Slashdot Mirror
Zero Day Threat
Ben Rothke writes "Zero
Day Threat: the Shocking Truth of How Banks and Credit Bureaus Help Cyber
Crooks Steal Your Money and Identity is an
interesting and eye-opening look at how banks and credit card companies make
ID theft and fraud rather elementary. But with all
that, this book must be read in the larger context of how today's society
deals with, and is often oblivious to, risk. When is
comes to risk, American society tolerates tens of thousands of drunk-driving
deaths, gives millions in federal tobacco subsidies, and is oblivious about
near-epidemics such as heart disease, obesity, and diabetes. With
all that, it is doubtful that the myriad horror stories Zero Day
Threat details will persuade Congress or the other players to do anything
to curtail the problem with identity theft and internet
fraud." Keep reading for the rest of Ben's review.
Zero Day Threat: the Shocking Truth of How Banks and Credit Bureaus Help Cyber Crooks Steal Your Money and Identity
author
Byron Acohido & Jon Swartz
pages
304
publisher
Union Square Press
rating
9
reviewer
Ben Rothke
ISBN
978-1402756955
summary
Excellent overview on the epidemic of indent theft
The
internet and web have indeed revolutionized society, and there is hardly an
industry that has not been positively affected by the net. On the down
side, the net is the new conduit for criminals. For example, in the few
years before the web became ubiquitous, U.S. and international law enforcement
nearly had a noose around the child pornography industry and brought it to a
near standstill. After the web, authorities have given up hope that
child pornography can ever be contained.
Similarly, white-collar crime and fraud has been exacerbated by the net. Zero Day Threat details the various loopholes that criminals use to carry out their attacks and crimes. Each of the book's 18 chapters is divided into 3 section, exploiters — which details how the crime lords and their teams carry out the crimes, enablers — which details the history and current practices of credit card companies, banks, credit bureaus, and data brokers, and expediters — which recounts how technology and technologies enable these crimes. I found that the breaking up of the chapters into such triplets is occasionally confusing, and you are left wondering what story you are in.
The book is based on the premise that the payment industry, namely the credit card companies, banks, credit bureaus and data brokers have created an infrastructure that is pliable, nearly endlessly extendable, but paper-thin when it comes to security. The system is built for ease of access, ease of granting credit, but without a robust security infrastructure or privacy controls.
Consider that the PCI Security Standards Council was not created until late 2004, and that will give you an idea how security is anathema to the industry. The outgrowth of PCI is the PCI Data Security Standard which is the first uniformly created set of comprehensive security requirements for enhancing payment account data security. While the industry debates the efficacy of PCI, attackers are busy at work running innumerable fraudulent schemes.
The authors paint an honest appraisal of the lack of security in the industry and have their facts in order, although an occasional hyperbole does creep in, for instance when the authors repeatedly state that the hackers in question went weeks without sleep. But a huge error is where they state in chapter 11 that PCI is controversial, with some merchants complaining that it is too costly to implement. There is nothing controversial about PCI, and the security controls it requires are sorely needed. While merchants express their discontent about security and its associated costs, attackers steal from underneath them. The quicker the merchants get that they needed security, the quicker the attacks will stop. But as the book shows, that will not happen anytime soon.
Part of the reason why identity theft will not go away anytime soon is similar to the problem in the air traffic control industry, as detailed in Terminal Chaos: Why U.S. Air Travel Is Broken and How to Fix It. There are too many players in the game, all of which focus on their own interests, and no one wants to take responsibility for the problem. The fact that the Social Security number (SSN) is still used as a key personal identifier, combined with the ease at which an individual 's SSN can be obtained and misused should be enough to give anyone pause.
The primary purpose of a SSN has been to track individuals for taxation purposes. But in the last decade, the SSN has become a de facto national identification number. When established in the 1930s, the Social Security Administration meant for the SSN to be used as a way to track a person's earnings for Social Security benefits. Despite its narrowly intended purpose, the SSN is now used more for non-Social Security purposes, than for the reason it was created. Today, SSNs are used for identity verification, and are the de facto identifier for the credit and financial services industry. With SSNs being aggregated by the millions, they are the fodder for the stories in the book.
