Archive

Archive for the ‘PCI’ Category

Carding Terms & Terminology

December 14th, 2009 admin No comments

(Re-post from a carding forum online.  I hope Dave Thomas “El Mariachi” can help clarify any questions or misstatements in this list.)

==================================================

Bank-emitent (Issuing bank) -> bank which has issued the card

Billing address
-> the card owner address

Drop -> innerman. His task is to receive the money or goods and, accordingly, to give the part of the earnings to you.

Biling -> office, which has agreement with a bank. Also this office assumes payments for the cards.

Card bill -> it’s a Bank emitent card bill.

Bank-equirer -> bank, in which the store opens the account.

Merchant account -> bank account for accepting credit cards.

Merchant Bank -> bank, through which occur the payments between the buyer and the salesman (frequently it is used as synonym “bank-equirer”).

Cardholder -> owner of the card.

Validity -> suitability card using.

White plastic -> a piece of the pure plastic, where the information is plot.

CR-80 -> rectangular piece of pure white plastic (without the drawing image) with the size of a credit card with the magnetic strip.

Transaction -> charege to the credit card

POS terminal (Point Of Sale terminal) -> reading card device, which stands at commercial point.

PIN-code -> the sequence, which consists of 4-12 numbers. It is known only to the owner of card. By simple words password for the work with ATM and so on.

AVS -> the card owner address checking. It is used for the confirmation of the card belonging exactly to its holder.

“Globe” -> card holographic gluing with the image of two hemispheres (MasterCard).

Pigeon (hen) -> card holographic gluing with the image of the flying pigeon (VISA).

Reader -> information reading device for the readout from the magnetic strip of card.

Encoder -> read/write device for the magnetic track of the card.

Embosser -> card symbol extrusion device.

Card printer -> card information printing device.

Exp.date -> card validity period.

Area code -> the first of 3 or 6 numbers of the card owner phone.

CVV2, cvv, cvn -> 3 or 4 additional numbers, which stand at the end of the number of card.

ePlus -> program for checking the cards.

BIN -> first 6 numbers of the card number due to those it is possible to learn what bank issued out the card and what is the type of this card (ATM-card, credit, gold, etc.). Synonym of word “Prefix”.

Chargeback -> the cardholder’s bank voids the removal of money from its card.

Dump -> information, which is written to the magnetic strip of the card, it consists of 1,2 or 3 tracks.

Track (road) -> a part of the dump with the specific information. Every 1-st track is the information about the owner of the card, 2-nd track -> information about the owner of card, about the bank issued the card, etc. 3-rd track -> it is possible to say -> spare, it is used by stores for the addition of the points and other.

Slip -> synonym to the word “cheque” (conformably to card settlings).

Card balance -> money sum that finding on the card account.
MMN Mothers Maiden Name, important if you want to change the billing address

Parking (parked) -> Installing device

Lips -> Reader

Jacket (dress jacket) -> Installing reader on ATM

Trousers -> Pinpad

Dress trousers -> Installing pinpad on ATM

Ironing jacket -> Charging battery of reader

Ironing trousers-Charging battery of pinpad

Cover -> Big panel, on which pinpad placing

Piece of iron , box, parking -> ATM

Stuff -> Cards or tracks

Second step -> Cashing

Institute -> Bank (like Finance institute)

Observer -> Person, who take care of all working

Fitter -> Person, who install and take off device

Inhabitant -> Cardholders

Side-show -> Time of device working (ex: today a lot of inhabitant on side-show)

Sofa -> Model of ATM

Citroen -> Model of ATM

Flat -> Model of ATM

Toothed -> Model of ATM

Disco -> Model of ATM

Tourists -> Group of workers who must install device

Chief -> Head of group

Harvest -> Stuff from one ATM

==================================================
SOME OTHER TERMS:
==================================================

Automated Clearing House (ACH) -> the automated clearing house. The voluntary association of depositors, which achieves clearing of checks and electronic units by the direct exchange of means between the members of association.

AMVA -> Association of American Motor Vehicle Agencies

ACCOUNT NUMBER -> A unique sequence of numbers assigned to a cardholder account that identifies the issuer and type of financial transaction card.

ACQUIRER -> A licensed member that maintains the merchant relationship and acquires the data relating to a transaction from the merchant or card acceptor and submits that data into interchange, either directly or indirectly.

ADDRESS VERIFICATION SERVICE -> A fraud prevention tool designed for mail order, telephone order and Internet transactions.

AMC -> American Magnetics Corporation

AUTHORIZE -> A process defined in operations regulations whereby a transaction is approved by or on behalf of an issuer; commonly understood to be receiving a sales validation by the merchant, by telephone, or authorization terminal.

AUTOMATED TELLER MACHINE (ATM) -> An unattended, magnetic stripe-reading terminal that dispenses cash; accepts deposits and loan payments; enables a bank customer to order transfers among accounts and make account inquiries.

BANKCARD -> A debit or credit card issued by a bank or other financial institution, such as a MasterCard card or Visa card. BIOMETRICS -> Biometrics utilize “something you are” to authenticate identification. This might include fingerprints, retina pattern, iris, hand geometry, vein patterns, voice password, or signature dynamics. Biometrics can be used with a smart card to authenticate the user. The user’s biometrics information is stored on a smart card, the card is placed in a reader, and a biometrics scanner reads the information to match it against that on the card. This is a fast, accurate, and highly-secure form of user authentication.

BIT (Binary Digit) -> The smallest unit of information in a binary system: a 1 or 0 condition.

BPI -> Bits Per Inch.

BYTE -> A binary clement string functioning as a unit. Eight-bit bytes are most common. Also called a “character”.

BUSINESS CARD -> A Business card is similar to the Corporate card, but issued to a business with a few employees and where each employee is responsible for their purchases.

CARDHOLDER -> The customer to whom a card has been issued or the individual authorized to use the card.

CARDING -> Credit card fraud. Carding texts offer advice on how to make credit cards, how to use them, and otherwise exploit the credit card system.

CASH DISBURSEMENT -> A transaction that is posted to a cardholder’s credit card account in which the cardholder receives cash at an ATM, or cash or travelers checks at a branch of a member financial institution or at a qualified and approved agent of a member financial institution.

CIRRUS SYSTEM INCORPORATED -> A wholly owned subsidiary of MasterCard International Incorporated, operates the international ATM sharing association known as “Cirrus® ATM Network.”

COB -> Change of billing. Used for online carding, to change the billing address of a card since Online Stores will only ship large items if the billing and shipping address match. You can obtain these from vendors in CP. Once you have this, you can easily change the card address to that of your drop so that the stores ship items to your drop, since the billing and shipping addresses will match.

CLEANING -> The process of exchanging financial transaction details between an acquirer and an issuer to facilitate posting of a cardholder’s account and reconciliation of a customer’s settlement position.

CO-BRANDED CARD -> A credit card issued by a member bank and a merchant, bearing the “brand” of both.

CARDJET CARDS -> Teslin®-based, CR-80 size cards with a surface that is specially formulated for thermal inkjet printing. CardJet Inks bond to cards and dry instantly, without smearing. CardJet cards stand up well to abrasion, dye-migration and UV fading.

Continuous Acqusition and Life-cycle Support (CALS) -> the integrated system of the production guaranteeing, purchase and expluatation. This system makes possible to computerize all data about the design, development, production, servicing and the propagation of the production.

CHECK READER -> A peripheral device used to read encoded information on a check to be transmitted and processed by a computer or register for authorization and approval.

COERCIVITY -> The measure of how much magnetic force is needed to change the state of a magnetized element. The higher the coercivity, the more force is needed. There are two types of magnetic stripe cards, low coercivity and high coercivity. While low coercivity cards can be erased if they get too close to a common magnet, high coercivity cards are not as easily erased.

COLOR MATCHING -> Several color matching options are included with FARGO Card Printer/Encoders. These options are built directly into the printer driver so they are easily selected. Colors print with more clarity, detail, and accuracy.

COLOR MONITOR -> A monitor that displays data and graphics in color. Color monitors vary in the number of colors, dot-pitch and intensities they can produce.

COMMPORT -> Communications Port. Most IBM compatible computers have from one to four commports used to communicate with devices attached to the computer (COM1, COM2, COM3, COM4). You need a commport to communicate with the 712 Encoder.

COMMUNICATION PROTOCOL -> The rules governing the exchange of information between devices on a data link.

