Chaordic Mind

In April 2010 I’ll be at SOURCEBoston on a panel discussing how compliance regulations get made.  This got me thinking about how to explain in simple terms such a complex series of events.  I’ve previously discussed the question of “why” regulatory compliance is important and it’s relation to vaccinations.  Here I’d like to discuss the “how” of regulatory issues.

(If you’d like to hear about this and other PCI related issues then register for the BrightTALK PCI Compliance Summit on March 25, 2010.)

There are so many debates about the pros and cons of regulatory compliance but they all focus on the individual and not the population as a whole.  In fact, the best way to model and examine the evolution of regulation and deregulation is through the eye of the scientist examining the entire population of players.

Background:

Let’s take a look at the history of regulation and deregulation.  The following are a few industries that have experienced both regulation and deregulation over the years, but the list may as well also include industries such as agriculture, telephone, communications (radio, TV, cable), medical and pharmacy.

• Airline
  –Civil Aeronautics Board (1937)
  –Airline Deregulation Act (1978)
• Railway
  –Interstate Commerce Commission (1887)
  –Railroad Revitalization and Regulatory Reform Act (1976) / Staggers Rail Act (1980)
• Trucking
  –Motor Carrier Act (1935)
  –Motor Carrier Regulatory Reform and Modernization Act (1980)
• Energy
  –OPEC price hikes (1973)
  –Emergency Natural Gas Act (1977)

Each of these industries experienced a need for regulation and eventual deregulation in order to keep in check the potential for large problems that could impact large numbers of people (e.g. monopoly, poor conditions, unbound risk, lack of consumer protection).  In 1935 Congress passed the Motor Carrier Act that gave the Interstate Commerce Commission (ICC) authority to regulate trucking involved in interstate commerce.  When the confines of this regulation outlived it usefulness the tides turned.  From 1971 until the eventual passage in 1980 politicians worked to remove barriers to entry into this industry and finally passed the Motor Carrier Regulatory Reform and Modernization Act.  This migratory pattern of regulation and deregulation occurs regularly in many industries.

Pattern of Data Loss

It is no surprise to anyone that there is a building momentum of data loss.  We can gather individual statistics from the news or get detailed statistics from DataLossDB.org.  Either way we notice a pattern of attacks and rising numbers of data breaches that make us ask, is the situation getting better or worse?  Is what we are doing having the desired effect?

It’s very difficult to answer that question since the problem is multi-factorial, but there are signs that things are getting better.  As fraud shifts from one industry to another and one method to another we are slowly driving it from the system.  (This type of analysis does not as easily apply to authentication/identity fraud, but may very well when it comes to system infiltration and data exfiltration techniques.)  For example, we see attack vectors moving from one method to another and from one geographic region to another.  Attackers originally stole data from flat files but when those were encrypted the attackers began capturing data as it traversed the network.  When this was encrypted they began installing custom malware to capture data in memory.  Slowly the system are moving from system protection, to network, to software, and finally hardware protection.

As protection system such as Chip-PIN were implemented across Europe and Asia we saw a drop in card present fraud as the attackers moved to online and e-commerce fraud (via UKPA or APACS).  The attackers adapted to the system and moved on to other low hanging fruit.

History of Regulatory Time

I can’t really do justice to replicating the work of David Lineman, of  Information Shield, so I’ll simply reference his paper “A History of Regulatory Time” and reference his graph showing a timeline of security privacy-related regulations.  Take a look and map the regulations below against the major data breaches of recent and we begin to notice the correlation of regulation in reaction to the rise in tide of data breaches.

Inflection Points and Traffic Jams

Simply analyzing data breaches and their respective reactionary regulation doesn’t paint a precise picture of how the regulations are formed, only that they are somehow correlated.  To understand this we need to first understand a little about math.  Inflection points are the change in slope from an increasing value to a decreasing value or vice versa.  In terms of data breaches we can consider if the number of data breaches, though currently increasing, has a slope that is increasing or decreasing.

Andy Grove, founder of Intel, said in his book Only the Paranoid Survive that “An inflection point occurs where the old strategic picture dissolves and gives way to the new.”  We need to focus on this inflection point in order to understand and if the increasing numbers reflect a state of growth or decline in a system, which we are (unfortunately) only able to measure over time.

In fact, this concept is familiar to physicists in the term “hysteresis“.

For example, consider a thermostat that controls a furnace. The furnace is either off or on, with nothing in between. The thermostat is a system; the input is the temperature, and the output is the furnace state. If one wishes to maintain a temperature of 20 °C, then one might set the thermostat to turn the furnace on when the temperature drops below 18 °C, and turn it off when the temperature exceeds 22 °C. This thermostat has hysteresis. If the temperature is 21 °C, then it is not possible to predict whether the furnace is on or off without knowing the history of the temperature.

The question we always ask is “Where are we on the Sine Wave of Pain?“  Is the rate of negative events increasing or decreasing?  The only way to know is gather and map data as well as measure trending patterns in the industry and make calculated estimates as to which it is.

One thing for sure is that the population not the individual is what drives regulation and as such it is the population that examined the rising data loss numbers and determines when they want change.  It is this demand for change that ultimately initializes the regulation engine to affect what the individual cannot directly.

Traffic Patterns and Modeling

Still, all we have shown at this point is that a culmination of actions can result in change brought upon by the populous.   How that change is enacted is an area of great interest and one that draws from, of all things, traffic patterns.  Before getting into that I’d like to reflect on different types of phase shifts seen both in nature and fiction.  We are all familiar with the concept of ice melting into water which freezes into ice.  It was Kurt Vonnegut who in his book Cat’s Cradle first proposed the fictional concept of Ice-Nine.  This was said to be a polymorph of water that freezes at 45.8 °C (114.4 °F) instead of 0 °C (32 °F).  The idea being that ice could maintain its ice form even at room temperature which is around 20 °C  (68 °F) to 25 °C (77 °F).  In the book, it would take only a single fragment of “ice-nine” to come in contact with the ocean and they would all instantly freeze.  This shows how a seemingly stable system can react suddenly when given the proper catalyst.

A common method of modeling traffic patterns is the Nagel-Schreckenberg (NaSch) model.  (For more detailed information on this model I recommend reading Traffic Simulation using Agent-Based Modelling by Andrew Lansdowne.)  The diagram to the right shows this model in that the traffic flow (y-axis) is measured against the traffic density (x-axis).  You can see that as the traffic density increases the traffic flow increases.  This continues until point “A” where we reach the critical density.  This is the density at which a chance can occur but not at which it must occur.  If everyone continues driving along at the same rate the density can increase until a critical event occurs that breaks down the system.  An example could be one person applying the breaks which then causes the person behind them to do the same, and on and on.  Point “B” is the moment at which the critical event occurs.  At this point we see the traffic flow decrease representing the slowing of traffic until the density is so high it stops (point “D”).

One interesting feature of this series of events is that the traffic flow pattern will always exist in a cycle moving from point A to B, to D and back to A in that order.  Traffic will never go from D to B because doing so requires it to first traverse A.  Remember that term hysteresis?  In the book Critical Mass by Philip Ball he states, “A state of traffic depends not only on its density but on its history – on whether it was previously denser or less dense.  As the traffic rate rises and then falls, the flow rate follows a loop.”

We can examine the graphical flow of data in another form by mapping space on the road (x-axis) against time (y-axis).  As you can see in the second diagram, we map the position of each vehicle over time.  Until the density decreases the traffic jam will continue.  Here the traffic jam is visible in the very dense points as a diagonal across the diagram.  Once the density decreases we once again see a greater flow of traffic.

What’s the Solution?

As you can see, modeling traffic patterns can be very similar to the regulation and deregulation of an industry.  So what is the solution to an increase in incidents that push us past the critical density?  Contrary to initial though the solution to high traffic is not to simply build more roads.  In fact, Richard Moe, Head of the US National Trust for Historic Preservation, once said “building more roads to ease traffic is like trying to cure obesity by loosening the belt”.  Simply applying ‘more’ security does not mean you achieve ‘better’ security.

I propose the following approaches:

• Help prevent data sprawl :: Security is required where data is maintained.  Does your environment reflect the “data, data, anywhere” or “data, data, everywhere” philosophy?  Do you know where all your data is? Does it exist in more locations than is necessary?  Check these items and set measurable actions to correct it.
• Examine use cases :: While medical record data requires persistence, payment card data is only used once and then not ever again.  The use cases are simple enabling a flexible set of measures to secure the data.  If your business model does require retention of data then examine what data you are retaining and make sure it’s as benign as possible.
• Brute force is effective but costly, while the elegant solution is simple and secure :: Have you ever considered replacing the data you retain with a reference number instead?  I recommend you read up on technologies such as point-to-point encryption and tokenization.
• Solve tomorrows problems with today’s technology :: Problems are not hard if you know which ones to solve.  I recommend absorbing and comparing as many of the data breach reports (more) you can to determine what emerging attack patterns exist in your industry and how to prevent them.  If you are only able to implement one set of technology each 10+ years then make sure it solves tomorrows problems and not yesterdays.
• Plugging one hole doesn’t save the levee :: Reducing card present fraud drives attackers to e-commerce.  Reducing fraud in one country drives them to others.  Only a holistic solution will work on such interconnected systems.  This is one of the arguments for industry regulation.