Book such as Silent Spring, which helped launch the environmental movement, and The Jungle, which exposed the corruption of the American meatpacking industry, were watershed books that changed America. While Zero Day Threat is not in the same category as either of these books, it is highly unlikely that the level of outrage it will create will be much, nor the indignation significant. Because as bad as identity theft is, and as much grief as it causes, there are far too many politicians, powerful companies, lobbyists and more that are in the way of any change.
Nonetheless, Zero Day is a most interesting look at the many players that work together to facilitate the countless identity theft rings. The book is an absorbing look at the many international players and their enablers involved. While identity theft is not going away anytime soon, Zero Day Threat details the problem, and shows what you can do to ensure that you are not a victim.
Ben Rothke is the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase Zero Day Threat: the Shocking Truth of How Banks and Credit Bureaus Help Cyber Crooks Steal Your Money and Identity from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Similarly, white-collar crime and fraud has been exacerbated by the net. Zero Day Threat details the various loopholes that criminals use to carry out their attacks and crimes. Each of the book's 18 chapters is divided into 3 section, exploiters — which details how the crime lords and their teams carry out the crimes, enablers — which details the history and current practices of credit card companies, banks, credit bureaus, and data brokers, and expediters — which recounts how technology and technologies enable these crimes. I found that the breaking up of the chapters into such triplets is occasionally confusing, and you are left wondering what story you are in.
The book is based on the premise that the payment industry, namely the credit card companies, banks, credit bureaus and data brokers have created an infrastructure that is pliable, nearly endlessly extendable, but paper-thin when it comes to security. The system is built for ease of access, ease of granting credit, but without a robust security infrastructure or privacy controls.
Consider that the PCI Security Standards Council was not created until late 2004, and that will give you an idea how security is anathema to the industry. The outgrowth of PCI is the PCI Data Security Standard which is the first uniformly created set of comprehensive security requirements for enhancing payment account data security. While the industry debates the efficacy of PCI, attackers are busy at work running innumerable fraudulent schemes.
The authors paint an honest appraisal of the lack of security in the industry and have their facts in order, although an occasional hyperbole does creep in, for instance when the authors repeatedly state that the hackers in question went weeks without sleep. But a huge error is where they state in chapter 11 that PCI is controversial, with some merchants complaining that it is too costly to implement. There is nothing controversial about PCI, and the security controls it requires are sorely needed. While merchants express their discontent about security and its associated costs, attackers steal from underneath them. The quicker the merchants get that they needed security, the quicker the attacks will stop. But as the book shows, that will not happen anytime soon.
Part of the reason why identity theft will not go away anytime soon is similar to the problem in the air traffic control industry, as detailed in Terminal Chaos: Why U.S. Air Travel Is Broken and How to Fix It. There are too many players in the game, all of which focus on their own interests, and no one wants to take responsibility for the problem. The fact that the Social Security number (SSN) is still used as a key personal identifier, combined with the ease at which an individual 's SSN can be obtained and misused should be enough to give anyone pause.
The primary purpose of a SSN has been to track individuals for taxation purposes. But in the last decade, the SSN has become a de facto national identification number. When established in the 1930s, the Social Security Administration meant for the SSN to be used as a way to track a person's earnings for Social Security benefits. Despite its narrowly intended purpose, the SSN is now used more for non-Social Security purposes, than for the reason it was created. Today, SSNs are used for identity verification, and are the de facto identifier for the credit and financial services industry. With SSNs being aggregated by the millions, they are the fodder for the stories in the book.
Book such as Silent Spring, which helped launch the environmental movement, and The Jungle, which exposed the corruption of the American meatpacking industry, were watershed books that changed America. While Zero Day Threat is not in the same category as either of these books, it is highly unlikely that the level of outrage it will create will be much, nor the indignation significant. Because as bad as identity theft is, and as much grief as it causes, there are far too many politicians, powerful companies, lobbyists and more that are in the way of any change.