CONTACT SMART CARD ENCODER -> The contact smart card encoder connects the ISO contact pins mounted on the e-card docking station to a Gemplus GemCore 410 smart card coupler mounted inside the printer. The GemCore 410’s digital I/O is converted to a RS-232 signal which is accessible to application programs through a dedicated DB-9 port on the outside of the printer labeled “Smart Card.”

CONTACTLESS SMART CARD ENCODER -> The contactless smart card encoder connects an antenna mounted on the e-card docking station to a Gemplus GemEasyLink 680SL coupler mounted inside the printer/encoder. Application programs can access Mifare® contactless cards via a RS-232 signal through a dedicated DB-9 port on the outside of the printer labeled “Mifare/Contactless.”

CONTROL NUMBERS -> Measure card usage and be used as a tracking device if the card is lost. ID Services will print these on cards after the numbers have been supplied.

CREDIT CARD AUTHORIZATION -> The process in which a credit card is accepted, read and approved for a sales transaction. Credit card authorization is normally accomplished by reading a credit cared through a credit card reader that is integrated into a register or stand-alone reading device. Generally, pertinent credit information is transmitted via a modem and telephone line to a credit card “clearinghouse”. The clearing house (authorization source) communicates with the credit card’s bank for approval and the appropriate debit amount of the sale.

CREDIT CARD READER (Magnetic Stripe Reader) -> A device that reads the magnetic stripe on a credit card for account information to automatically be processed for a transaction. A credit card reader is either integrated into a register, attached onto a register as a separate component or is part of a stand-alone terminal dedicated for the sole function of processing credit card transactions.

CURSOR -> A blinking symbol on the screen that shows where data may be entered next.

CUSTOMER POLE DISPLAY -> A peripheral device designed to show customers information about their transaction. This information normally consists of a description and price of the product they are purchasing. Customer pole displays are also used to display marketing information and other messages.

COMMERCIAL CARDS -> This is the formal name for a group of cards issued to businesses, commercial organizations and governments. Types of commercial cards include: Corporate Card, Purchase Card, and Business Card. Corporate card A Corporate card is usually issued to the employees of a corporation, where the corporation assumes all liability for the card’s usage. These tend to be to larger corporations.

CURRENCY CONVERSION -> The process by which the transaction currency is converted into the currency of settlement or the currency of the issuer for the purpose of facilitating transaction authorization, clearing and settlement reporting. The acquirer determines the currency of the transaction; the currency of the issuer is the preferred currency used by the issuer, and most often, the currency in which the cardholder will be billed.

DEBIT CARD -> A plastic card used to initiate a debit transaction. In general, these transactions are used primarily to purchase goods and services and to obtain cash, for which the cardholder’s asset account is debited by the issuer

DECODE -> A term used to describe the process of interpreting scanned or “read” information and presenting it in a usable fashion to the computer.

DENSITY -> Defined in bits per inch (BPI), recording density is the number of information bits which are recorded on one inch of a magnetic strip.

DIRECT THERMAL -> Direct thermal is a printing technology method in which the printer utilizes a paper that reacts chemically to heat. The label rolls are coated with a thermo-sensitive layer that darkens when exposed to intense heat. Direct thermal printers require no ink or ribbon and are typically used when a bar code label needs to endure for a year or less.

DIRECT-TO-CARD (DTC) PRINTING -> The Direct-to-Card printing process prints digital images directly onto any plastic card with a smooth, clean, glossy PVC surface.

DISKETTE / FLOPPY DISK -> A flexible disk which holds information that can be read by the computer.

DOS (Disk Operation System) -> The standard operation system for all computers advertised as “IBM Compatible”.

DOT-MATRIX PRINTER -> A printer that forms characters or images using a matrix of pins that strike an inked ribbon.

DOWNLOADING -> The process of sending configuration parameters, operating software or related data from a central source to remote stations.

DPI (dots per inch) -> Measurement of a printer’s resolution. Example: 600 dpi indicates that the printer can produce 600 dots of color in each inch of a card. NOTE: When judging color reproduction for a CardJet Card Printer, the inkjet resolution must be at 2400 dpi or better to achieve the color equivalent of a 300 dpi dye-sub printer.

DUAL HOPPERS -> Select FARGO Card Printer/Encoders provide a dual-stack, 200 card capacity Card inp<-b>ut Hopper. This unique dual hopper allows you to load up to 200 of the same type of card for maximum card production or allows you to load a different stack of cards into each hopper for added versatility and efficiency. Loading two different stacks of cards is often beneficial if, for example, you are using two types of preprinted card backgrounds (i.e. gold cards versus silver cards) in order to more easily distinguish between two types of members, employees, students, etc.

DUAL TRACK -> A type of credit cared reader that is capable of reading both Track 1 and 2 on a credit card.

DYE-SUBLIMATION -> Dye-sublimation is the print process FARGO Card Printer/Encoders use to print smooth, continuous-tone, photo-quality images. This process uses a dye-based ribbon roll that is divided into a series of color panels. The color panels are grouped in a repeating series of three separate colors along the length of the ribbon: Yellow, Magenta, and Cyan (YMC). As the ribbon and card pass simultaneously beneath the Printhead, hundreds of thermal elements heat the dyes on the ribbon. Once the dyes are heated, they vaporize and diffuse into the surface of the card. Varying the heat intensity of each thermal element within the Printhead makes it possible for each transferred dot of color to vary saturation. This blends one color into the next. The result is continuous-tone, photo-realistic color images.

Debit Card -> Card, which resembles the credit card by the method of using, but making possible to realize direct buyer account debiting at the moment of the purchase of goods or service.

Delivery Versus Payment (DVP) -> the system of calculations in the operations with the valuable papers, which ensures the mechanism, which guarantees that the delivery will occur only in the case of payment and at the moment of payment.

Direcht debit -> payment levy method, mainly, with the repetitive nature (lease pay, insurance reward, etc.) with which the debitor authorizes his financial establishment to debit his current account when obtaining of calculation on payment from the indicated creditor.

Electronic Fund Transfer (EFT) -> the remittance of means, initiated from the terminal, telephone or magnetic carrier (tape or diskette), by transfer of instructions or authorities to financial establishment, that concern to the debiting or crediting of the account (see Electronic Fund Transfer/Point of Sale -> EFT/POS).

Electronic Fund Transfer/Point of Sale -> EFT/POS -> debiting from the electronic terminal, for the means transfer purpose from the account of a buyer into the payment on the obligations, which arose in the course of transaction at the point of sale.

E-CARD DOCKING STATION -> FARGO provides an optional e-card docking station on select models that can be ordered with encoders for one, two or three different types of e-cards. These printer/encoders allow application software to read and/or store information in the memory of e-cards. The optional encoders provide everything needed for an application program to communicate with a specific type e-card through a standard RS-232 interface. The FARGO e-card docking station comes standard with the read/write pins (as defined by ISO) needed to communicate with contact smart cards. The e-card docking station can also be ordered with a magnetic stripe encoder for either an ISO magnetic stripe that supports dual high/low coercivity tracks 1, 2 and 3 or a JIS II magnetic stripe.

E-CARD ENCODER -> Select FARGO Card Printer/Encoders support reading and/or storing information in up to three different types of e-cards: ISO 7816 contact smart cards, Mifare® contactless smart cards and HID proximity cards.

EDGE-TO-EDGE -> Refers to the maximum printable area on a card. Printer/Encoders with edge-to-edge printing capability can print just to the edge of a card resulting in printed cards with virtually no border.

EMBOSSING -> Raised characters are produced through the use of a male and female die brought together by pressure applied above and below a marking surface. Embossing is ideal for variable information data cards, strip tags, and identification molding processes.

EBT (ELECTRONICS BENEFITS TRANSACTION) -> Allows governments to implement social aid programs such as food stamps through the use of a magnetic-stripe card, which can be accepted at merchant locations set up to accept this plan.

ELECTRONIC DRAFT CAPTURE (EDC) -> A system in which the transaction data is captured at the merchant location for processing and storage.

ELECTRONIC FUNDS TRANSFER (EFT) -> A paperless transfer of funds initiated from a terminal, computer, telephone instrument, or magnetic tape.

EMBOSS-The process of printing identifying data on a bankcard in the form of raised characters.

ENTERPRISE -> An “enterprise” e-commerce solution indicates technology for a large business enterprise. This usually involves a number of systems that are required to interface with each other as well as a central database management system. The design and management of an enterprise solution can be very complex.

EMULATION -> The imitation of a computer system, performed by a combination of hardware and software, that allows programs to run between incompatible systems.

ENCODER -> A device used to write data onto magnetic stripe cards.

EPROM -> Read-only, non-volatile, semi-conductor memory that is erasable via ultra violet light and reprogrammable.