3 Habits of Highly Effective Regulation

In the end there are three attributes, or habits, that make regulation effective in achieving adoption and acceptance.

1. Education, education, education :: This is the single most effective method of driving adoption.  People want to know how to interpret, implement, and adopt the regulation to their business model.  I’ve seen more people fail to start because they didn’t know where to start than anything else.  People want to know if they can use a $0.10 piece of duct tape or if they need to replace the entire engine of the car.
2. Flexibility of controls :: This is an attribute of so many regulations due to the fact that they apply to such a range of companies, industries, size of organizations and the like.  Remember that 100% compliance is not the goal when system failures occur in groups.  The PCI DSS has what’s called “compensating controls.”  The EU Data Protection Directive has the “comply or explain” concept.  Even the ISO 27000 series do not mandate 100% adherence to each and every control.
3. More data for Risk Modeling :: Let’s consider this without getting into a debate over Frequentist vs. Bayesian statistics (as I’ll leave that to Alex Hutton).  The more data we have the more closely we can make educated decisions about how to evolve the standard, protect against failure, and make deterministic decisions about how to proceed.  More data will help us understand when we have reached an inflection point and ultimately determine when the rising regulation turns toward deregulation.

Someone turned me on to this article on fearing the auditor which made me think of other information sources we might fear.  The author of that article claim there are three types of auditors: the good, the bad, and the ugly (ok, so I paraphrased.)

Variance in individual quality should be no surprise since we see this in just about every industry.  There are a range of skills in just about every profession including penetration testing, auditing, and yes analysts.  So let me propose that there are three types of analysts:

1. Polar Bears: These are people who believe that polarizing the conversation is the best way to improve the industry.  They are masters of the catch phrase and speak only in sounds bites.  They survey a few people and make bold statements that reflect only one segment of the industry.  What they lack in substance and facts they make up for in cliches.
2. Gold Mine Speculators: These are people who do not know what the actual answer is but they speculate, typically in 5-10 year projection statements.  They may be correct 25% of the time but that’s good enough.  If they are correct people call them visionaries; if they are not they pick a new industry and re-speculate.
3. Educators: They understand that there is no one simple answer but that solutions are custom made and long term collaborations.  They are not in the news as much since they are not making polar speculative claims, but they help bring a holistic analysis of the options and present the pros/cons with every statement.

I like analysts but believe that in every profession one should “seek first to understand and then to be understood”.

After reading Violet Blue‘s list of the Top 10 Sexy Geeks I thought it only appropriate that we qualify that list and highlight some of the sexy infosec geeks.

It took ignoring large amounts of analytical data and bayesian analysis to bring you a list like this.  We leveraged many hours of questionably reputable consultants to mine the minds of infosec geeks around world.  The result is the following list of the Top 10 sexy infosec geeks of 2009.  (Feel free to disagree or add to the list via comments.)

10. Jeff Moss (Dark Tangent)

Founder of Black Hat and Defcon, Jeff has arguably brought together more information security geeks than anyone else. He was most recently appointed to the Homeland Security Advisory Council and enjoys a comfortable following in both the black/grey/white hat words. Jeff is certainly one of the more well known and certainly connected infosec geeks out there.

09. Justine Aitel

Justine is rumored to be one of the few many women in information security who writes shell code.  She is CEO of Immunity Inc, the creators of the CANVAS security testing tool.  What she carries in her pocketbook might just be the scariest device around.

08. Chris Wysopal (Weld Pond)

Former founder of the L0pht Heavy Industries and author of netcat and L0phtCrack, Chris is a veritable force when it comes to computer security and turning computer hackery into big business.  Chris is currently CTO of Veracode, a software security testing company.

07. Erin Jacobs

Erin has done more than create the controversial  secxy pillow fight at Defcon.  She started the first ever panel (that I know of) about professional image and gender issues in information security.  This brought together women from across the spectrum to raise the level of conversation and its awareness.  In addition she is a musician, motorcyclist, and daytime CSO.

06. Dino Dai Zovi

Dino is a hacker who literally wrote the book, The Mac Hackers Handbook.  In addition to that he won the very first pwn2own at CanSecWest in 2007, was named one of Violet Blue’s Top 10 Sexy Geeks in 2007, and named one of the 15 most influential people in security by eWeek in 2008.

05. Katie Moussouris

Katie knows all about the Security Development Lifecycle and has presented on it at numerous international security conferences.  In addition, she founded the Microsoft Vulnerability Research Program (MSRP) and the Symantec Vulnerability Research Program.  Katie is presently working with the ANSI standards body defining standards for the entire industry.

04. Christopher Hoff

Chris is known for his provocative statements such as Cloudifornication.  He is a sought after speaker on cloud computing and security and one of the few people in the industry who is both smart and a good entertainer. In addition to being sharp in mind he is tattooed tough while practicing Brazilian Jujitsu. He is currently Director of Cloud and Virtualization Systems at Cisco, but better known to friends as Father Cloud.

03. Stacy Thayer

Stacy is the only one in the bunch with a Ph.D.  She founded SOURCEBoston and quickly took it global with SOURCEBarcelona.  Stacy has been connected to the information security industry for some time and creating SOURCE conferences help bring together hundreds and thousands of individuals every year to collaborate and share their common interest.

02. Jacob Appelbaum

Jake can be complicated but certainly is directed towards hardware hacking, cryptography, extreme travel, languages, and photography.  He is currently executive director of the hackerspace Noisebridge in San Francisco.  He works for the Tor project but was formerly a sysadmin for Kink.com. You don’t get more sexy than that.

01. Jack Daniel

Jack is just this guy, ya know.  He looks as sexy as ZZ Top and probably hasn’t shaven his beard since before you were born, but that experience brings with it the tenacity to know true security from common theater. He seems to be everywhere at once and always willing to help people with his guidance, sarcasm, or even sock puppets.

(Re-post from a carding forum online.  I hope Dave Thomas “El Mariachi” can help clarify any questions or misstatements in this list.)

==================================================

Bank-emitent (Issuing bank) -> bank which has issued the card

Billing address -> the card owner address

Drop -> innerman. His task is to receive the money or goods and, accordingly, to give the part of the earnings to you.

Biling -> office, which has agreement with a bank. Also this office assumes payments for the cards.

Card bill -> it’s a Bank emitent card bill.

Bank-equirer -> bank, in which the store opens the account.

Merchant account -> bank account for accepting credit cards.

Merchant Bank -> bank, through which occur the payments between the buyer and the salesman (frequently it is used as synonym “bank-equirer”).

Cardholder -> owner of the card.

Validity -> suitability card using.

White plastic -> a piece of the pure plastic, where the information is plot.

CR-80 -> rectangular piece of pure white plastic (without the drawing image) with the size of a credit card with the magnetic strip.

Transaction -> charege to the credit card

POS terminal (Point Of Sale terminal) -> reading card device, which stands at commercial point.

PIN-code -> the sequence, which consists of 4-12 numbers. It is known only to the owner of card. By simple words password for the work with ATM and so on.

AVS -> the card owner address checking. It is used for the confirmation of the card belonging exactly to its holder.

“Globe” -> card holographic gluing with the image of two hemispheres (MasterCard).

Pigeon (hen) -> card holographic gluing with the image of the flying pigeon (VISA).

Reader -> information reading device for the readout from the magnetic strip of card.

Encoder -> read/write device for the magnetic track of the card.

Embosser -> card symbol extrusion device.

Card printer -> card information printing device.

Exp.date -> card validity period.

Area code -> the first of 3 or 6 numbers of the card owner phone.

CVV2, cvv, cvn -> 3 or 4 additional numbers, which stand at the end of the number of card.

ePlus -> program for checking the cards.

BIN -> first 6 numbers of the card number due to those it is possible to learn what bank issued out the card and what is the type of this card (ATM-card, credit, gold, etc.). Synonym of word “Prefix”.

Chargeback -> the cardholder’s bank voids the removal of money from its card.

Dump -> information, which is written to the magnetic strip of the card, it consists of 1,2 or 3 tracks.

Track (road) -> a part of the dump with the specific information. Every 1-st track is the information about the owner of the card, 2-nd track -> information about the owner of card, about the bank issued the card, etc. 3-rd track -> it is possible to say -> spare, it is used by stores for the addition of the points and other.