Nonetheless, Zero Day is a most interesting look at the many players that work together to facilitate the countless identity theft rings. The book is an absorbing look at the many international players and their enablers involved. While identity theft is not going away anytime soon, Zero Day Threat details the problem, and shows what you can do to ensure that you are not a victim.
Ben Rothke is the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase Zero Day Threat: the Shocking Truth of How Banks and Credit Bureaus Help Cyber Crooks Steal Your Money and Identity from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Is this a book review or a political tract ?
\u262D = \u5350
This looks more like what's written on the back cover.
If you can read this, I forgot to post anonymously.
This write-up emits socialist hawking radiation.
Not so much as people in general are oblivious to risk. As much as we are a lazy species, and capitalism pays full respect to that fact.
CS: It is all sink or swim...oh and did I mention there are sharks in that water?
And some company is making money off of each and every one of those things.
This whole sentence is moronic, but it's easiest to point to the fact that federal tobacco subsidies ended several years ago. If one has to criticize American society, too little hysteria over risk seems like an odd choice.
What I'm listening to now on Pandora...
In the introduction of this article, the word risk is used where 'liability' may be more appropriate. Risk is something we engage in with intention. Liability is different, and out of our control. Banks with poor security measures don't expose us to risk, but liability.
The real reason that credit card fraud will continue is that there will always be people that want to steal from others. Security will slow it down, but just like wearing gloves while mixing chemicals, it really only reduces the damage to the things it protects.
A couple of ambulance-chasing reporters from USA Today, who've really had any eye on InfoSec since '04, write a disjointed book with no logical flow (read: 3-point chapter divisions)....
And it finds its way on here? I'm glad I cancelled my subscription months ago when I saw this site sliding.
I mean, seriously. These guys compare hackers to meth addicts. It's a sensationalist P.O.S. written by people with no background in the field.
Some people would define that as "Liberty".
Also:
No. The law is NOW that you're officially driving drunk when your blood alcohol level is .08. In some people that's LESS THAN ONE BEER.
This has led to gestapo style checkpoints where drivers are randomly pulled aside for breathalyzer tests merely because they were at a rock concert.
I do not, in any way shape or form, define that as "tolerate".
I've been seriously contemplating boycotting both Visa and MasterCard recently, for all the reasons mentioned above. They are entrenched, have no interest in security (because the consumer pays for insurance anyway). And they're unavoidable (making them essentially a duopoly). I've tried to buy things without Visa or MasterCard and it makes life very hard. This is perhaps the best indication that there's a problem...that I can't avoid sending money to these companies (a situation every monopolist loves). Furthermore, the system is based around authorization. That is, you don't give people money with these transaction systems, you give them authorization to withdraw money on demand, without confirmation from you! This is just stupid.
Through all this, we're funding organized (and disorganized) crime at a level that makes me want to cry. Organized crime will come around, once they have enough financial influence, and make our lives hell. I hope we don't have to wait for that to happen before people/governments take action. These criminals have already made email unusable. What's next?
It's long past time. You, with all those crypto skills. Invent electronic cash. Make it secure. Make me able to give money to anyone, with both parties verifying the transaction. Make it independent of identity. Make it open and publish the specs for a prototype device (or software). Market the hell out of it. Do it 20 years ago. If that's not possible, do it now.
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
I wonder what the fix is. I know nothing will happen any time soon, but how do I protect myself? I'm not talking Lifelock or some other scam, but a real solution that gives me protection.
Corporate greed has a way of coming out on top, even when practices look stupid. They are making their money, even if our IDs are at risk. Which, you know, is clearly bullshit.
We figured out a long time ago that it's easier to elect seven judges than to elect 132 legislators.
why does congress have to act? i'm really not a libertarian in general, but its the consumers putting up with this crap from banks, credit reporting agencies, and credit card companies that perpetuates the problem
if only there were more room underneath my tinfoil hat for 20s
"But with all that, this book must be read in the larger context of how today's society deals with, and is often oblivious to risk. When is comes to risk, American society tolerates tens of thousands of drunk-driving deaths, gives millions in federal tobacco subsidies, and is oblivious about near-epidemics such as heart disease, obesity, and diabetes. "
9/11
Know this site and this is the ONLY tuly free credit report direct or start here. The other "free" credit report websites are just trying to sell you stuff that you don't need.
