Slashdot Mirror
2012 Olympics Security to be Chosen by Sponsorship
denebian devil writes "In an Editorial/Blog at ITPRO, Davey Winder writes of a keynote speech at Infosecurity Europe by Member of Parliament Derek Wyatt. In this speech, which was about the IT security demands of running the 2012 London Olympics, Derek Wyatt MP dropped the bombshell that IT Security at the Olympics will hinge not on which companies show themselves to be the best in their field or to have the technology that best meets the needs of the Olympics, but rather on whether or not the companies were a 'major sponsor' of the Olympics. So who has bought their way into being the security experts of choice, and with whom our security and that of the visiting millions will rest? Visa."
I look forward to seeing guards dressed as Ronald McDonald and Mayor McCheese handing out the medals.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
Business goes to those who spend the most money. It is not based on ability. Why? Because there is no accountability on either end of the process. Unless a company is threatened with the possibility of personal punishment for corporate stupidity then there are only rewards for this kind of system. If a business suffers or fails due to this kind of dumbness those responsible will just get a job somewhere else and leave the mess to someone else.
Well, in an attempt to NOT be cynical...at least Visa would have plenty of experience on the topic. Just because they are a huge, near-monopolistic entity doesn't mean they would be inept at choosing security. Granted, it's a pretty lame way to choose, but you have to admit, if anyone has experience on the subject...
;)
We always hear about the big hacks, we don't hear about the countless failed attempts though. Give credit where credit is due. (and make sure it's Visa©, as it's everywhere you want to be!)
Karma: Chameleon (mostly due to the fact that you come and go).
This should surprise nobody, as the olympics themselves are typically given to the city that spends the most $$ and bribes the most IOC officials.
This impacts none of you nerds. Everyone here has asthma.
...brought to you by Nissan... VISA... JP Morgan Chase... Al Qaeada...
GetOuttaMySpace - The Anti-Social Network
Zonk, your persistent use of misleading headlines to stir up the posters is unprofessional. This is only the latest in a long string.
Your headline says "2012 Olympics Security to be Chosen by Sponsorship" and with security such an issue of course the reader will at first believe that it is PHYSICAL security in question.
You know damn well this is not the case. I am just one of the many who want you to start showing a little class and write headlines that accurately reflect the story, not the inflammatory fiction that you would prefer.
This is a technology site and this is a technology story. To fancy that it is anything else is an extravagance on your part, unprofessional and in the end, juvenile.
The policy is not completely loony. The biggest sponsors have the most to lose monetarily from a serious problem. The problem is that when corporations get too big, they seem no longer capable of acting rationally in their own financial best interest (e.g. Sony, Microsoft long term), so the profit motive loses effectiveness.
I hope there's going to be some funny messages popping up on the screens on live TV.
You couldn't buy that kind of comedy...Oh, wait; nevermind.
No its not, its Corruption.
Corporations are an affront to the free market. Governments have allowed rich people to create legal fiction to protect themselves if there business were to do something questionable. Laws allowing people to incorporate and receive such special protection are wrong and not part of pure Capitalism.
What if something does happen.. So you think the "security company" will be head accountable for providing poor security? Unlikely.. maybe the CEO will retire with a large payout.. err.. I mean "step down"
Bringing liberty to the masses. - http://freetalklive.com/
Ticket for Olympics for 2012 £1500. Over priced food £200 for a hot dog. Getting nuked in the arena because there isnt any security .. PRICELESS :)
I, for one, get Slashdot stories via an RSS live bookmark on Firefox, and I don't know that the headline refers to a story at it.slashdot.org - I have to agree that Zonk's headline is extremely misleading, as when I see "Olympics" and "security" I immediately assume the headline refers to physical security.
I've learned that they're worthless, so I don't read AC comments anymore.
the past few decades have demonstrated empirically that huge corporations seem to do crummily at the whole security thing
It's also show that government beauracracies do just as poorly or even worse. So what is one to do? At least the corporations seem to waste a little bit less money doing security poorly.
A decade ago, Mastercard came up with the Secure Electronic Transaction (SET) protocol. This protocol cryptographically ensured the security of credit card data, and was designed to be implemented in hardware at the retailers. Each one of those PIN pads is capable of participating in the SET protocol.
Visa killed it, because it rendered them irrelevant.
Visa itself isn't a credit lender. Visa is a commercialized industry group, very similar to the RIAA, providing a common badge to paste on the front of thousands of banks, and a common mode of operation for those banks. When you get a Visa card, it looks and acts like any credit card from any of the member banks. That's important because you (and the merchants you shop at) trust that if your card has a Visa logo that it will be honored. Back in the late 70s, that was vitally important because most credit commerce was conducted off-line. But now that we have ubiquitous electronic networks and everyone authorizes credit cards before accepting them, that logo means almost nothing. Now, it's a question of "does the merchant trust that they'll get paid?" The Visa logo lets the cashier know that his store does (or does not) trust the bank on the other end of the transaction. It assures the merchant that yes, this Visa member bank will pay them. But with a fully online transaction, the payment could happen automatically and securely. The merchant wouldn't care where the card came from, since the authorization went directly to the customer's bank, and their bank transferred their money instantly before the customer even walked out the door. There would be no need for intermediaries to skim their transaction fees for operating a special bank-only network, as the secured transactions themselves could take place over any public network.
This would have killed Visa. Instead, they swept SET under the rug and we've been dealing with phony cards and ID theft ever since. Now, they have a program called PCI-CISP, and it's used by Visa to deflect the blame to the merchants for leaking stolen data.
John
I'm not sure what your point is. All security involves balancing risk and cost; spending too much on security is no better than spending too little on security. If I spend $10 to prevent $5 in losses, I'm being foolish.
In the context of the Olympics, you can have perfect Olympic security by simply not having any Olympics. Otherwise there is always a risk of either electronic or physical intrusions. Somebody has to evaluate the risks and the damage they could cause, evaluate to what extent a given security plan mitigates that risk, and decide if the expected damage reduction is worth the cost of the security.
For example, consider the possibility that somebody is able to hijack the Olympics home page, and it takes an hour to fix the problem. Such a defacement is clearly not "acceptable", but what is it worth? Would they pay $1 to prevent it? Almost certainly. Would they pay $1,000,000,000 to prevent it? Probably not.
Apparently you've never employed anyone, or been a member of a partnership. Employees and partners aren't slaves or children, and their boss can't control all their actions. Therefore their boss should not be held accountable for all their actions.
Let's say Joe from IT uses his access to the business systems to get the backup encryption key and then steals one of the archived DB backup tapes. When he gets home he extracts a list of credit card numbers and sells or uses them. In this scenario the business policy provided reasonable protection of the credit card numbers -- the business systems were secured from general access and the tapes were encrypted. But Joe used the access he was necessarily granted to do his job to violate the trust of his employer and steal credit card numbers. Why should the CEO be personally liable?
Or for a small-business example try this one: you and your partner start a business. You hire skilled and reliable workers, you do good work, and your customers love you. Everything is going great and you land a big contract. Then your partner takes all of your liquid assets including the contract payment and skips town. Your business now has no cash to complete the contract or issue a refund, and you didn't do anything wrong, other than trust your partner -- should you lose your home because your business partner turned out to be a thief?
There are scenarios where the directors or owners should be held accountable; any time that the management of a company makes decisions that hurt people though direct action or negligence they should be held accountable. And contrary to your apparent belief it is possible to sue the directors and owners of a company personally in any case where they were actually at fault. It's just not possible to sue them personally in cases where they were not at fault, and there are socially valid reasons for making that distinction.