Slip -> synonym to the word “cheque” (conformably to card settlings).

Card balance -> money sum that finding on the card account.
MMN Mothers Maiden Name, important if you want to change the billing address

Parking (parked) -> Installing device

Lips -> Reader

Jacket (dress jacket) -> Installing reader on ATM

Trousers -> Pinpad

Dress trousers -> Installing pinpad on ATM

Ironing jacket -> Charging battery of reader

Ironing trousers-Charging battery of pinpad

Cover -> Big panel, on which pinpad placing

Piece of iron , box, parking -> ATM

Stuff -> Cards or tracks

Second step -> Cashing

Institute -> Bank (like Finance institute)

Observer -> Person, who take care of all working

Fitter -> Person, who install and take off device

Inhabitant -> Cardholders

Side-show -> Time of device working (ex: today a lot of inhabitant on side-show)

Sofa -> Model of ATM

Citroen -> Model of ATM

Flat -> Model of ATM

Toothed -> Model of ATM

Disco -> Model of ATM

Tourists -> Group of workers who must install device

Chief -> Head of group

Harvest -> Stuff from one ATM

==================================================
SOME OTHER TERMS:
==================================================

Automated Clearing House (ACH) -> the automated clearing house. The voluntary association of depositors, which achieves clearing of checks and electronic units by the direct exchange of means between the members of association.

AMVA -> Association of American Motor Vehicle Agencies

ACCOUNT NUMBER -> A unique sequence of numbers assigned to a cardholder account that identifies the issuer and type of financial transaction card.

ACQUIRER -> A licensed member that maintains the merchant relationship and acquires the data relating to a transaction from the merchant or card acceptor and submits that data into interchange, either directly or indirectly.

ADDRESS VERIFICATION SERVICE -> A fraud prevention tool designed for mail order, telephone order and Internet transactions.

AMC -> American Magnetics Corporation

AUTHORIZE -> A process defined in operations regulations whereby a transaction is approved by or on behalf of an issuer; commonly understood to be receiving a sales validation by the merchant, by telephone, or authorization terminal.

AUTOMATED TELLER MACHINE (ATM) -> An unattended, magnetic stripe-reading terminal that dispenses cash; accepts deposits and loan payments; enables a bank customer to order transfers among accounts and make account inquiries.

BANKCARD -> A debit or credit card issued by a bank or other financial institution, such as a MasterCard card or Visa card. BIOMETRICS -> Biometrics utilize “something you are” to authenticate identification. This might include fingerprints, retina pattern, iris, hand geometry, vein patterns, voice password, or signature dynamics. Biometrics can be used with a smart card to authenticate the user. The user’s biometrics information is stored on a smart card, the card is placed in a reader, and a biometrics scanner reads the information to match it against that on the card. This is a fast, accurate, and highly-secure form of user authentication.

BIT (Binary Digit) -> The smallest unit of information in a binary system: a 1 or 0 condition.

BPI -> Bits Per Inch.

BYTE -> A binary clement string functioning as a unit. Eight-bit bytes are most common. Also called a “character”.

BUSINESS CARD -> A Business card is similar to the Corporate card, but issued to a business with a few employees and where each employee is responsible for their purchases.

CARDHOLDER -> The customer to whom a card has been issued or the individual authorized to use the card.

CARDING -> Credit card fraud. Carding texts offer advice on how to make credit cards, how to use them, and otherwise exploit the credit card system.

CASH DISBURSEMENT -> A transaction that is posted to a cardholder’s credit card account in which the cardholder receives cash at an ATM, or cash or travelers checks at a branch of a member financial institution or at a qualified and approved agent of a member financial institution.

CIRRUS SYSTEM INCORPORATED -> A wholly owned subsidiary of MasterCard International Incorporated, operates the international ATM sharing association known as “Cirrus® ATM Network.”

COB -> Change of billing. Used for online carding, to change the billing address of a card since Online Stores will only ship large items if the billing and shipping address match. You can obtain these from vendors in CP. Once you have this, you can easily change the card address to that of your drop so that the stores ship items to your drop, since the billing and shipping addresses will match.

CLEANING -> The process of exchanging financial transaction details between an acquirer and an issuer to facilitate posting of a cardholder’s account and reconciliation of a customer’s settlement position.

CO-BRANDED CARD -> A credit card issued by a member bank and a merchant, bearing the “brand” of both.

CARDJET CARDS -> Teslin®-based, CR-80 size cards with a surface that is specially formulated for thermal inkjet printing. CardJet Inks bond to cards and dry instantly, without smearing. CardJet cards stand up well to abrasion, dye-migration and UV fading.

Continuous Acqusition and Life-cycle Support (CALS) -> the integrated system of the production guaranteeing, purchase and expluatation. This system makes possible to computerize all data about the design, development, production, servicing and the propagation of the production.

CHECK READER -> A peripheral device used to read encoded information on a check to be transmitted and processed by a computer or register for authorization and approval.

COERCIVITY -> The measure of how much magnetic force is needed to change the state of a magnetized element. The higher the coercivity, the more force is needed. There are two types of magnetic stripe cards, low coercivity and high coercivity. While low coercivity cards can be erased if they get too close to a common magnet, high coercivity cards are not as easily erased.

COLOR MATCHING -> Several color matching options are included with FARGO Card Printer/Encoders. These options are built directly into the printer driver so they are easily selected. Colors print with more clarity, detail, and accuracy.

COLOR MONITOR -> A monitor that displays data and graphics in color. Color monitors vary in the number of colors, dot-pitch and intensities they can produce.

COMMPORT -> Communications Port. Most IBM compatible computers have from one to four commports used to communicate with devices attached to the computer (COM1, COM2, COM3, COM4). You need a commport to communicate with the 712 Encoder.

COMMUNICATION PROTOCOL -> The rules governing the exchange of information between devices on a data link.

CONTACT SMART CARD ENCODER -> The contact smart card encoder connects the ISO contact pins mounted on the e-card docking station to a Gemplus GemCore 410 smart card coupler mounted inside the printer. The GemCore 410′s digital I/O is converted to a RS-232 signal which is accessible to application programs through a dedicated DB-9 port on the outside of the printer labeled “Smart Card.”

CONTACTLESS SMART CARD ENCODER -> The contactless smart card encoder connects an antenna mounted on the e-card docking station to a Gemplus GemEasyLink 680SL coupler mounted inside the printer/encoder. Application programs can access Mifare® contactless cards via a RS-232 signal through a dedicated DB-9 port on the outside of the printer labeled “Mifare/Contactless.”

CONTROL NUMBERS -> Measure card usage and be used as a tracking device if the card is lost. ID Services will print these on cards after the numbers have been supplied.

CREDIT CARD AUTHORIZATION -> The process in which a credit card is accepted, read and approved for a sales transaction. Credit card authorization is normally accomplished by reading a credit cared through a credit card reader that is integrated into a register or stand-alone reading device. Generally, pertinent credit information is transmitted via a modem and telephone line to a credit card “clearinghouse”. The clearing house (authorization source) communicates with the credit card’s bank for approval and the appropriate debit amount of the sale.

CREDIT CARD READER (Magnetic Stripe Reader) -> A device that reads the magnetic stripe on a credit card for account information to automatically be processed for a transaction. A credit card reader is either integrated into a register, attached onto a register as a separate component or is part of a stand-alone terminal dedicated for the sole function of processing credit card transactions.

CURSOR -> A blinking symbol on the screen that shows where data may be entered next.

CUSTOMER POLE DISPLAY -> A peripheral device designed to show customers information about their transaction. This information normally consists of a description and price of the product they are purchasing. Customer pole displays are also used to display marketing information and other messages.

COMMERCIAL CARDS -> This is the formal name for a group of cards issued to businesses, commercial organizations and governments. Types of commercial cards include: Corporate Card, Purchase Card, and Business Card. Corporate card A Corporate card is usually issued to the employees of a corporation, where the corporation assumes all liability for the card’s usage. These tend to be to larger corporations.

CURRENCY CONVERSION -> The process by which the transaction currency is converted into the currency of settlement or the currency of the issuer for the purpose of facilitating transaction authorization, clearing and settlement reporting. The acquirer determines the currency of the transaction; the currency of the issuer is the preferred currency used by the issuer, and most often, the currency in which the cardholder will be billed.

DEBIT CARD -> A plastic card used to initiate a debit transaction. In general, these transactions are used primarily to purchase goods and services and to obtain cash, for which the cardholder’s asset account is debited by the issuer

DECODE -> A term used to describe the process of interpreting scanned or “read” information and presenting it in a usable fashion to the computer.

DENSITY -> Defined in bits per inch (BPI), recording density is the number of information bits which are recorded on one inch of a magnetic strip.