To be truly safe from someone opening credit in your name is to freeze your credit - monitoring services are NOT as good. Here's a great guide on how to do it.
On another note and something positive about credit, check your credit card. They may offer to double or more the manufacturer's warranty. Meaning, if you're actually considering an extended warranty, your credit card may give you the same coverage to you for free.
But other than that, the whole credit industry seems to be geared towards sucking us in. I mean, unless you're going to drive and stay with friends and relatives, is it possible to travel without one?
Is it possible to get a job without a credit rating now? They background checks with Choicepoint who gets their data mostly from the credit bureaus.
What about flying? If you don't have a credit rating, are you automatically flagged as suspect?
And as far as SSN is concerned, we're stuck with that beast. I kind of hope it does go bankrupt then maybe we can burn the things!
Those wacky leftists, pointing out that Americans don't assess or address risk well. What traitors!
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
American society tolerates...
There is not enough time or resources to protect people from themselves.
identity theft will not go away .... There are too many players in the game
Clearly the author has no immediate experience in the banking industry. The process is designed to minimize business risk. It shifts the consequences to the customer. It's intentional and the industry is quite happy with it.
Utter the words EMV in the U.S. banking industry and you are on the wrong end of a tirade on socialist schemes, government regulation and the kitchen sink's role in harming business interests.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
I have always found it perplexing how the US is now fixated on terrorism when it is probably one of the least likely things that will kill any US Citizen (even of those serving in the armed forces, a significant number of their deaths are actually accidental).
Obviously, I don't wish to undermine the importance of their deaths. But if saving lives is truly your main concern, then there issues that put more lives at risk.
Terrorism isn't killing nearly as many US Citizens as fast food (and it also isn't killing nearly as many US Citizens as the US is killing others around the world for that matter). Yet look at what the US goverment is doing and what US media is fixated on. It really amazes me sometimes.
The internet and web have indeed revolutionized society, and there is hardly an industry that has not been positively affected by the net
Were they positively affected? ;)
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
http://www.youtube.com/watch?v=CS9ptA3Ya9E
The talk about federal tobacco subsidies, obesity, etc. isn't really applicable. Those are risks that people voluntarily accept when they choose to engage in risky behavior. That's quite different from having my bank account pilfered by a crook.
Excellent overview on the epidemic of indent theft
I'm not sure what "indent theft" is. Some of the code I see in my company has too little indentation. Was it stolen? If they stole some of the indent from those lines of code, why does other code in the same files have way too much?
Great something else I need to care about. Why is everyone telling me that I need to care about something. Global warming, global cooling, global climate change, Obama, McCain, Clinton, Pelosi, abortion, gay marriage, paying my taxes, paying my rent, RIAA, the most recent pop tart to get drunk and flashing her cooch, Colbert, Sterwart, child pornography, identity theft, and on and on. It's not that people don't care or are comfortable with risk it's just there are too many things to care about.
Frankly if someone wants my identity they can have it but you gotta take the whole thing because I don't fucking care anymore.
People who bite the hand that feeds them usually lick the boot that kicks them
Keep in mind that financial institutions have only a minor interest in preventing identity theft, since the victim is legally stuck with the consequences unless s/he acts quickly -- which is often impossible since someone financing a car in my name won't exactly be sending me a notice of the fact. In fact, it could be argued that they have an incentive to make some ID theft easy since it increases business.
The last time this came up before Congress, with the bankruptcy "reforms" of a few years ago, the main effect was to make it harder for victims of identity theft to get out of being held responsible for the thief's actions.