EXPANSION BOARD / EXPANSION SLOT -> The optional device board that is usually added inside the system cabinet at an available expansion slot.

FACTORING -> Also known as laundering. When a merchant submits transactions for another merchant that were not conducted at the original merchant’s business establishment, this is known as factoring.

FIRMWARE -> A computer program or software stored permanently in PROM or ROM.

FIELDS -> A specific position on each track where data may be written or read.

FIXED DATA -> Data which doesn’t change. In Card Template, data remains constant from encoding session to encoding session. This means that, until it is modified, each card will encoded with this information. In Set-Up/Encode Fields, data is fixed.

FOIL -> Decorative foils are applied to cards with heat. If you have a specific foil in mind, we can apply it for you, ID Services has a wide variety to choose from.

HAND-HELD DATA COLLECTOR -> See Portable Data Collector

HARD DISK DRIVE -> Enclosed disk drive that contains one or more metallic disks for data storage. A hard disk has many times the capacity of a diskette.

HIGH COERCIVITY -> See coercivity.

HIGH-VOLUME PRINTING -> Fast, efficient printing for producing large quantities of cards with minimal down time for supplies loading or maintenance.

HIGH DEFINITION PRINTING™ (HDP™) -> The High-Definition Printing process prints full-color images onto clear HDP transfer film. The HDP film is then fused to the card through heat and pressure via a heated roller. This revolutionary technology enhances card durability and consistently produces the best card color available – even on tough-to-print matte-finished cards, proximity cards, and smart cards.

HIGH SPEED PRINTING -> FARGO Card Printer/Encoders are among the fastest desktop card printer/encoders in the industry. High-speed printing allows for more efficient card production – saving time, money, and resources.

HOLOGRAM -> This security feature prevents the reproduction of ATM/Bank cards and credit cards. ID Services has a variety of holograms to choose from or will apply your own custom hologram.

HOST COMPUTER -> A central computer, such as a mainframe computer at a company’s headquarters or central office. The central computer in a star network.

ISO -> International Standards Organization specification for magnetic stripe encoding. The FARGO encoder supports dual high/low coercivity and tracks 1, 2 and 3.

ID CARDS -> An important record-keeping tool for hospitals, nursing homes, healthcare providers, insurance companies and colleges/universities are ID cards. ID Services offers them in four sizes, CR50, 60, 70 and 80, to fit any standard imprinting or embossing system. ID Services offers a variety of card compositions to meet the needs of the specific application. Composite cards are recommended for College/University ID’s due to their flexibility and long life span.

Integrated Circuit (IC) Card -> It is known also as chip card. Card equipped with one either several computer micros-chip or integrated microcircuits for identification and storing of data or their special treatment, utilized for the establishment of the authenticity of personal identification number (PIN), for delivery of permission for the purchase, account balance checking and storing the personal records. In certain cases, the card memory renewal during each use (renewed account balance).

International Standardisation Organisation (ISO) -> International organization, which carries out standardization, with the staff office in Geneva, Switzerland.

IN-COUNTER SCANNER -> A bar code scanner that normally has multiple laser beams emitting from it to read bar codes in high-speed environments (i.e. grocery stores). An in-counter scanner is usually mounted into a countertop so that products can quickly and easily be passed over the scanner for bar code reading.

IMPRINTER -> A device supplied to the merchant to produce an image of the embossed characters of the bankcard on all copies of sales drafts and credit slips.

ISSUER -> A member that enters into a contractual agreement with MasterCard or Visa to issue MasterCard or Visa cards.

JIS II -> Japanese Industrial Standard for magnetic stripe encoding, published and translated into English by Japan Standards Association.

KEYLOCK CARDS -> Hotels and resorts all over the world are changing the traditional door locks to electronic swipe key cards. Keylock cards are becoming a necessity to keep hotel guests safe. For excellent performance, the cards must match the system and the applications. ID Services offers roll-on magnetic stripes as well as laminated magnetic stripes in both high energy and low energy coercivity with the hotel and/or its logo perfectly printed.

KEY GENERATOR -> Any tool designed to break software copy protection by extracting internally-stored keys, which can then be entered into the program to convince it that the user is an authorized purchaser.

KEY LOGGER -> (Keystroke Logger). A program that runs in the background, recording all the keystrokes. Once keystrokes are logged, they are hidden in the machine for later retrieval, or shipped raw to the attacker. The attacker then peruses them carefully in the hopes of either finding passwords, or possibly other useful information that could be used to compromise the system or be used in a social engineering attack. For example, a key logger will reveal the contents of all e-mail composed by the user. Keylog programs are commonly included in rootkits and RATs (remote administration trojans).

LCD DISPLAY -> The LCD – or Liquid Crystal Display – shows the current status of the printer, and changes according to the printer’s current mode of operation. LCD communicates an error with text, which is easier to interpret than LED lights.

LOW COERCIVITY -> See coercivity.

LASER SCANNER -> A bar code scanner that utilizes laser technology. These scanners emit laser beams that read bar codes. Laser scanners have “depth of field” which enables them to read bar codes from short distances away (6″ to a few feet).

LED (Light Emitting Diode) -> A semiconductor light source that emits visible light or invisible infrared radiation.

LOCKABLE HOPPER -> Some FARGO Card Printer/Encoders provide a lockable Card Hopper Door. This lock is intended to help prevent theft of your blank card stock. This feature is especially helpful if using valuable card stock such as preprinted cards, smart cards, or cards with built-in security features such as holograms.

MAGSTRIPE STRIPE -> The magnetically encoded stripe on the bankcard plastic that contains information pertinent to the cardholder account. The physical and magnetic characteristics of the magnetic stripe are specified in ISO Standards 7810, 7811, and 7813.

MAGNETIC STRIPE READER -> A device that reads information recorded on the magnetic stripe of a card.

Magnetic Ink Character Recignition (MICR) -> System, which ensures the machine reading of the information, substituted by magnetic inks in the lower part of the check, including the number of check, the code of department, sum and the number of account.

MEMBER -> An institution that participates in the programs offered by MasterCard International Incorporated.

MERCHANT -> A retailer, or any other person, firm, or corporation that (pursuant to a merchant agreement) agrees to accept credit cards, debit cards, or both, when properly presented.

MAS (Merchant Accounting System) -> The Vital back-end system that handles settlement, interchange and billing.

MERCHANT BANK -> A bank that has entered into an agreement with a merchant to accept deposits generated by bankcard transactions; also called the acquirer or acquiring bank.

MCC (MERCHANT CATEGORY CODE) -> Four-digit classification codes used in the warning bulletin, authorization, clearing, and settlement systems to identify the type of merchant business in various stages of transaction processing.

MMS (MERCHANT MANAGEMENT SYSTEM) -> The Vital front-end system that handles point of sale functions such as terminal types, cut-off times, etc.

MOTO (MAIL ORDER/TELEPHONE ORDER) -> A transaction initiated by mail or telephone to be debited or credited to a bankcard account.

MAGNETIC STRIPE -> The black stripe found on the back of most credit cards and many other types of identification cards and drivers licenses. Used to encode and read data, usually identifying the owner of the card.

MAGNETIC (“MAG”) STRIPE -> Mag Stripe refers to the black or brown magnetic stripe on a card. The stripe is made of magnetic particles of resin. The resin particle material determines the coercivity of the stripe; the higher the coercivity, the harder it is to encode -> and erase -> information from the stripe. Magnetic stripes are often used in applications for access control, time and attendance, lunch programs, library cards, and more.

MAGNETIC STRIPES -> Offered in five different sizes and are available in both low coercivity (300 oersteds) and high coercivity (2750 (USA), or 4000 (European) oersteds.)

· 1/8″ Covers one track (HEM only)

· 5/16″ Covers two tracks

· 6/16″ Covers three tracks (3/8″)

· 7/16″ Covers three tracks

· 8/16″ Covers three and one half tracks (1/2″)

· 9/16″ Covers four tracks (super stripe)

· We can apply roll-on magnetic stripes as well as flush laminated magnetic stripes.

For additional security ID Services offers holo-magnetic stripes. The stripes are custom made with your company name appearing in the stripe. Multiple magnetic stripes can be applied to each card.

MAGNETIC STRIPE READER -> See Credit Card Reader

MASTER REGISTER -> A cash register that acts as the central register or “file server” in a multiple register environment. The master register normally controls “slave” registers that are networked and cable to it.

MEGABYTE -> A unit of measure that consists of 1,014 bytes.