DIRECT THERMAL -> Direct thermal is a printing technology method in which the printer utilizes a paper that reacts chemically to heat. The label rolls are coated with a thermo-sensitive layer that darkens when exposed to intense heat. Direct thermal printers require no ink or ribbon and are typically used when a bar code label needs to endure for a year or less.

DIRECT-TO-CARD (DTC) PRINTING -> The Direct-to-Card printing process prints digital images directly onto any plastic card with a smooth, clean, glossy PVC surface.

DISKETTE / FLOPPY DISK -> A flexible disk which holds information that can be read by the computer.

DOS (Disk Operation System) -> The standard operation system for all computers advertised as “IBM Compatible”.

DOT-MATRIX PRINTER -> A printer that forms characters or images using a matrix of pins that strike an inked ribbon.

DOWNLOADING -> The process of sending configuration parameters, operating software or related data from a central source to remote stations.

DPI (dots per inch) -> Measurement of a printer’s resolution. Example: 600 dpi indicates that the printer can produce 600 dots of color in each inch of a card. NOTE: When judging color reproduction for a CardJet Card Printer, the inkjet resolution must be at 2400 dpi or better to achieve the color equivalent of a 300 dpi dye-sub printer.

DUAL HOPPERS -> Select FARGO Card Printer/Encoders provide a dual-stack, 200 card capacity Card inp<-b>ut Hopper. This unique dual hopper allows you to load up to 200 of the same type of card for maximum card production or allows you to load a different stack of cards into each hopper for added versatility and efficiency. Loading two different stacks of cards is often beneficial if, for example, you are using two types of preprinted card backgrounds (i.e. gold cards versus silver cards) in order to more easily distinguish between two types of members, employees, students, etc.

DUAL TRACK -> A type of credit cared reader that is capable of reading both Track 1 and 2 on a credit card.

DYE-SUBLIMATION -> Dye-sublimation is the print process FARGO Card Printer/Encoders use to print smooth, continuous-tone, photo-quality images. This process uses a dye-based ribbon roll that is divided into a series of color panels. The color panels are grouped in a repeating series of three separate colors along the length of the ribbon: Yellow, Magenta, and Cyan (YMC). As the ribbon and card pass simultaneously beneath the Printhead, hundreds of thermal elements heat the dyes on the ribbon. Once the dyes are heated, they vaporize and diffuse into the surface of the card. Varying the heat intensity of each thermal element within the Printhead makes it possible for each transferred dot of color to vary saturation. This blends one color into the next. The result is continuous-tone, photo-realistic color images.

Debit Card -> Card, which resembles the credit card by the method of using, but making possible to realize direct buyer account debiting at the moment of the purchase of goods or service.

Delivery Versus Payment (DVP) -> the system of calculations in the operations with the valuable papers, which ensures the mechanism, which guarantees that the delivery will occur only in the case of payment and at the moment of payment.

Direcht debit -> payment levy method, mainly, with the repetitive nature (lease pay, insurance reward, etc.) with which the debitor authorizes his financial establishment to debit his current account when obtaining of calculation on payment from the indicated creditor.

Electronic Fund Transfer (EFT) -> the remittance of means, initiated from the terminal, telephone or magnetic carrier (tape or diskette), by transfer of instructions or authorities to financial establishment, that concern to the debiting or crediting of the account (see Electronic Fund Transfer/Point of Sale -> EFT/POS).

Electronic Fund Transfer/Point of Sale -> EFT/POS -> debiting from the electronic terminal, for the means transfer purpose from the account of a buyer into the payment on the obligations, which arose in the course of transaction at the point of sale.

E-CARD DOCKING STATION -> FARGO provides an optional e-card docking station on select models that can be ordered with encoders for one, two or three different types of e-cards. These printer/encoders allow application software to read and/or store information in the memory of e-cards. The optional encoders provide everything needed for an application program to communicate with a specific type e-card through a standard RS-232 interface. The FARGO e-card docking station comes standard with the read/write pins (as defined by ISO) needed to communicate with contact smart cards. The e-card docking station can also be ordered with a magnetic stripe encoder for either an ISO magnetic stripe that supports dual high/low coercivity tracks 1, 2 and 3 or a JIS II magnetic stripe.

E-CARD ENCODER -> Select FARGO Card Printer/Encoders support reading and/or storing information in up to three different types of e-cards: ISO 7816 contact smart cards, Mifare® contactless smart cards and HID proximity cards.

EDGE-TO-EDGE -> Refers to the maximum printable area on a card. Printer/Encoders with edge-to-edge printing capability can print just to the edge of a card resulting in printed cards with virtually no border.

EMBOSSING -> Raised characters are produced through the use of a male and female die brought together by pressure applied above and below a marking surface. Embossing is ideal for variable information data cards, strip tags, and identification molding processes.

EBT (ELECTRONICS BENEFITS TRANSACTION) -> Allows governments to implement social aid programs such as food stamps through the use of a magnetic-stripe card, which can be accepted at merchant locations set up to accept this plan.

ELECTRONIC DRAFT CAPTURE (EDC) -> A system in which the transaction data is captured at the merchant location for processing and storage.

ELECTRONIC FUNDS TRANSFER (EFT) -> A paperless transfer of funds initiated from a terminal, computer, telephone instrument, or magnetic tape.

EMBOSS-The process of printing identifying data on a bankcard in the form of raised characters.

ENTERPRISE -> An “enterprise” e-commerce solution indicates technology for a large business enterprise. This usually involves a number of systems that are required to interface with each other as well as a central database management system. The design and management of an enterprise solution can be very complex.

EMULATION -> The imitation of a computer system, performed by a combination of hardware and software, that allows programs to run between incompatible systems.

ENCODER -> A device used to write data onto magnetic stripe cards.

EPROM -> Read-only, non-volatile, semi-conductor memory that is erasable via ultra violet light and reprogrammable.

EXPANSION BOARD / EXPANSION SLOT -> The optional device board that is usually added inside the system cabinet at an available expansion slot.

FACTORING -> Also known as laundering. When a merchant submits transactions for another merchant that were not conducted at the original merchant’s business establishment, this is known as factoring.

FIRMWARE -> A computer program or software stored permanently in PROM or ROM.

FIELDS -> A specific position on each track where data may be written or read.

FIXED DATA -> Data which doesn’t change. In Card Template, data remains constant from encoding session to encoding session. This means that, until it is modified, each card will encoded with this information. In Set-Up/Encode Fields, data is fixed.

FOIL -> Decorative foils are applied to cards with heat. If you have a specific foil in mind, we can apply it for you, ID Services has a wide variety to choose from.

HAND-HELD DATA COLLECTOR -> See Portable Data Collector

HARD DISK DRIVE -> Enclosed disk drive that contains one or more metallic disks for data storage. A hard disk has many times the capacity of a diskette.

HIGH COERCIVITY -> See coercivity.

HIGH-VOLUME PRINTING -> Fast, efficient printing for producing large quantities of cards with minimal down time for supplies loading or maintenance.

HIGH DEFINITION PRINTING™ (HDP™) -> The High-Definition Printing process prints full-color images onto clear HDP transfer film. The HDP film is then fused to the card through heat and pressure via a heated roller. This revolutionary technology enhances card durability and consistently produces the best card color available – even on tough-to-print matte-finished cards, proximity cards, and smart cards.

HIGH SPEED PRINTING -> FARGO Card Printer/Encoders are among the fastest desktop card printer/encoders in the industry. High-speed printing allows for more efficient card production – saving time, money, and resources.

HOLOGRAM -> This security feature prevents the reproduction of ATM/Bank cards and credit cards. ID Services has a variety of holograms to choose from or will apply your own custom hologram.

HOST COMPUTER -> A central computer, such as a mainframe computer at a company’s headquarters or central office. The central computer in a star network.

ISO -> International Standards Organization specification for magnetic stripe encoding. The FARGO encoder supports dual high/low coercivity and tracks 1, 2 and 3.

ID CARDS -> An important record-keeping tool for hospitals, nursing homes, healthcare providers, insurance companies and colleges/universities are ID cards. ID Services offers them in four sizes, CR50, 60, 70 and 80, to fit any standard imprinting or embossing system. ID Services offers a variety of card compositions to meet the needs of the specific application. Composite cards are recommended for College/University ID’s due to their flexibility and long life span.

Integrated Circuit (IC) Card -> It is known also as chip card. Card equipped with one either several computer micros-chip or integrated microcircuits for identification and storing of data or their special treatment, utilized for the establishment of the authenticity of personal identification number (PIN), for delivery of permission for the purchase, account balance checking and storing the personal records. In certain cases, the card memory renewal during each use (renewed account balance).

International Standardisation Organisation (ISO) -> International organization, which carries out standardization, with the staff office in Geneva, Switzerland.