Lacking <sarcasm> tags,
What do you think the purpose of the original poster was in asking whether this is a book review or a political tract? It seems to imply that the OP finds the criticism offensive or off topic. As the book is about threats, a brief discussion of American risk assessment and management practices is certainly not off topic. Therefore, I believe the OP finds these criticism offensive, but for the life of me, I can't figure out why.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
Just make a federal law that says consumers are NOT responsible for fradulant transactions as a result of identity theft. Period.
All the major players would then do what is necessary to protect thir bottom line.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
Until it costs institutions less to secure this stuff than it does in losses, this will not change.
How do you shift this balance?
- Make the C level folks criminally and financially liable for theft of your data (they store it and sell it, they should be on the hook to protect it).
- Make the credit agencies financially liable for inaccuracies in their data bases. (they should be held accountable for the accuracy of the information that they are selling).
Today, there is no real recourse for you if institutions sell lies about you, or give your private data away to all takers.
Judging by the highly slanted overview of the article the posted is apparently not American.
"During My Service In The United States Congress, I Took The Initiative In Creating The Internet." -Al Gore
Enforcement is profitable!
Imagination drew in bold strokes, instantly serving hopes and fears, while knowledge advanced by slow increments...
it is doubtful that the myriad horror stories Zero Day Threat details will persuade Congress or the other players to do anything to curtail the problem with identity theft and internet fraud.
Congress already made it illegal. See: Fraud. That's pretty much all Congress can do. We don't call them the legislative branch for nothing.
The problem is that it's more expensive for society to enforce than to tolerate, and it's not very high on the list of "things people get upset over when it happens to a neighbor." Burglary, murder, rape, vehicular manslaughter, sure... but nobody's going to lose sleep because their neighbor was "identity thefted." Once society progresses to some sort of near-utopia where ID theft is the worst of our problems, or once it actually becomes more economical to enforce than to tolerate, I'm sure you'll see it in stump speeches and party platforms. Until then, monitor your own credit and/or lock it down. Oh, and don't give out your information to talking giraffes.
https://www.eff.org/https-everywhere
So "my country, right or wrong" is a better take on the situation? That seems to be what you are implying.
In which "failure to pass bunches of laws and spend taxpayer's money" is equated with "being oblivious to"
...but working in the financial industry may have my blinders tighter than ever.
I recall a very basic security seminar I was in many years ago - before Microsoft was in the server business. One of the core concepts presented was the three security factors we could rely on:
- Something you ARE - fingerprint, iris, voice, etc.
- Something you KNOW - password, phrase, challenge response.
- Something you HAVE - token, card, whatever...
Any two of the three could offer good security. Asking for all three could offer very good security. Of course, we are only talking about access security here, as being forced to use all three to sign into your already-compromised workstation does not offer much data security.
But in most credit card transactions, we have to offer at least #2 & 3, not always in that order. Adding biometrics (something you ARE) is interesting.
Faking #3 (something you HAVE) is not so hard. Cards get copied, and actually the account number may be as good as a card in the card-not-present environment that e-commerce lives in.
Faking #2 is the most current target of many, and they add loggers to terminals. Only a matter of time before we see wireless loggers inserted into terminals or POS devices, making it very hard for a consumer to check for the wire to 'another' device, and removing the need to go and retrieve the logger. Sending those PINs wirelessly is just too easy, only requiring a modest investment in technology. I venture there are plenty of ways to get those made for ya.
Ultimately, for financial security, I think we need to mitigate the technological 'expediter' by introducing either more accountability or more time into the settlement process, allowing fraudulent transactions time to be rolled back and deny the crooks the funds. That is probably impossible in an environment where merchants demand faster payment, especially when merchants live on the edge of cash flow and can fail if they are denied cash over the course of days. Imagine trying to slow down the cash flow for weeks...
Another option is faster accountability. Perhaps your cell phone is your friend here, and you get an SMS for every transaction... Imagine the thrill of seeing your purchase of two minutes ago appearing on your phone with a big "dispute this" button available. Imagine the thrill of getting that message for a purchase you *didn't* make, and killing the transaction... Imagine the potential for abuse. Not perfect.
