks and acts like any credit card from any of the member banks. That's important because you (and the merchants you shop at) trust that if your card has a Visa logo that it will be honored. Back in the late 70s, that was vitally important because most credit commerce was conducted off-line. But now that we have ubiquitous electronic networks and everyone authorizes credit cards before accepting them, that logo means almost nothing. Now, it's a question of "does the merchant trust that they'll get paid?" The Visa logo lets the cashier know that his store does (or does not) trust the bank on the other end of the transaction. It assures the merchant that yes, this Visa member bank will pay them. But with a fully online transaction, the payment could happen automatically and securely. The merchant wouldn't care where the card came from, since the authorization went directly to the customer's bank, and their bank transferred their money instantly before the customer even walked out the door. There would be no need for intermediaries to skim their transaction fees for operating a special bank-only network, as the secured transactions themselves could take place over any public network.
This would have killed Visa. Instead, they swept SET under the rug and we've been dealing with phony cards and ID theft ever since. Now, they have a program called PCI-CISP, and it's used by Visa to deflect the blame to the merchants for leaking stolen data.
John
Apparently you've never employed anyone, or been a member of a partnership. Employees and partners aren't slaves or children, and their boss can't control all their actions. Therefore their boss should not be held accountable for all their actions.
Let's say Joe from IT uses his access to the business systems to get the backup encryption key and then steals one of the archived DB backup tapes. When he gets home he extracts a list of credit card numbers and sells or uses them. In this scenario the business policy provided reasonable protection of the credit card numbers -- the business systems were secured from general access and the tapes were encrypted. But Joe used the access he was necessarily granted to do his job to violate the trust of his employer and steal credit card numbers. Why should the CEO be personally liable?
Or for a small-business example try this one: you and your partner start a business. You hire skilled and reliable workers, you do good work, and your customers love you. Everything is going great and you land a big contract. Then your partner takes all of your liquid assets including the contract payment and skips town. Your business now has no cash to complete the contract or issue a refund, and you didn't do anything wrong, other than trust your partner -- should you lose your home because your business partner turned out to be a thief?
There are scenarios where the directors or owners should be held accountable; any time that the management of a company makes decisions that hurt people though direct action or negligence they should be held accountable. And contrary to your apparent belief it is possible to sue the directors and owners of a company personally in any case where they were actually at fault. It's just not possible to sue them personally in cases where they were not at fault, and there are socially valid reasons for making that distinction.