IN-COUNTER SCANNER -> A bar code scanner that normally has multiple laser beams emitting from it to read bar codes in high-speed environments (i.e. grocery stores). An in-counter scanner is usually mounted into a countertop so that products can quickly and easily be passed over the scanner for bar code reading.

IMPRINTER -> A device supplied to the merchant to produce an image of the embossed characters of the bankcard on all copies of sales drafts and credit slips.

ISSUER -> A member that enters into a contractual agreement with MasterCard or Visa to issue MasterCard or Visa cards.

JIS II -> Japanese Industrial Standard for magnetic stripe encoding, published and translated into English by Japan Standards Association.

KEYLOCK CARDS -> Hotels and resorts all over the world are changing the traditional door locks to electronic swipe key cards. Keylock cards are becoming a necessity to keep hotel guests safe. For excellent performance, the cards must match the system and the applications. ID Services offers roll-on magnetic stripes as well as laminated magnetic stripes in both high energy and low energy coercivity with the hotel and/or its logo perfectly printed.

KEY GENERATOR -> Any tool designed to break software copy protection by extracting internally-stored keys, which can then be entered into the program to convince it that the user is an authorized purchaser.

KEY LOGGER -> (Keystroke Logger). A program that runs in the background, recording all the keystrokes. Once keystrokes are logged, they are hidden in the machine for later retrieval, or shipped raw to the attacker. The attacker then peruses them carefully in the hopes of either finding passwords, or possibly other useful information that could be used to compromise the system or be used in a social engineering attack. For example, a key logger will reveal the contents of all e-mail composed by the user. Keylog programs are commonly included in rootkits and RATs (remote administration trojans).

LCD DISPLAY -> The LCD – or Liquid Crystal Display – shows the current status of the printer, and changes according to the printer’s current mode of operation. LCD communicates an error with text, which is easier to interpret than LED lights.

LOW COERCIVITY -> See coercivity.

LASER SCANNER -> A bar code scanner that utilizes laser technology. These scanners emit laser beams that read bar codes. Laser scanners have “depth of field” which enables them to read bar codes from short distances away (6″ to a few feet).

LED (Light Emitting Diode) -> A semiconductor light source that emits visible light or invisible infrared radiation.

LOCKABLE HOPPER -> Some FARGO Card Printer/Encoders provide a lockable Card Hopper Door. This lock is intended to help prevent theft of your blank card stock. This feature is especially helpful if using valuable card stock such as preprinted cards, smart cards, or cards with built-in security features such as holograms.

MAGSTRIPE STRIPE -> The magnetically encoded stripe on the bankcard plastic that contains information pertinent to the cardholder account. The physical and magnetic characteristics of the magnetic stripe are specified in ISO Standards 7810, 7811, and 7813.

MAGNETIC STRIPE READER -> A device that reads information recorded on the magnetic stripe of a card.

Magnetic Ink Character Recignition (MICR) -> System, which ensures the machine reading of the information, substituted by magnetic inks in the lower part of the check, including the number of check, the code of department, sum and the number of account.

MEMBER -> An institution that participates in the programs offered by MasterCard International Incorporated.

MERCHANT -> A retailer, or any other person, firm, or corporation that (pursuant to a merchant agreement) agrees to accept credit cards, debit cards, or both, when properly presented.

MAS (Merchant Accounting System) -> The Vital back-end system that handles settlement, interchange and billing.

MERCHANT BANK -> A bank that has entered into an agreement with a merchant to accept deposits generated by bankcard transactions; also called the acquirer or acquiring bank.

MCC (MERCHANT CATEGORY CODE) -> Four-digit classification codes used in the warning bulletin, authorization, clearing, and settlement systems to identify the type of merchant business in various stages of transaction processing.

MMS (MERCHANT MANAGEMENT SYSTEM) -> The Vital front-end system that handles point of sale functions such as terminal types, cut-off times, etc.

MOTO (MAIL ORDER/TELEPHONE ORDER) -> A transaction initiated by mail or telephone to be debited or credited to a bankcard account.

MAGNETIC STRIPE -> The black stripe found on the back of most credit cards and many other types of identification cards and drivers licenses. Used to encode and read data, usually identifying the owner of the card.

MAGNETIC (“MAG”) STRIPE -> Mag Stripe refers to the black or brown magnetic stripe on a card. The stripe is made of magnetic particles of resin. The resin particle material determines the coercivity of the stripe; the higher the coercivity, the harder it is to encode -> and erase -> information from the stripe. Magnetic stripes are often used in applications for access control, time and attendance, lunch programs, library cards, and more.

MAGNETIC STRIPES -> Offered in five different sizes and are available in both low coercivity (300 oersteds) and high coercivity (2750 (USA), or 4000 (European) oersteds.)

· 1/8″ Covers one track (HEM only)

· 5/16″ Covers two tracks

· 6/16″ Covers three tracks (3/8″)

· 7/16″ Covers three tracks

· 8/16″ Covers three and one half tracks (1/2″)

· 9/16″ Covers four tracks (super stripe)

· We can apply roll-on magnetic stripes as well as flush laminated magnetic stripes.

For additional security ID Services offers holo-magnetic stripes. The stripes are custom made with your company name appearing in the stripe. Multiple magnetic stripes can be applied to each card.

MAGNETIC STRIPE READER -> See Credit Card Reader

MASTER REGISTER -> A cash register that acts as the central register or “file server” in a multiple register environment. The master register normally controls “slave” registers that are networked and cable to it.

MEGABYTE -> A unit of measure that consists of 1,014 bytes.

MICROCOMPUTER (Personal Computer) -> A small. low cost computer originally designed for individual users. Recently, microcomputers have become powerful tools for many businesses that, when networked together, have replace minicomputers and in some cases mainframes and information tools.

MICRO-PRINTING -> Very small text printed into the plastic card and generally look like thin lines to the naked eye. The text is printed at 9600 dpi (dots per inch) and require a magnifying glass to view the micro-printed text. Desktop card printers print at 300 dpi and can not reproduce micro-printing making micro-printing a very handy feature when checking for counterfeit cards.

MICROPROCESSOR -> Integrated circuit chip that monitors, controls and executes the machine language instructions.

MICR READER -> MICR is an acronym for Magnetic Ink Character Recognition. MICR Readers are normally used to read the encoded information within the ink on a check.

MODEM (Modulator – Demodulator) -> A device used to convert serial digital data for transmission over a telephone channel, or to reconvert the transmitted signal to serial digital data for acceptance by a receiving terminal.

MONOCHROME MONITOR -> A monitor that displays characters in only one color, such as amber or green.

MULTI-USER -> Multi-user systems consist of two or more computers that are connected together and that share data and peripherals. A multi-user system includes a host computer (file server) and one or more stations. All stations share the same hard disk and may share other devices such as printers.

MTBF (Mean Time Between Failures) -> The average time between failures of a particular device based on statistical or anticipated experience.

NETWORK -> A communications system connecting two or more computers and their peripheral devices.

NETWORK CARD -> An expansion card that is installed in an available slot in a computer so that it may connect and communicate to another computer.

OPERATING SYSTEM -> System that consists of several programs that help the computer manage its own resources, such as manipulating files, running programs and controlling the keyboard and screen.

OUTPUT STACKER -> The Output Stacker stores printed cards in a first-in/first-out order. This feature makes it easy to keep printed cards in a specific order for faster issuance or to print serialized cards.

OVERSIZED CARDS -> Oversized cards are used for more efficient visual identification and are available in many non-standard sizes. The most popular sizes are CR-90 (3.63″ x 2.37″/92mm x 60mm) and CR-100 (3.88″ x 2.63″/98.5mm x 67mm).

OVERLAMINATE -> Protective clear or holographic material designed to offer advanced card security and durability. Two types are available from FARGO: Thermal Transfer Overlaminate is a .25 mil thick material that enhances card security and durability. PolyGuard Overlaminate is available in a 1 mil and .6 mil thick material and provides extraordinary protection for applications that require highly durable cards.

OVERLAY PANEL -> The clear overlay panel (O) is provided on dye-sublimation print ribbons. This panel is automatically applied to printed cards and helps prevent images from premature wear or UV fading. All dye-sublimation printed images must have either this overlay panel or an overlaminate applied to protect them.

OVER-THE-EDGE -> Refers to the maximum printable area on a card. Printer/Encoders with over-the-edge printing capability can print past the edge of a card resulting in printed cards with absolutely no border.

PARALLEL TRANSMISSION -> Transmission mode that sends a number of bits simultaneously over separate lines. Usually unidirectional.

PERIPHERAL DEVICE -> Hardware that is outside of the system unit, such as a disk drive, printer, cash drawer or scanner.

POLLING -> A means of controlling devices on multi-point line. Usually utilized to send/receive information via modem from remote computers to a central computer.