One key point to remember, perhaps. Theft is not new. The methods have changed. The scale is larger, but everything is.
Is it fixable? Not if we want convenience. But hey, it used to be that people got mugged for cash. Does that happen so much any more? In a cashless society, with stricter security, are we gonna see ATMs that can tell the difference between the eyebell you use to authenticate yourself, or the eyeball the mugger just popped out of your socket?
Hope so. I want all my biometrics to stay with me.
deleting the extra space after periods so i can stay relevant, yeah.
If you need a book to tell you that a corporation that exists solely to increase shareholder wealth gives one flying fuck about you or your information, I have a Nigerian Prince who would LOVE to make your acquaintance.
Summary in the big ol' green box: "Excellent overview on the epidemic of indent theft" We cannot continue to allow these thieves to steal our indents! Let my punctuation go!
I think the hardest part of this problem to look at is the idea of national identification. National banking and credit institutions need a way to identify individuals. They've chosen the not-so-private SSN as the number of choice. It works in the sense that it is largely unique per person, but is fantastically easy to fake.
Better identification would almost certainly translate into more government involvement. There's always been a healthy opposition to a national ID card, but just such a thing could stop identity "theft". The price would be stoopidly easy government monitoring of your movements. I'm envisioning a card that does some cryptography allowing you to cryptographically sign agreements for credit, etc. If fraud charges show up, you could show that the signature on the change is incorrect. Of course, such a card could be stolen, but its loss would be obvious and it could be dealt with. SSNs can simply be copied.
Use the Firehose to mod down Second Life stories!
People worry too much as it is. Some of us need to be more oblivious to the problems of the world. I'm not suggesting that nobody does anything about our problems, but every person does not need to worry about every single problem. Sometimes we're happier not knowing!
Everyone wants to scare us into doing something, usually buying a product. Take some time to relax, you'll live longer.
FreeBSD.org - The power to serve
It seems to me that the entire credit complex is designed to make sure that very few people have good credit and that it is trivially easy to lower a person's credit rating so that the cost of borrowing is increased. Even on the surface the system seems rigged -- credit bureaus get paid for access to their records by the very people who loan money out, thus they have a financial incentive to make sure that their ratings are as low as possible so as to maximize the profits of those loaning out the money.
I say this because it seems like every time I turn around there is some new attempt to evaluate (and ultimately lower) the credit score of people. The first one that comes to mind is the slight reduction every time you *apply* for credit, even if you don't take it. The second (which I believe was rebuffed here in MN) was the attempt to use driving records to help set credit ratings.
And now its identity theft, where the onus is on the consumer to use a complex and difficult system to "repair" their credit ratings which countless stories would indicate is nearly impossible to do, even a decade later.
In some ways its like the grade on a curve vs. straight percentage debate -- the credit industry seems to want to grade us on a curve, regardless of how many of us score 95% on the test, thus minimizing the pool of people who are eligible for the best interest rates.
Man, this is the least funny Bottom of the Barrel book review yet.
That's called Pandemic.
communism = Nazism? really?
An author who understands that the word "myriad" is in fact an adjective and not a noun.
I so agree with you. High fructose corn syrup and hydrogenated fats are devastatingly bad. Don't buy them. Vote with your wallet!!
If the finance industry were to strongly authenticate users, instead of cheaping out with cards and net pictures or other ineffective schemes, but put hardware (tokens preferably in card form) in customer hands, and use them together with some human operation on all or part of the display, they could know that the person on the other end of the line had the card and knew a pattern or something. Using such things to authenticate customers (as opposed to identifying them) would make faking accounts nearly impossible and would make use of phished information basically infeasible because the authenticator would change every time. To do this you need to authenticate both ways and preferably check the authentication at the end of a transaction. Were this done, much of the money that funds malware development and comes of id theft would dry up. Users would need to be more involved than now in guarding their information, but with no more difficulty than they have in signing a check or document, and in fact with less difficulty. The electronics is basically what is in RFIDs today that do authentication, plus some flexible displays. That is cheap - few bucks worth - in quantity, if institutions insisted. There is no need for full blown CPUs or other fancy stuff and the costs of the parts drops daily. However, people don't demand these sorts of things much because they are not out there yet. Clamor for real strong authentication, not the half measure kludges sold today that don't use hardware, might change that. Eventually fraud losses might force it anyway. You note that CAPTCHAs are getting solved. Other "machine token" schemes are vulnerable to worms and a few more of those getting broken might just cause the whole class of these schemes to be junked. I suspect though that fear of change and of customers who don't want to do anything different has more to do with lack of change than any evil intent.