MICROCOMPUTER (Personal Computer) -> A small. low cost computer originally designed for individual users. Recently, microcomputers have become powerful tools for many businesses that, when networked together, have replace minicomputers and in some cases mainframes and information tools.

MICRO-PRINTING -> Very small text printed into the plastic card and generally look like thin lines to the naked eye. The text is printed at 9600 dpi (dots per inch) and require a magnifying glass to view the micro-printed text. Desktop card printers print at 300 dpi and can not reproduce micro-printing making micro-printing a very handy feature when checking for counterfeit cards.

MICROPROCESSOR -> Integrated circuit chip that monitors, controls and executes the machine language instructions.

MICR READER -> MICR is an acronym for Magnetic Ink Character Recognition. MICR Readers are normally used to read the encoded information within the ink on a check.

MODEM (Modulator – Demodulator) -> A device used to convert serial digital data for transmission over a telephone channel, or to reconvert the transmitted signal to serial digital data for acceptance by a receiving terminal.

MONOCHROME MONITOR -> A monitor that displays characters in only one color, such as amber or green.

MULTI-USER -> Multi-user systems consist of two or more computers that are connected together and that share data and peripherals. A multi-user system includes a host computer (file server) and one or more stations. All stations share the same hard disk and may share other devices such as printers.

MTBF (Mean Time Between Failures) -> The average time between failures of a particular device based on statistical or anticipated experience.

NETWORK -> A communications system connecting two or more computers and their peripheral devices.

NETWORK CARD -> An expansion card that is installed in an available slot in a computer so that it may connect and communicate to another computer.

OPERATING SYSTEM -> System that consists of several programs that help the computer manage its own resources, such as manipulating files, running programs and controlling the keyboard and screen.

OUTPUT STACKER -> The Output Stacker stores printed cards in a first-in/first-out order. This feature makes it easy to keep printed cards in a specific order for faster issuance or to print serialized cards.

OVERSIZED CARDS -> Oversized cards are used for more efficient visual identification and are available in many non-standard sizes. The most popular sizes are CR-90 (3.63″ x 2.37″/92mm x 60mm) and CR-100 (3.88″ x 2.63″/98.5mm x 67mm).

OVERLAMINATE -> Protective clear or holographic material designed to offer advanced card security and durability. Two types are available from FARGO: Thermal Transfer Overlaminate is a .25 mil thick material that enhances card security and durability. PolyGuard Overlaminate is available in a 1 mil and .6 mil thick material and provides extraordinary protection for applications that require highly durable cards.

OVERLAY PANEL -> The clear overlay panel (O) is provided on dye-sublimation print ribbons. This panel is automatically applied to printed cards and helps prevent images from premature wear or UV fading. All dye-sublimation printed images must have either this overlay panel or an overlaminate applied to protect them.

OVER-THE-EDGE -> Refers to the maximum printable area on a card. Printer/Encoders with over-the-edge printing capability can print past the edge of a card resulting in printed cards with absolutely no border.

PARALLEL TRANSMISSION -> Transmission mode that sends a number of bits simultaneously over separate lines. Usually unidirectional.

PERIPHERAL DEVICE -> Hardware that is outside of the system unit, such as a disk drive, printer, cash drawer or scanner.

POLLING -> A means of controlling devices on multi-point line. Usually utilized to send/receive information via modem from remote computers to a central computer.

POLYGUARD™ -> A card overlaminate available in 1 mil and .6 mil thicknesses that provides extraordinary card protection; ideal for harsh or more secure environments. Available as clear or with embedded holographic-type security images.

POS (Point-of-Sale) -> Term normally used to describe cash register systems that record transactions or the area of “checkout” in a retail store.

PIN NUMBERS -> This security feature will activate usage of the card. Once the numbers have been supplied from our customers, ID Services can apply them to the customer cards.

PINPAD -> A “pin pad” is a small keyboard that normally contains numeric keys. PIN is an acronym for personal identification number which is normally entered into the keyboard “pad” to verify account information for a transaction (i.e. similar to an automated teller machine).

PORTABLE DATA COLLECTOR -> A hand-held computer that can be used as a stand alone portable unit for point-of-sale, inventory, receiving and other applications. A portable data collector is normally a temporary storage device that gathers information and downloads data into a main or central computer.

PROGRAMMABLE KEYBOARD -> A keyboard that is capable of being configured and programmed in a variety of ways. Programmable keyboards allow keys to represent special departments, functions, product, etc.

PROJECTION SCANNER -> A type of bar code reader that is normally placed vertically, and that projects laser beams horizontally to scan bar codes. Often used when high performance and speed to reading bar codes is critical.

PROTOCOLS -> A set of rules for the exchange of information, such as those used for successful data transmission.

PROXIMITY (“PROX”) CARD -> Proximity cards allow access and tracking utilizing contactless technology (usually by communicating through a built-in antenna).

PROX CARD ENCODER -> The prox card encoder uses a HID ProxPoint® Plus reader mounted on the e-card docking station inside the printer/encoder. The ProxPoint is a “read only” device producing a Wiegand signal that is converted to RS-232 using a Cypress Computer Systems CVT-2232. Application programs can read information from HID prox cards via a RS-232 signal through a dedicated DB-9 port on the outside of the printer labeled “Prox.”

PVC (POLYVINYLCHLORIDE) -> These cards are manufactured for mechanical style embossing and to be our least expensive card option. They are available in 23 different colors and three different card finishes. Heat distortion occurs at 130°F and the cards will flex approximately 2,500 flex cycles. Estimated normal card life: 18 months.

PDF (PORTABLE DOCUMENT FORMAT -> Adobe’s file format is the de facto standard for electronic document distribution. It is the preferred means of distributing documents online because it preserves fonts, formatting, colors and graphics regardless of the application or platform used to create it. The Adobe Acrobat Reader, required to read PDF files, is available free from the Adobe web site.

PIN PERSONAL IDENTIFICATION NUMBER) -> A four-to-12 character secret code that allows an issuer to positively authenticate the cardholder for the purpose of approving an ATM or terminal transaction occurring at a point-of-interaction device.

POTS (PLAIN OLD TELEPHONE SERVICE) -> The standard analog telephone service with no enhancements like call waiting, etc.

PURCHASE CARD -> The Purchase card is issued to corporations, businesses and governments. It provides control over daily and monthly spending limits, total credit limits, and where the card may be used. It also reduces the administrative cost associated with authorizing, tracking, paying, and reconciling those purchases. Many employees may be issued the same card number.

RAM (Random Access Memory) -> Temporary storage that holds the program and data the CPU is processing.

RESIN THERMAL TRANSFER -> Resin Thermal Transfer is the process used to print sharp black text and crisp bar codes that can be read by both infra-red and visible-light bar code scanners. It is also the process used to print ultra-fast, economical one-color cards. Like dye-sublimation, this process uses a thermal Printhead to transfer color from the ribbon roll to the card. The difference, however, is that solid dots of color are transferred in the form of a resin-based ink which fuses to the surface of the card when heated. This produces very durable, single-color images.

RSA -> the coding and autentification technology, developed in 1977 in MIT by Rivest, Shamir and Adel’man, which subsequently opened their own company RSA Data Sechurity, Inc., purchased recently by the company Security Dynamics Technologies, Inc.

Real-Time Gross Settlement (RTGS) -> the payment method, with which the transfer of means is achieved for each transaction in obtaining of instructions about the payment. Decrease the risk with the payment.

Smart Card -> card equipped with integrated circuit and microprocessor, capable to carrying out the calculations.

System risk -> the risk, with which the incapacity of one of the payment system participants either financial market participants as a whole to fullfill their obligations causes the incapacity of other participants or financial establishments to fulfill its obligations (including obligations regarding the realization of calculations in means transfer systems) properly. This failure can cause significant liquidity or crediting problems and, as result, it can cause loss to the stability of financial markets (with the subsequent action on the level of economic activity).

SCALE -> A scale is a peripheral device used to record the weight of an item and transmit the amount to a computer for processing.

SCRATCH-OFF PANELS -> Applied through hot stamping or silk screening. Typically they are used to cover pin numbers on pre-paid phone cards.

SERIAL TRANSMISSION -> Transmission mode that sends data one bit at a time. In most cases, in personal computers, serial data is passed through as RS232 serial interface port.

SIGNATURE CAPTURE -> A peripheral device that electronically captures an individual’s signature for customer identification and transaction applications.

SLAVE REGISTER -> A cash register that is driven by a “master” register in a multiple register environment.

SMART CARD -> A smart card contains a “chip” with memory and is typically used to hold customer account information and a “balance” of money similar to a checking account. The card is inserted into a device that can read and write to it updating information appropriately.