POLYGUARD™ -> A card overlaminate available in 1 mil and .6 mil thicknesses that provides extraordinary card protection; ideal for harsh or more secure environments. Available as clear or with embedded holographic-type security images.

POS (Point-of-Sale) -> Term normally used to describe cash register systems that record transactions or the area of “checkout” in a retail store.

PIN NUMBERS -> This security feature will activate usage of the card. Once the numbers have been supplied from our customers, ID Services can apply them to the customer cards.

PINPAD -> A “pin pad” is a small keyboard that normally contains numeric keys. PIN is an acronym for personal identification number which is normally entered into the keyboard “pad” to verify account information for a transaction (i.e. similar to an automated teller machine).

PORTABLE DATA COLLECTOR -> A hand-held computer that can be used as a stand alone portable unit for point-of-sale, inventory, receiving and other applications. A portable data collector is normally a temporary storage device that gathers information and downloads data into a main or central computer.

PROGRAMMABLE KEYBOARD -> A keyboard that is capable of being configured and programmed in a variety of ways. Programmable keyboards allow keys to represent special departments, functions, product, etc.

PROJECTION SCANNER -> A type of bar code reader that is normally placed vertically, and that projects laser beams horizontally to scan bar codes. Often used when high performance and speed to reading bar codes is critical.

PROTOCOLS -> A set of rules for the exchange of information, such as those used for successful data transmission.

PROXIMITY (“PROX”) CARD -> Proximity cards allow access and tracking utilizing contactless technology (usually by communicating through a built-in antenna).

PROX CARD ENCODER -> The prox card encoder uses a HID ProxPoint® Plus reader mounted on the e-card docking station inside the printer/encoder. The ProxPoint is a “read only” device producing a Wiegand signal that is converted to RS-232 using a Cypress Computer Systems CVT-2232. Application programs can read information from HID prox cards via a RS-232 signal through a dedicated DB-9 port on the outside of the printer labeled “Prox.”

PVC (POLYVINYLCHLORIDE) -> These cards are manufactured for mechanical style embossing and to be our least expensive card option. They are available in 23 different colors and three different card finishes. Heat distortion occurs at 130°F and the cards will flex approximately 2,500 flex cycles. Estimated normal card life: 18 months.

PDF (PORTABLE DOCUMENT FORMAT -> Adobe’s file format is the de facto standard for electronic document distribution. It is the preferred means of distributing documents online because it preserves fonts, formatting, colors and graphics regardless of the application or platform used to create it. The Adobe Acrobat Reader, required to read PDF files, is available free from the Adobe web site.

PIN PERSONAL IDENTIFICATION NUMBER) -> A four-to-12 character secret code that allows an issuer to positively authenticate the cardholder for the purpose of approving an ATM or terminal transaction occurring at a point-of-interaction device.

POTS (PLAIN OLD TELEPHONE SERVICE) -> The standard analog telephone service with no enhancements like call waiting, etc.

PURCHASE CARD -> The Purchase card is issued to corporations, businesses and governments. It provides control over daily and monthly spending limits, total credit limits, and where the card may be used. It also reduces the administrative cost associated with authorizing, tracking, paying, and reconciling those purchases. Many employees may be issued the same card number.

RAM (Random Access Memory) -> Temporary storage that holds the program and data the CPU is processing.

RESIN THERMAL TRANSFER -> Resin Thermal Transfer is the process used to print sharp black text and crisp bar codes that can be read by both infra-red and visible-light bar code scanners. It is also the process used to print ultra-fast, economical one-color cards. Like dye-sublimation, this process uses a thermal Printhead to transfer color from the ribbon roll to the card. The difference, however, is that solid dots of color are transferred in the form of a resin-based ink which fuses to the surface of the card when heated. This produces very durable, single-color images.

RSA -> the coding and autentification technology, developed in 1977 in MIT by Rivest, Shamir and Adel’man, which subsequently opened their own company RSA Data Sechurity, Inc., purchased recently by the company Security Dynamics Technologies, Inc.

Real-Time Gross Settlement (RTGS) -> the payment method, with which the transfer of means is achieved for each transaction in obtaining of instructions about the payment. Decrease the risk with the payment.

Smart Card -> card equipped with integrated circuit and microprocessor, capable to carrying out the calculations.

System risk -> the risk, with which the incapacity of one of the payment system participants either financial market participants as a whole to fullfill their obligations causes the incapacity of other participants or financial establishments to fulfill its obligations (including obligations regarding the realization of calculations in means transfer systems) properly. This failure can cause significant liquidity or crediting problems and, as result, it can cause loss to the stability of financial markets (with the subsequent action on the level of economic activity).

SCALE -> A scale is a peripheral device used to record the weight of an item and transmit the amount to a computer for processing.

SCRATCH-OFF PANELS -> Applied through hot stamping or silk screening. Typically they are used to cover pin numbers on pre-paid phone cards.

SERIAL TRANSMISSION -> Transmission mode that sends data one bit at a time. In most cases, in personal computers, serial data is passed through as RS232 serial interface port.

SIGNATURE CAPTURE -> A peripheral device that electronically captures an individual’s signature for customer identification and transaction applications.

SLAVE REGISTER -> A cash register that is driven by a “master” register in a multiple register environment.

SMART CARD -> A smart card contains a “chip” with memory and is typically used to hold customer account information and a “balance” of money similar to a checking account. The card is inserted into a device that can read and write to it updating information appropriately.

SMART CARD -> Smart cards have an embedded computer circuit that contains either a memory chip or a microprocessor chip. There are several types of smart cards: Memory, Contact, Contactless, Hybrid (Twin), Combi (Dual Interface), Proximity and Vicinity.

SMARTGUARD™ -> SmartGuard is a printer security option that uses a custom access card and a built-in reader to restrict printer access. With this feature, only those with a valid access card can print cards. This makes both your printed cards and your overall system more secure.

SMARTLOAD™ -> SmartLoad is an exclusive FARGO technology used in CardJet Card and Ink Cartridges to advise you on the status of your CardJet supplies. In CardJet Ink Cartridges, SmartLoad technology reports the number of prints remaining in the cartridge and alerts you when ink is low or out. In CardJet Card Cartridges, SmartLoad technology tells you to install a new cartridge when the card supply runs out.

SMARTLOAD CARD CARTIDGE -> Cartridge that is pre-loaded with CardJet Cards at the factory. They snap into the back of the printer in just seconds. SmartLoad technology inside the cartridges alerts you to install a new cartridge when the card supply runs out.

SMARTLOAD INK CARTIDGE -> CardJet Ink Cartridges are available with both full-color and black (used for infrared bar codes only) inkjet inks. Cartridges snap into the printer just like the cartridges used in other familiar office or home inkjet printers. SmartLoad technology inside the cartridges reports the number of prints remaining in the cartridge and alerts you when ink is low or out.

SMARTSHIELD™ -> This option allows the printer/encoder to print custom, reflective security images on the card that fluoresce under a black or UV light source.

SOLENOID -> Solenoids are commonly used in “dumb” cash drawers and incorporate a cable connected trigger which releases the drawer. Cash drawers with solenoids are interfaced to receipt printers that “drive” them. Solenoids have different voltages and are integrated into the cash drawer dependent on the printer they are interfaced to.

STANDARD CARDS -> The standard card size is CR-80. CR-80 dimensions are 3.375″ x 2.125″ (85.6mm x 54mm).

THERMAL TRANSFER -> Thermal transfer is a printing technology method in which printers use regular paper and a heat sensitive ribbon. The ribbon deposits a coating of dark material on the paper when exposed to intense heat. Thermal transfer printers produce a more durable label that won’t fade as quickly as direct thermal labels and are often used when a label needs to endure longer than a year.

THERMAL TRANSFER OVERLAMINATE -> A card overlaminate available in a .25 mil thickness that increases card security and durability; often used for moderate durability applications or when additional security (such as holographic images) are needed.

TILL -> The paper money and currency tray that holds money in a cash drawer. Tills are usually available in 4 or 5 till versions, available with lock and cover and are removable.

TRACK -> One of up to three portions of a magnetic stripe where data can be written.

TRACK 1 -> Track one is a “track” of information on a credit card that has a 79 character alphanumeric field for information. Normally a credit card number, expiration date and customer name are contained on track 1.

TRACK 2 -> Track two is a “track” of information on a credit card that has a 40 character field for information. Normally a credit cad number and expiration date are contained on track 2.

TRACK3 -> Track three is a “track” of information on a credit card that has 107 character field for alphanumeric information. Normally a credit card number, expiration date and room for additional information are available on track 3.

Truncation -> procedure, which makes it possible to limit the physical displacements of a paper document, in the ideal version, by the bank of the first presentation, by the replacement by electronic transfer of entire or part of the information, which is contained on this document (check).