Umm... the Shocking Truth of How Banks and Credit Bureaus Help Cyber Crooks Steal Your Money and Identity ? oooh ahhh
I didn't even bother to read the summary which seems to be topic for the majority of posts so far. Sensationalist title might get the average Joe interested, but I tend to think most of the ./ crowd are already quite well aware of "how banks and credit bureaus help cyber crooks steal your money and identity" and it's not all that shocking.
Hell, a book with that title could probably consist of nothing more than ./ comments which are related to the subject.
Of course I didn't RTFA... why would I do that? You really are new here aren't you? Don't let my UID fool you.
You are way off.
http://www.alcoholalert.com/drunk-driving-statistics-2005.html
I call troll on the entire article. There's no way this guy is that dumb... He's obviously fishing. how else do you go on a tirade about how we're ignoring all of the issues the government and even private institutions seem to spend all of their time dealing with.
Don't feed the trolls.
And fi on the moderators for letting the trolls live under the bridge.
Yesterday, this was labeled +4 Insightful, because it is.
Today it's down to "0 Troll"??? The only reason I can possibly see is an anti-Obama sig, and there are PLENTY of pro-Obama sigs running around.
Shame on the Slashdotters for allowing this rampant abuse of the mod system to go on.
The payment card industries standard 1.1 states that AV software has to be installed on every box (especially servers and personal computers), but also clears that UNIX boxes and mainframes don't need to fall under that rule and so don't need AV software.
Currently, PCI 1.2 is in the works and there's already a brief overview on the changes.
So far, the guys kicked that UNIX/mainframe excemption and extended that AV rule by "must address all known forms of malicious software".
So, when I'm running a few Cisco ASA routers on my network (which basicly are Cisco appliances running linux), I am supposed to either get AV software for those boxes?
And the AV software on my windows boxes doesn't scan for Linux rootkits - do I even have a chance to get the PCI 1.2 compliance?
On the other hand, PCI 1.1 is currently perfectly fine with a WLAN running WEP "encryption" and PCI 1.2 is said to state that you should change any WLAN from the long-broken WEP-obfuscation to WPA-encryption by at least 2010.
If you're running a web application, you're only to required to run reviews on this applications code or sanitzing input for SQL injections and the like when this web application is facing the internet. As long as that application sits on some internal network, you're perfectly PCI compliant.
Well, galf a year ago, credit card details of 4.2 million Hannaford Bros customers were stolen - not by some employee sniffing at the right points, but from some malware exploiting a vulnerability in the Hannaford Bros-internal credit card application.
The PCI standard also states "one primary function per server".
Well, some virtualizations like OpenVZ/Virtuozzo may not seem "that" secure (you can attach to the guest OS from the host box, sniffing traffic or processed kernel code "for free"), but others (HVM solutions like VMware or Xen) quite clearly are "strong enough".
But wether you'll be failing or getting PCI compliance by running a dozen virtualized servers on a physical box is merely a matter of the auditing company you've chosen.
Which brings me to the last point: getting PCI standard compliance means that you're paying some PCI-approved auditing company, who you've chosen on your own and who do turn checks various boxes (either "in place" or "not in place") in some form, mail the form to the council and wait for the response.
Excuse me, but such things are plain nuts.
People worry too much as it is.
Worst of all are the ones who are preoccupied with whether others are worrying about too many things.
"I can't imagine how things could get any worse!" (some guy) "That could just be failure of imaginatioÂn on your p