SMART CARD -> Smart cards have an embedded computer circuit that contains either a memory chip or a microprocessor chip. There are several types of smart cards: Memory, Contact, Contactless, Hybrid (Twin), Combi (Dual Interface), Proximity and Vicinity.

SMARTGUARD™ -> SmartGuard is a printer security option that uses a custom access card and a built-in reader to restrict printer access. With this feature, only those with a valid access card can print cards. This makes both your printed cards and your overall system more secure.

SMARTLOAD™ -> SmartLoad is an exclusive FARGO technology used in CardJet Card and Ink Cartridges to advise you on the status of your CardJet supplies. In CardJet Ink Cartridges, SmartLoad technology reports the number of prints remaining in the cartridge and alerts you when ink is low or out. In CardJet Card Cartridges, SmartLoad technology tells you to install a new cartridge when the card supply runs out.

SMARTLOAD CARD CARTIDGE -> Cartridge that is pre-loaded with CardJet Cards at the factory. They snap into the back of the printer in just seconds. SmartLoad technology inside the cartridges alerts you to install a new cartridge when the card supply runs out.

SMARTLOAD INK CARTIDGE -> CardJet Ink Cartridges are available with both full-color and black (used for infrared bar codes only) inkjet inks. Cartridges snap into the printer just like the cartridges used in other familiar office or home inkjet printers. SmartLoad technology inside the cartridges reports the number of prints remaining in the cartridge and alerts you when ink is low or out.

SMARTSHIELD™ -> This option allows the printer/encoder to print custom, reflective security images on the card that fluoresce under a black or UV light source.

SOLENOID -> Solenoids are commonly used in “dumb” cash drawers and incorporate a cable connected trigger which releases the drawer. Cash drawers with solenoids are interfaced to receipt printers that “drive” them. Solenoids have different voltages and are integrated into the cash drawer dependent on the printer they are interfaced to.

STANDARD CARDS -> The standard card size is CR-80. CR-80 dimensions are 3.375″ x 2.125″ (85.6mm x 54mm).

THERMAL TRANSFER -> Thermal transfer is a printing technology method in which printers use regular paper and a heat sensitive ribbon. The ribbon deposits a coating of dark material on the paper when exposed to intense heat. Thermal transfer printers produce a more durable label that won’t fade as quickly as direct thermal labels and are often used when a label needs to endure longer than a year.

THERMAL TRANSFER OVERLAMINATE -> A card overlaminate available in a .25 mil thickness that increases card security and durability; often used for moderate durability applications or when additional security (such as holographic images) are needed.

TILL -> The paper money and currency tray that holds money in a cash drawer. Tills are usually available in 4 or 5 till versions, available with lock and cover and are removable.

TRACK -> One of up to three portions of a magnetic stripe where data can be written.

TRACK 1 -> Track one is a “track” of information on a credit card that has a 79 character alphanumeric field for information. Normally a credit card number, expiration date and customer name are contained on track 1.

TRACK 2 -> Track two is a “track” of information on a credit card that has a 40 character field for information. Normally a credit cad number and expiration date are contained on track 2.

TRACK3 -> Track three is a “track” of information on a credit card that has 107 character field for alphanumeric information. Normally a credit card number, expiration date and room for additional information are available on track 3.

Truncation -> procedure, which makes it possible to limit the physical displacements of a paper document, in the ideal version, by the bank of the first presentation, by the replacement by electronic transfer of entire or part of the information, which is contained on this document (check).

Tipper -> a machine designed for use with PVC plastic cards to create raised print. (basically a plastic card embosser)
UNIX -> UNIX is a terminal based operation system in which “dumb” terminals are communicating back to a “smart” processing unit or host.

UPS -> An acronym for uninterruptible power source. A UPS is primarily used as a back up power source for computers and computer networks to insure on-going operation in the event of a power failure. Sophisticated units also have power conditioning and power monitoring features.

UV INKS -> most commonly used to put hidden graphics and text on a plastic card. The inks are invisible until the card is subjected to a certain colored light (for instance, when placing a California drivers license under a black light the image of the California flag will become visible in green and orange.) UV inks are used as an aid in detecting counterfeit cards. They come in a variety of colors and can react to different colored lights. Desktop card printers are unable to print UV ink.

VARIABLE DATA -> is information which changes with each encoding session or on a card-by-card basis.

VERTICAL SCANNER -> See Projection Scanner.

WAND -> A pen-shaped bar code scanner that emits a beam from the end or tip of the wand. Wands are older, bar code reading technology but inexpensive and still widely used where speed and performance are not crucial.

WEDGE -> A wedge decodes “read” data (i.e. bar codes, credit cards) and communicates that information through a keyboard port on a computer. The keyboard plugs into the wedge and the wedge device plugs into the computer where the keyboard was. Sophisticated wedges can accept a few different peripheral devices. Also See Decode

ATMs: PTS, PCI DSS, or PA-DSS?

November 8th, 2009 admin No comments

A friend of mine and well known expert on the PCI standards, Branden Williams, blogged about “Does PTS apply to ATMs?“  For those of you still reading that question, PTS stands for PIN Transaction Security and was formerly known as the PIN/PED program.

The important question is which standard do you apply to automated teller machines (ATMs) which seem to exemplify the need for each standard to one degree or another.

Branden reminds us:

ATMs are payment devices just like the card swipe or chip & pin machines we see at mearchants all over the world.  The only difference is that they typically have larger displays, are heavier and more physically hardened, and they spit out money on request.  They’ve also become a great target for hackers to prey on the trusting human (with a fake ATM), or to add sophisticated skimming devices to steal and take advantage of consumer payment data.

It is important to not compartmentalize systems into Procrustean boxes and instead break them into their respective parts.  For example, a company may be both a merchant and a service provider (e.g. Amazon.com or Internet Service Providers).  In the same way an ATM can be broken down into its respective parts and the standards which apply.

  • PTS applies to the PIN pad component
  • PA-DSS applies to the software running on it (potentially)
  • PCI DSS applies to the company that drives the ATM network
Categories: PCI Tags: , , , , , ,

What does Regulatory Compliance have in common with Immunization?

November 8th, 2009 admin No comments

I don’t think many people have ever asked themselves what regulatory compliance has in common with immunization, but they should.  The fact of the matter is that these two have more in common than you think and understanding one will help you better understand the other and how to make better educated decisions.  In addition, there are trade-offs — both heath and economic — to the choices one makes in participating in vaccination and immunization programs.  The following addresses a few of these items and opens the doors for further conversation.

Why Comply? Why Vaccinate?

Immunization and vaccination are the process by which an individual or population is treated in order to fortify itself against attack from foreign bodies.  Vaccination against disease can help prevent contracting that pathogen in the future, and preventing multiple individuals in a population from becoming infected helps prevent the widespread outbreak and transmission of diseases such as smallpox, polio, measles, mumps, and anthrax.  By elevating the level of a population that is resistant to such attacks vaccines help protect the entire population from harm.

The problem is that although most all agree that vaccination is positive for the population not everyone agrees that it is positive for the individual.

Since vaccination began in the late 18th century, opponents have claimed that vaccines do not work, that they are or may be dangerous, that individuals should rely on personal hygiene instead, or that mandatory vaccinations violate individual rights or religious principles.

Have we not heard similar arguments against regulatory compliance?  Individuals stating that:

  • My environment is already secure
  • I know how to manage risk better than the regulatory bodies
  • My environment is special and unique and does not fit into your Procrustean boxes

I’ve listened to people sing the virtues of regulatory compliance as often as I’ve heard other individual tell me “that sounds good but it’s not for me.”  I feel as if I’m mediating between the Center for Disease Control (CDC) and a troubled parent about why their child should be vaccinated before entering grade school.

Perspective

Part I

One of the problems with understanding the complexity of the problem is that of perspective.  The CDC and the parent have very different perspectives on vaccines and immunization.  In the same way, the regulatory bodies and those who must comply with them have very different views on how to best apply data security practices.

For example, it is widely known by the payment card industry (PCI) that the majority of small and medium merchants use one of a few brands of payment application.  Many retail merchants use a Micros, VeriFone, or Radiant Aloha (restaurants) point of sale (POS) application.  This high level of homogeneity in a population lends itself to attract attackers (pathogens) who wish to take advantage of any vulnerabilities they can identify in these systems.

The PCI Council, who act as the CDC, along with the card brands mandate that software companies validate their applications against a given security standard (in this case the PA-DSS).  They then introduce these more secure applications into the population and the governing bodies mandate their use over less secure payment applications.