Tipper -> a machine designed for use with PVC plastic cards to create raised print. (basically a plastic card embosser)
UNIX -> UNIX is a terminal based operation system in which “dumb” terminals are communicating back to a “smart” processing unit or host.

UPS -> An acronym for uninterruptible power source. A UPS is primarily used as a back up power source for computers and computer networks to insure on-going operation in the event of a power failure. Sophisticated units also have power conditioning and power monitoring features.

UV INKS -> most commonly used to put hidden graphics and text on a plastic card. The inks are invisible until the card is subjected to a certain colored light (for instance, when placing a California drivers license under a black light the image of the California flag will become visible in green and orange.) UV inks are used as an aid in detecting counterfeit cards. They come in a variety of colors and can react to different colored lights. Desktop card printers are unable to print UV ink.

VARIABLE DATA -> is information which changes with each encoding session or on a card-by-card basis.

VERTICAL SCANNER -> See Projection Scanner.

WAND -> A pen-shaped bar code scanner that emits a beam from the end or tip of the wand. Wands are older, bar code reading technology but inexpensive and still widely used where speed and performance are not crucial.

WEDGE -> A wedge decodes “read” data (i.e. bar codes, credit cards) and communicates that information through a keyboard port on a computer. The keyboard plugs into the wedge and the wedge device plugs into the computer where the keyboard was. Sophisticated wedges can accept a few different peripheral devices. Also See Decode

I’m up late doing some last minute planning for BSidesBay, a community organized security unconference happening at the HackerDojo in Mountain View, CA on 12/12.  I’m rather excited about meeting new people, old friends, and experiencing the birth of a new event.  This is truly a first for many of us and I hope it’s just as exciting for all in attendance.

Before we begin here are some useful links and references:

• Twitter: @SecurityBSides
• UStream channel
• Hashtag: #BSidesBay

BSidesLasVegas

This will be my first Security B-Sides event, though the second to occur.  The first was BSidesLasVegas that exploded on the scene earlier this year.  Ok, perhaps exploded is a little strong as it was off the main LV strip with a location only disclosed the day of the event.  Still, about 100 people come to this free hacker event which was covered by several media outlets including ZDNet, Dark Reading, Hacker News Network, and many other blogs.

Created in a little under three weeks lead time, a few key people hosted and put on an event that rocked the concept of conferences all together.  Jack Daniel, Chris Nickerson, and Jeff Espinoza worked hard to maintain this train on track during the 2+ days that it ran.

Those in attendance enjoyed a 10,000 sq ft house, pool, free vending machine (hacked of course), awesome presentations, and for once an opportunity to meet and mingle with the presenters and attendees alike.  This event happened in parallel with NeighborCon, a group of hardware hackers lead buy Travis Goodspeed, famous for the GoodFET chip, and Jeff Espinoza.

BSidesBay

A number of things came out of the first event, none the least of which was the desire to spread the unconference love and host more organic, locally grown events.

Allison Miller organized BSidesBay by tasking out roles and responsibilities to others, in true chaordic form.  First the venue, then the food, supplies, presenters, attendees.

• Ally organized and procured the HackerDojo event space and several speakers & will be MC’ing the event
• Trey Ford stepped in with his Big Green Egg to cook the food & moderate a panel
• Quinton Jones leveraged McAfee as a sponsor of the food
• Ryan Russell leveraged BigFix as a sponsor of the office supplies
• Casey Greene of the HackerDojo helped coordinate the event location
• Jennifer Leggio helped organize panelists and media conversation
• 40+ participants joined in for collaborative conversation

All of these events use the PBWorks wiki site that enables community participation.  If you want to attend the event you do not call up an event planner or subscribe to a mailing list, you simply edit the event page add yourself!

BSidesBay has already been written up in ZDNet to promote the conversation of security and risk in open platforms.  This event follows the barcamp style format in which there will be 2-keynote panels in the morning and collaborative, chaordic breakout sessions in the afternoon.

The morning panels will include:

• “OWASP & WASC: Impacts on web application security automation”
  • Robert Auger, Staff Information Security Engineer, PayPal
  • Jeremiah Grossman, CTO, WhiteHat Security
  • Brett Hardin, Manager of SMB, Qualys
  • Trey Ford, Manager of SaaS, McAfee (moderator)
• “Keeping Users Secure on Open Platforms”
  • John Adams, Operations Engineer, Twitter
  • Ryan Seu, Security Engineer/Incident Management, Facebook
  • Jeff Wu, Security Project Manager, Facebook
  • Andy Steingruebl, Manager, Secure Development, PayPal

The afternoon panels will include breakout sessions in the following format:

1. People will check out the session wall creating in the morning and gravitate to the Topic Areas they are most interested in.
2. The Topic Area groups will discuss, illustrate, brainstorm, and debate on the area of interest for an hour.
3. Larger group will reconvene to share highlights from their Topic Area.
4. If <5pm, then go to i. Else, wrap up sessions.

If that was not enough, there will be Rock Band available to attendees after the event at the HackerDojo.  We plan to project the screen on a wall and see who can rock out to the Beetles the best.  Come and sing your heart out!

One of my favorite rules to live by is that “nothing is impossible, the impossible just takes longer.”  This is a short story about how the underdogs leveraged their collective to create something much greater than the sum of their individual parts.  Security B-Sides was born out of a realization that all physical events are bound by two most structured rules, that of space and time.

No we are not talking about physics but the simple fact that regardless of the number of smart people in the world all physical events will only have enough physical room for X number of people across Y amount of time.  For many conferences this means physical walls constraining the number of presenters and attendees across a time period of a few days.  Thus a problem arises:  The scarcity of those limited seats increases in proportion to the interest in them.

The Internet is a natural solution with sites like BrightTALK hosting virtual conferences.  Online you are not limited by space and time with every piece of information now accessible any time of day to (virtually) anyone on the planet.  Don’t get me wrong, I’m a huge advocate of social networking but I equally believe that in the absence of physical networking the online social world is little more than high-speed news flashes.  The ghost of the machine is the physical flesh and bone behind them.

Why Security B-Sides?

Security B-Sides is the first do-it-yourself (DIY), grass-roots, open security conference in the world.  B-Sides does to physical events what the Internet did to TV and radio — it expands the spectrum of conversation and gives voice to those further down the long tail.  These events are by security professionals and for security professionals.  It works like this:

1. Not many people have the experience to organize and host a conference.  In addition most events cost money and lots of it.
2. Oh sure, we could do it all for you but where would the fun be in that?
3. Instead of creating an event, we’ve created the infrastructure, tools, and documents, basically conference-in-a-box.  We are lowering the barrier to entry for anyone to create their own local event.
4. And let’s make it free, open to everyone, and publish all the details about how we did it online.

Yeah, that sounds a whole lot better.  Sounds easy huh?  Only by working together can we make the impossible easy.  Only through collaborative, chaordic design do we find order in chaos.  I greatly appreciate the following quote by Dee Hock, Founder and Chairman Emeritus, Visa Inc.

“It is no failure to fall short of realizing all that we might dream.

The failure is to fall short of dreaming all that we might realize”

Birth of a New Machine

I believe that small unconferences are the natural expansion of all events and have been for quite some time.  After the exclusive FOO Camp (Friends Of O’Reilly) a small collective used PBWorks to launch the Barcamp movement.  These small, 1-day events expand the level of physical interaction.  They are more than stuffy sales pitches but typically driven entirely by the geeks that love them.

It is by volunteers alone that these events occur, as people come together to create a day long shrine to knowledge and innovation.  Most recently ZACon, in South Africa,  launched with a great volume of speakers.  Most of the speakers and attendees helped organize the event in one way or another.  They published video recordings of all the talks along with their presentation materials online for free.

The geeks rise again as BSidesBay launches next Saturday (12/12) at HackerDojo in Mountain View, CA.  This event is a tribute to the DIY culture that exists in Silicon Valley and around the world.  Here’s how it works:

• How do I register? Add yourself to the list.
• How do I suggest topics? Add them to the list.
• What materials will be discussed? Check the list and bring your own ideas to share.
• Can I get a list of attendees? For sure, it’s all open and online.
• Will my friends be there? Only if you bring them or they forget to bring you.

Can events like this really work?  They can and do work very well.  Check it out and let us know what you think.

This is only the first of many Security B-Sides events.  Check out the main page and look follow information via twitter or the mailing list (low volume).

I don’t think many people have ever asked themselves what regulatory compliance has in common with immunization, but they should.  The fact of the matter is that these two have more in common than you think and understanding one will help you better understand the other and how to make better educated decisions.  In addition, there are trade-offs — both heath and economic — to the choices one makes in participating in vaccination and immunization programs.  The following addresses a few of these items and opens the doors for further conversation.