So why not just stop there?  If things were that easy, the CDC would only ever have to worry about one pathogen using one attack vector.  If we secure the retail payment applications, attackers will just move to other industries such as petrol (gas) stations, ski resorts, and florist shops.  To which the industry responds with Dresser Wayne or Gilbarco, SKIDATA, and Teleflora Dove validated payment applications respectively.  The validated payment application program targets to inoculate every industry against the dangers of retaining data most valuable to attackers.

Part II

But what about the individual restaurant owner who says they don’t need a validated payment application?  They claim all the reasons mentioned above from the specialized nature of their business or network to the secure risk management platform they have already implemented.  Why should they comply?

I do not have a good answer to the ‘why’ but I do have one for the ‘how’.  In fact, about 95% of the ‘PCI Wars’ debate going on today try to answer the question of “why” when this is as futile as debating intelligent design vs evolution (because both are based on separate and unequal premises.)  Debating why one should comply is futile as the rules state that everyone who “stores, process or transmits” such data must comply (as per the card brand operating regulations.)

The more interesting question is that of how one should comply.  These examples reference the PCI standards but could apply to just about any regulatory compliance mandate.  The way in which one complies can be taken at a high level.  For the PCI standards it implies preventing the paper and electronic theft of payment card data.  In fact, any way that your company decides to do this implies compliance with the standard.

If parents didn’t mind sending their children to school in hermetically sealed bubbles, then there would be less of a public policy need for them to be vaccinate against disease.  In this way, the parent and child could make their own decision about data security without harming or posing a risk to the rest of the population of school children and their parents.  If your company can, via whatever means at your disposal, hermetically seal itself against attacks then the matter of compliance is simply an exercise for the user in creative documentation, reporting, and compensating controls.  The problem is, many companies over estimate their security controls and thus cause a break in the structure of data security.

Economics of Immunization and Compliance

When approaching the economics of immunization one cannot ignore the population at hand.  For example, a poorer population will benefit more strongly from an immunization program than one that maintains a high level of sanitation, health care, and treatment programs.  To the same degree a more vulnerable population (e.g. retail, restaurants, higher education, e-commerce, etc.) will benefit more from regulatory compliance than one that is more highly secure (e.g. government systems).

In fact, one of the primary catalysts for regulatory compliance is the build up of problems (e.g. data breaches) within an industry followed by the punctuated equilibrium that brings about a response founded in legislative and regulatory action.

The cost of making a population more secure is relatively simple: require them to use more secure applications and systems.  The cost to the individual can vary along with the benefits.  The same applies to vaccines.

One could go their entire professional life without contracting the flu but this is rather rare in my experience.  Instead many people will get the flu vaccine each year on the off chance they will come in contact with the virus because being bed ridden for 1-2 weeks can be both painful and detrimental to the company.

So what!

The cause of action to vaccinate a population is to immunize them from each other.  The process involves a uniform across the board preemptive treatment that is meant to mitigate risks, not prevent them entirely.  In the same way, regulatory bodies craft legislation as a one-size-fits all in order to protect the population from each other.  The individual implementation should see this as guidance and not a rule without exceptions.

The details of how one protects themselves against attack and infection may be unique to each individual, but they still must comply with the overarching industry agreement to protect themselves and thus the population against attacks.  The implementation will vary, of course it will.  One size does not fit all.  But the industry needs a standard, a baseline, against which it can measure risk.  As new infections and outbreaks occur, the industry will change the baseline to match the new attacks.

Those who can visualize the various perspectives will have a greater visibility into how they can better fortify their individual organizations to both validate against industry mandates and manage risk based on their specific organizational behavior.

The rise of Payment-card Skimming and Prevention

August 28th, 2009 admin No comments

The recent rise in payment-card (credit card) skimming has given rise to a number of press released to notify the general public about the risks and how to prevent becoming a victim.

The PCI SSC released an information supplement titled: Skimming Prevention: Best Practices for Merchants.  In addition Commonwealth Bank released a slideshow on the same topic.

Although this is nothing new, it is on the rise and thus we should be more aware than ever.  If you have a few hours to spare check out the YouTube videos on:

Capability and Maturity Model Creation in Information Security

August 25th, 2009 admin No comments

Please read my guest blog post over at IT Knowledge Exchange.  It covers the topic of: Capability and Maturity Model Creation in Information Security.

The post references the following capability and maturity model (CMM) resources:

Also, Katie Moussouris reminded me of the Microsoft SDL Optimization Model.

When are data breaches just outliers?

August 19th, 2009 admin 6 comments

Recently the large story to hit the news, the thing people are all reading and writing about, is the story about how 1 guy (and 2-5 accomplices) were able to steal 130 million payment-cards in over three years, and finally got caught.  The question is, what if Albert “Segvec” Gonzalez (aka. Cumbajohnny) is an outlier?  A statistical anomaly.

Facts of the Case

Rich Mogull has a good overview of the indictmentWired magazine, the Washington Post (Brian Krebs), and the Wall Street Journal all have coverage.  Rich has an interesting comment that:

In the “drama” category, we learn that the main perpetrator is the same person who hacked TJX (and multiple other retailers), and was the Secret Service informant who helped bring down the Shadowcrew.

This indictment covers breaches of Heartland, Hannaford, 7-Eleven, and two “major retailers” breached in 2007 and early 2008.

This is the same Albert Gonzales who was indicted last year for breaches of TJ Maxx, Barnes & Noble, BJ’s Wholesale Club, Boston Market, DSW, Forever 21, Office Max, and Sports Authority.

The attacks both sniffed traffic and attempted to identify stored card numbers. They targeted data at rest and in motion.

The Wired article adds:

But these are just the latest in a string of high-profile breaches that have been connected to Gonzalez. He and 10 others were charged in May and August 2008 with network intrusions into TJX, OfficeMax, Dave & Busters restaurant chain and other companies.

Using a SQL-injection attack, the hackers allegedly broke into the 7-Eleven network in August 2007, resulting in the theft of an undetermined amount of card data. They allegedly used the same kind of attack to infiltrate Hannaford Brothers in November 2007, which resulted in 4.2 million stolen debit and credit card numbers; and into Heartland on Dec. 26, 2007. Of the two unnamed national retailers mentioned in the affidavit, one was breached on Oct. 23, 2007, and the other sometime around January 2008.

Gonzalez was a Secret Service informant who once went by the nickname “Cumbajohnny.” He was a top administrator on a carding site called Shadowcrew when he was arrested in 2003.

Gonzalez called his credit card theft ring “Operation Get Rich or Die Tryin.” As Wired.com previously reported, he spent $75,000 on a birthday party for himself and once complained to associates that he had to manually count $340,000 in stolen $20 bills after his counting machine broke.

Stephen Watt, a 25-year-old programmer who was working for Morgan Stanley, created a sniffing program dubbed “blabla” that Gonzalez’s gang used to allegedly siphon credit and debit card numbers from TJX and other companies and is facing sentencing this month.

The Wall Street Journal adds:

The Treasury Department recently reported that of the more than 55,000 incidents of wire fraud since 1998, more than half of them occurred in the past two years.

For the techie in each of you, I’d recommend Rich’s summary of the Visa/FBI/USSS data breach report in February 2009.

Allegations

From all accounts it appears that many of the major payment-card data breaches in the last three years can be attributed to a small handful of people, and perhaps one ringleader. Could this be a normal attack pattern, or were these individuals outliers?  If they were the crest of an even bigger wave of attacks, it does not bode well for corporate America, but if they are statistical anomalies then what would the world look like if we ignored them when measuring the success of the PCI program?

In 2003, Gonzalez, a carder in his own right, was arrested by the Secret Service and turned into a mole to allow them inside of CardersMarket, one of the largest carding rings in the world.  Though Gonzalez was outed at the time by Dave Thomas (aka. Ethics or El Mariachi), many people did not listen to his rants at TheGrifters.net.  Allegedly, Dave Thomas was at the time an informant for the FBI on the same operation.  Later that year, Gonzalez would replace Kim Taylor (aka. MacGyver) as the board manager.

In March 2004, Gonzalez expanded his domain by replacing Dmitry Golubov (aka Script) as board manager for CardersPlanet.

In 2008, Albert “Segvec” Gonzalez, Christopher Scott and Damon Patrick Toey were indited and accused of hacking into TJX Companies and thus exposing 40 million payment-cards.  This 2008 indictment named Aleksandr Suvorov (aka JonnyHell) of Estonia and Maksym Yastremskiy of Ukraine.  Could these be the two “Russian” conspirators that are mentioned in the current indictment of Gonzalez?

But Gonzalez would not have gotten very far had it not been for his friendship with Stephen Watt.  Mr. Watt, a 7 foot tall, 25-year-old programmer, wrote the packet sniffer “blabla” for Gonzalez to capture transactions as they traversed the corporate networks.  Interestingly enough, Watt “graduated from high school at 16 with a 4.37 grade point average and from college at 19″, but had a bug in the software that caused it to deactivate each time the POS was rebooted.

Outliers

Again, I begin to wonder what the world would be like if these personalities had not met or operated in unison.  What would the payment-card world be like without Gonzalez?  It may be a stretch to speculate that this one individual and his actions equate to outlier status. By this measure military dictators and oppressive regimes could also be named outliers even though their affect is quite impactful.

What we are really measuring here is the difference between potential energy and kinetic energy and the catalyst to convert matter from one to the other.  We can assume that there are vulnerabilities in every system and the grater the number the higher the potential energy.  The catalyst, in this case Gonzalez, plays the role in converting that potential energy (vulnerabilities) into kinetic energy (stolen cards and then cash.)  Without the catalyst the measured state would stay the same and as such represent a seemingly stable statistic.

We can ignore this alleged stability in the system by stating that all vulnerabilities have the potential of being converted into cash, but until they are such statements are meaningless (outside of theory modeling.)  To this point we measure vulnerabilities not by their size in population but by how frequently they are exploited.  Without a catalyst to convert the vulnerabilities they contain little value from a metrics perspective of data compromises.

Statistics

According to DataLossDB.org the number of payment-card numbers lost between 2007-2009 equates to the following:

2007: 111,957,179 records

2008: 13,439,242 records

2009: 130,965,494 records (to date)

The total number of records for (almost) three years time = 256,361,915 records.  So, let’s see what these numbers look like if we remove Gonzalez from the picture.  That’s right, let’s throw out the catalyst for the outliers and see what the world of data breaches looks like for the Payment Card Industry.

If we count up the number of records lost due to Gonzalez between 2007-2009 we have the following respectively: 94,000,000 (2007), 4,303,930 (2008), and 130,000,000 (2009).  The revised data for those three years would look as following:

2007: 17,957,179 records (down 84%)

2008: 9,135,312 records (down 32%)

2009:  965,494 records (down 99%)

Analysis

What can we learn from this data?  Well, one can speculate that in the absence of outliers like Gonzalez, the overall volume of credit card fraud is dropping.  In fact, without him we would be coasting through 2009 with very few payment-card related data breaches at all!  I won’t make the mistake you anticipate and confuse correlation with causation.

One could also conclude that payment-card related fraud does not follow a normal Gaussian distribution.  In fact, it appears that payment-card related theft and fraud is statistically closer related to the probability distribution of terrorism than traditional crime statistics.

Taking a business perspective one still needs to be on the lookout for attackers and carders who wish to target your business in an effort to “get rich or dye tryin”.  Wherever there is financial or payment-card data there will be those who wish to plunder and capitalize on it.  One thing we must remember is that underground carding is a business model, albeit an illegal one.

Personal Responsibility in PCI

August 16th, 2009 admin No comments

This week’s personal responsibility award goes to Rich Mogull for his excellent point-for-point response to Robert Carr, Heartland CEO, blame-it-on-the-QSA interview with CIO Magazine.  (If you need a summary read Michael Farnum’s notes at Computerworld.)

I fully support Bob Carr, who in 2007 was given the E&Y Entrepreneur of the Year award.  I think he is an innovator who took the unfortunate data breach and used it as a chance to evangelize for not just stricter but smarter data security controls.  I was happy to read about his implementation of end-to-end encryption in an effort to further thwart the carders.

What I don’t support is when people blame others for their problems.  A good leader knows to take responsibility for the actions of the actions of those they manage.  I find it disappointing that such a leader would bow to the blame-game and not just say, ‘Hey, we had a problem, we are fixing it, let’s move on.’

Perhaps it is something he must say legally, or perhaps he will never trust an external auditor again (financial or technical), but I must ask the same statement that Rich does.

As the CEO of a large public company you clearly understand the role of audits, assessments, and auditors. You are also fundamentally familiar with the concepts of enterprise risk management and your fiduciary responsibility as an officer of your company. Your attempts to shift responsibility to your QSA are the accounting equivalent of blaming your external auditor for failing to prevent the hijacking of an armored car.

Rich furthers this point by saying:

The role of your QSA is to assure your compliance with the standard, not secure your organization from attack. Their role isn’t even to assess your security defenses overall, but to make sure you meet the minimum standards of PCI.

If we look at the 10 Fallacies of PCI and read the 10 Myths of PCI [PDF] direct from the PCI SSC, you can see Myth #4 says, “PCI will make us secure”. I’m not sure how much clearer one can say it.

Successful completion of a system scan or assesssment for PCI is but a snapshot in time. Security exploits are non-stop and get stronger every day, which is why PCI compliance efforts must be a continuous process of assessment and remediation to ensure safety of cardholder data.

I am not saying the QSA did or did not do their job.  I do not know the facts surrounding the case and thus cannot speculate.  What I do know is that, either way, the QSA obtained their information from the corporate IT professionals.  In fact a major validation step is that of interviewing internal staff.  It it through these interviews and inspection of various devices and configurations that the QSA determines the scope of the assessment and the security of an organization.

In fact the Verizon DBIR report noted situations where a company may have security controls in place but do not monitor them over time.  The QSA examines the settings and processes of an organization at a point in time, but is not there every day to ensure these processes are performed.

The apparent ineffectiveness of event monitoring and log analysis continues to be somewhat of an enigma. The opportunity for detection is there; investigators noted that 66 percent of victims had sufficient evidence available within their logs to discover the breach had they been more diligent in analyzing such resources. Though lower than in previous years (it was 82 percent from 2004 to 2007), this finding still suggests that realized effectiveness remains much lower than potential effectiveness.

Rich points out a very important part of personal responsibility.

It is unfortunate that your assessors were not up to date on the latest electronic attacks, which have been fairly well covered in the press. It is even more unfortunate that your internal security team was also unaware of these potential issues, or failed to communicate them to you (or you chose to ignore their advice).

Regardless of where the blame falls in this situation, it’s the responsibility of a leader to say ‘mia culpa’ and move on.  I think Bob made excellent use of the media attention to drive technology in the right direction to stem the spread of payment-card data compromise.  I hope he is remembered for his leadership and not his blame of others.

Categories: PCI Tags:

Personal Responsibility in Information Security

August 9th, 2009 admin 5 comments

Recently Nick Selby posted on FudSec his article on Showing the Oblomovs the Door.  For those who care, an Oblomov or Oblomovism is considered a lazy or apathetic person or belief.  The blog post claims that information security professionals are “well-trained, well-intentioned” but “reduced [to] a series of relentless box-ticking” due to being “saddled with compliance management.”

The blog post further claims:

The CEO who lets the Security organization become the compliance department has abdicated to the government and Payment Card Industry his responsibility to understand and manage organizational risk. That is a fiduciary breach of CEO responsibility to shareholders. In addition to firing your ass, this should also be a floggable offense.

I agree one should use compliance as a guideline but manage it with respect to the business process.  I disagree with the fiduciary statement on grounds that one cannot claim a breach based on sparse case study and singularity statements.  The writer says this to bring grandeur to their claim.

The important part of this statement is that we are focused on the individual company here and their personal responsibility.  Remember, if you ever want to get something done don’t pass the buck.

The author, frustrated with the current implementation of compliance, states, “I stomped away from trying to influence security as an analyst because compliance … has managed to suck every ounce of oxygen from the room that is the security industry.”

Let’s just remember that history has shown that in the absence of legislation there exists a downward spiral of corporate responsibility towards protection of customer/consumer information and the well being of others. To support this I point to the moments of punctuated equilibrium that lead to things such as the Food and Drug Administration (FDA), the Securities and Exchange Commission (SEC), marginally improved ecological laws in China, and the current global financial crisis — to name a few.

Let’s also take a moment to remember that regulatory compliance has been raising the bar of information security since 1999, starting with GLBA, then with HIPAA and SOX, and finally with PCI DSS.  Is it because PCI DSS impacts most all business verticals on a global basis that it receives the most abuse from those who feel burned out?

Might I remind you that without such efforts the number of data breaches would be higher, much higher, than we see now because people find it easier to blame someone or something else rather than take personal responsibility for their own work.  The Information Security Management Handbook, by Tipton and Krause, has a section on diffusion of responsibility.

People behave differently based on the perception of being part of a group as opposed to being an individual.  It has been commonly observed that people tend to work less in a group than as individuals when only group output is measured.  People, in addition, tend to feel less responsibility in a group than as a single individual.  The bigger the group, the lower the felt sense of responsibility. Social scientists call this diffusion of responsibility and the phenomenon is commonly observed across all cultures.

I believe that instead of blaming others, we as information security professionals need to become an agent of change starting with ourselves and our current environment and expanding outwards.

The blog then claims:

At this writing it’s unclear whether Black Hat and DefCon demonstrations will include the PCI-compliant account skimmers we’re heard of, but the fact that they’re out there stands testament to the Pyrrhic victory that is the PCI Data Security Standard.

Please remember, the PCI DSS is meant to protect against the electronic and paper theft of payment card data.  It is not meant in any way to prevent credit card skimming. If you wish to raise the issue of skimming, please use the correct approach which is to clarify the need for a more secure payment card.  That of course gives way to the larger question of what is proper capital allocation and the conundrum of offline transactions and backwards compatibility.

I agree, sadly, with the blog post when it says, “PCI is not the minimum standard, it’s the maximum effort that many organizations make.” The question I have is, based on historical precedent (see above): are we better off with or without a carrot-and-stick approach? What impact has HIPAA had on the security of health care records vs PCI on the payment card industry?  In which area do we see more movement?

Certainly, movement does not always imply movement in the correct direction, but I would claim that basic items such as PCI DSS Requirement 3.2 which tells merchants and service providers to not store sensitive authentication date post-authorization has done wonders to the security of our payment card data.  How better to secure the data than to remove it in the first place?  We are seeing trends in this direction more and more in this industry and others.

But isn’t it better to have a minimum standard than none?  What if the minimum was for companies to do nothing?

Jeremiah Grossman stated, nothing did more to build webappsec awareness than pci-dss. Now we need something to improve webappsec security.” I could not agree more, but let’s please remember that without awareness of a problem you cannot bring clarity or correction. People love to lambaste and transfer responsibility to others, all the while stomping away from personal responsibility.

If your company or those around you fail to see the forest through the trees of ‘industry best practices’ when I wonder if they are fit to run the information security department.  Those who complain that ‘compliance’ is the problem are transferring responsibility to industry standards instead of working to secure their own infrastructure.

Do such standards need correction and evolution to mirror the evolving threat of attackers and the continued evolution of information security practices and technology?  Certainly!  I support Mr. Selby in his goal to drive higher standards and move towards risk management, but let’s do so by taking individual responsibility for our own management of risk.

Mr. Selby claims,all this compliance stuff is preventing us from addressing risk and performing, you know, security.” Why?  Did someone tell you that you cannot secure your data? Did someone tell you that by using proper the proper risk management practices you claim work so well that you cannot pass the “minimum standard”?  I support you in questioning and ferreting out anyone who makes such statements.  For the rest of the unwashed masses, we need standards.

Mr. Selby ends his rant with a statement everyone should agree with, “Compliance – the state of being – is achieved as a by-product of well-managed risk, not through a relentless ticking of boxes”, which is then followed by high-level statements of positive thinking.  The problem is that we need some tactical examples and guidelines to match the ever increasingly vague strategic statements.  GLBA says to safeguard customer information, but how?  And left to their own devices most companies will chose the cheapest possible way to implement optics of compliance.

I argue, that the PCI DSS has given concrete statements to how one secure their infrastructure, while giving the flexibility one needs to adjust for business and risk management (e.g., compensating controls, wireless and end-t0-end encryption guidelines.)

The problem lies not with our industry “best practices” but with the diffusion of responsibility that happens throughout every company.  Let’s reference back to that Information Security Management Handbook article:

The effects of de-individualization and individualization are real and play a role in how users perceive their role in an information security awareness program.  In the credit card processing call center example, de-individualization can encourage theft, carelessness, and loss of productivity.

I’d like to stop the blame game and see everyone start at home, transforming their company and being neighborly enough to share the information and results with others.  Revolution has often come from emerging evolution of ideas and conversations. I commend Mr. Selby for the conversation, but wish it involved a greater focus on personal responsibility.

Take responsibility for your own security, risk management, and data protection. Start today.

Dave Hogan doesn’t know PAN

August 7th, 2009 admin 2 comments

In a recent blog posting Dave Hogan, CIO of the National Retail Federation (NRF), reiterated his dogmatic stance that “PCI is little more than an elaborate patch”.  This is something he stated in a recent Congressional subcommittee meeting.

The best accounts of this testimony are by Branden Williams and Anton Chuvakin.  I highly recommend reading both of their blog posts, which deconstruct the testimony and point out flaws and fallacies in many of the statements.

Now, I want to agree with Dave, but much like conspiracy theorists he goes a little too far.  Is PCI enough to secure companies against every data compromise ever imaginable? Certainly not.  Does it raise the bar for the entire industry and make it harder for hackers to compromise payment-card data? Most certainly, and this can be shown by the increase in sophistication of attacks each year.

So, I want to agree with Dave until he makes statements like the following one during the Congressional subcommittee meeting:

What is ironic in this scenario is that the credit card companies’ rules require merchants to store, for extended periods, credit card data [PAN] that many retailers do not want to keep.

I am shocked he was not reprimanded for this one, but then again he said the same thing a few years back on 60 Minutes and few people blinked an eye.  This statement is 100% false.  The card brand operating rules and regulations have long since enabled chargebacks without the full credit card number (or PAN.)  This is further verified by Anton and Branden in their blogs mentioned above.  Walt had to restrain himself from throwing objects at his TV when he saw the 60 Minutes episode.

Dave continues in the next sentence by saying:

To many NRF members, it appears that the credit card companies are less interested in substantially improving their product and procedures than they are with reallocating their fraud costs.

Come again? The credit card companies that dominate the industry, Visa and MasterCard, are not liable for fraudulent transactions.  Do you know who is? The merchants who accept the stolen or fraudulent cards, by means of lost merchandise or goods.  In this sentence Dave is blaming the card brands for trying to reduce payment-card data loss, which in turn reduces other merchants fraud losses, many of which are members of the NRF … his employer.

Again, I want to agree with Dave when he says that we should remove the data and never store it in the first place.  <APPLAUSE>  In fact, many companies have been saying this for a long time, including: TrustCommerce, ProPay, Shift4, MerchantLink, EPX, PPI, BrainTree, Network Merchants, MagTek, Semtek, HomeATM, VeriFone, and CyberSource to name a few!

But are we to blindly accept that one-size-fits-all business models?  The benefits of many of these end-to-end encryption systems come with limitations on how the data can be used.  Internal business process must be re-engineered and some many no longer be possible since only scrambled or encrypted data will be present.

Companies must weigh the pros and cons of any security technologies before running head first into any “solution”.  I am an advocate of end-to-end encryption along with many other information security protection measures (many are listed in the PCI DSS), but we must implement each to the degree that they facilitate and support the business.

We also, need to read deeper into the mantra being told to us by experts.  We need to question the authority of others and examine the problem from all sides for ourselves.  It’s never an easy process but the more educated each of us are of both external security measures and internal business processes, the better we will be able to offer real guidance to our companies.

And that is job security you can bank on!

MasterCard kicks it up a notch with fine schedule

August 6th, 2009 admin 2 comments

Branden Williams noted last week that MasterCard has entered the world of fining merchants that do not comply with the PCI DSS standard (3.1.2.2 Noncompliance Assessments).  This should signal nothing more than the wave of security gaining momentum as more and more card brands gather behind the concept of securing electronic payments.

Branden has the breakdown here, along with a comparison of Visa vs MasterCard fines.  End result? MasterCard fines more than Visa according to his blog post.

Visa Compliance Acceleration Program (CAP) as follows:
* Level 1 Merchant: $25K/mo ($300K/yr) plus tiered merchants bumping down one tier (total $$$ unknown)
* Level 2 Merchant: $5K/mo ($60K/yr)

My understanding (though their appears to be some question about this) is that these fines are assessed quarterly until compliant1.
* Level 1 & 2: $25K, $50K, $100K, $200K ($375K/yr)
* Level 3: $10K, $20K, $40K, $80K ($150K/yr)

StorefrontBacktalk has more information here.

I don’t think this would even be on the table unless we had reached critical mass.  By all accounts, greater than 50% of merchants have taken measures to secure their payment-card transactions.  This means the card brands are standing on firm ground when they roll out fine structures that impact the stragglers who have resisted implementing sound security practices.

Categories: PCI Tags: , , ,
sidebar west END -->