Why Comply? Why Vaccinate?

Immunization and vaccination are the process by which an individual or population is treated in order to fortify itself against attack from foreign bodies.  Vaccination against disease can help prevent contracting that pathogen in the future, and preventing multiple individuals in a population from becoming infected helps prevent the widespread outbreak and transmission of diseases such as smallpox, polio, measles, mumps, and anthrax.  By elevating the level of a population that is resistant to such attacks vaccines help protect the entire population from harm.

The problem is that although most all agree that vaccination is positive for the population not everyone agrees that it is positive for the individual.

Since vaccination began in the late 18th century, opponents have claimed that vaccines do not work, that they are or may be dangerous, that individuals should rely on personal hygiene instead, or that mandatory vaccinations violate individual rights or religious principles.

Have we not heard similar arguments against regulatory compliance?  Individuals stating that:

• My environment is already secure
• I know how to manage risk better than the regulatory bodies
• My environment is special and unique and does not fit into your Procrustean boxes

I’ve listened to people sing the virtues of regulatory compliance as often as I’ve heard other individual tell me “that sounds good but it’s not for me.”  I feel as if I’m mediating between the Center for Disease Control (CDC) and a troubled parent about why their child should be vaccinated before entering grade school.

Perspective

Part I

One of the problems with understanding the complexity of the problem is that of perspective.  The CDC and the parent have very different perspectives on vaccines and immunization.  In the same way, the regulatory bodies and those who must comply with them have very different views on how to best apply data security practices.

For example, it is widely known by the payment card industry (PCI) that the majority of small and medium merchants use one of a few brands of payment application.  Many retail merchants use a Micros, VeriFone, or Radiant Aloha (restaurants) point of sale (POS) application.  This high level of homogeneity in a population lends itself to attract attackers (pathogens) who wish to take advantage of any vulnerabilities they can identify in these systems.

The PCI Council, who act as the CDC, along with the card brands mandate that software companies validate their applications against a given security standard (in this case the PA-DSS).  They then introduce these more secure applications into the population and the governing bodies mandate their use over less secure payment applications.

So why not just stop there?  If things were that easy, the CDC would only ever have to worry about one pathogen using one attack vector.  If we secure the retail payment applications, attackers will just move to other industries such as petrol (gas) stations, ski resorts, and florist shops.  To which the industry responds with Dresser Wayne or Gilbarco, SKIDATA, and Teleflora Dove validated payment applications respectively.  The validated payment application program targets to inoculate every industry against the dangers of retaining data most valuable to attackers.

Part II

But what about the individual restaurant owner who says they don’t need a validated payment application?  They claim all the reasons mentioned above from the specialized nature of their business or network to the secure risk management platform they have already implemented.  Why should they comply?

I do not have a good answer to the ‘why’ but I do have one for the ‘how’.  In fact, about 95% of the ‘PCI Wars’ debate going on today try to answer the question of “why” when this is as futile as debating intelligent design vs evolution (because both are based on separate and unequal premises.)  Debating why one should comply is futile as the rules state that everyone who “stores, process or transmits” such data must comply (as per the card brand operating regulations.)

The more interesting question is that of how one should comply.  These examples reference the PCI standards but could apply to just about any regulatory compliance mandate.  The way in which one complies can be taken at a high level.  For the PCI standards it implies preventing the paper and electronic theft of payment card data.  In fact, any way that your company decides to do this implies compliance with the standard.

If parents didn’t mind sending their children to school in hermetically sealed bubbles, then there would be less of a public policy need for them to be vaccinate against disease.  In this way, the parent and child could make their own decision about data security without harming or posing a risk to the rest of the population of school children and their parents.  If your company can, via whatever means at your disposal, hermetically seal itself against attacks then the matter of compliance is simply an exercise for the user in creative documentation, reporting, and compensating controls.  The problem is, many companies over estimate their security controls and thus cause a break in the structure of data security.

Economics of Immunization and Compliance

When approaching the economics of immunization one cannot ignore the population at hand.  For example, a poorer population will benefit more strongly from an immunization program than one that maintains a high level of sanitation, health care, and treatment programs.  To the same degree a more vulnerable population (e.g. retail, restaurants, higher education, e-commerce, etc.) will benefit more from regulatory compliance than one that is more highly secure (e.g. government systems).

In fact, one of the primary catalysts for regulatory compliance is the build up of problems (e.g. data breaches) within an industry followed by the punctuated equilibrium that brings about a response founded in legislative and regulatory action.

The cost of making a population more secure is relatively simple: require them to use more secure applications and systems.  The cost to the individual can vary along with the benefits.  The same applies to vaccines.

One could go their entire professional life without contracting the flu but this is rather rare in my experience.  Instead many people will get the flu vaccine each year on the off chance they will come in contact with the virus because being bed ridden for 1-2 weeks can be both painful and detrimental to the company.

So what!

The cause of action to vaccinate a population is to immunize them from each other.  The process involves a uniform across the board preemptive treatment that is meant to mitigate risks, not prevent them entirely.  In the same way, regulatory bodies craft legislation as a one-size-fits all in order to protect the population from each other.  The individual implementation should see this as guidance and not a rule without exceptions.

The details of how one protects themselves against attack and infection may be unique to each individual, but they still must comply with the overarching industry agreement to protect themselves and thus the population against attacks.  The implementation will vary, of course it will.  One size does not fit all.  But the industry needs a standard, a baseline, against which it can measure risk.  As new infections and outbreaks occur, the industry will change the baseline to match the new attacks.

Those who can visualize the various perspectives will have a greater visibility into how they can better fortify their individual organizations to both validate against industry mandates and manage risk based on their specific organizational behavior.

Do you read the Privacy Law Blog?  Well, if you care about any details behind the 45 different state breach notification laws then you need to check it out.  I’m adding this blog to my RSS feed because it provides detailed analysis of changes to these laws.

One of the most important things I found was “the list” of links to all 45 state breach notification laws!  It’s very impressive.

Recently Nick Selby posted on FudSec his article on Showing the Oblomovs the Door.  For those who care, an Oblomov or Oblomovism is considered a lazy or apathetic person or belief.  The blog post claims that information security professionals are “well-trained, well-intentioned” but “reduced [to] a series of relentless box-ticking” due to being “saddled with compliance management.”

The blog post further claims:

The CEO who lets the Security organization become the compliance department has abdicated to the government and Payment Card Industry his responsibility to understand and manage organizational risk. That is a fiduciary breach of CEO responsibility to shareholders. In addition to firing your ass, this should also be a floggable offense.

I agree one should use compliance as a guideline but manage it with respect to the business process.  I disagree with the fiduciary statement on grounds that one cannot claim a breach based on sparse case study and singularity statements.  The writer says this to bring grandeur to their claim.

The important part of this statement is that we are focused on the individual company here and their personal responsibility.  Remember, if you ever want to get something done don’t pass the buck.

The author, frustrated with the current implementation of compliance, states, “I stomped away from trying to influence security as an analyst because compliance … has managed to suck every ounce of oxygen from the room that is the security industry.”

Let’s just remember that history has shown that in the absence of legislation there exists a downward spiral of corporate responsibility towards protection of customer/consumer information and the well being of others. To support this I point to the moments of punctuated equilibrium that lead to things such as the Food and Drug Administration (FDA), the Securities and Exchange Commission (SEC), marginally improved ecological laws in China, and the current global financial crisis — to name a few.

Let’s also take a moment to remember that regulatory compliance has been raising the bar of information security since 1999, starting with GLBA, then with HIPAA and SOX, and finally with PCI DSS.  Is it because PCI DSS impacts most all business verticals on a global basis that it receives the most abuse from those who feel burned out?

Might I remind you that without such efforts the number of data breaches would be higher, much higher, than we see now because people find it easier to blame someone or something else rather than take personal responsibility for their own work.  The Information Security Management Handbook, by Tipton and Krause, has a section on diffusion of responsibility.

People behave differently based on the perception of being part of a group as opposed to being an individual.  It has been commonly observed that people tend to work less in a group than as individuals when only group output is measured.  People, in addition, tend to feel less responsibility in a group than as a single individual.  The bigger the group, the lower the felt sense of responsibility. Social scientists call this diffusion of responsibility and the phenomenon is commonly observed across all cultures.

I believe that instead of blaming others, we as information security professionals need to become an agent of change starting with ourselves and our current environment and expanding outwards.

The blog then claims:

At this writing it’s unclear whether Black Hat and DefCon demonstrations will include the PCI-compliant account skimmers we’re heard of, but the fact that they’re out there stands testament to the Pyrrhic victory that is the PCI Data Security Standard.

Please remember, the PCI DSS is meant to protect against the electronic and paper theft of payment card data.  It is not meant in any way to prevent credit card skimming. If you wish to raise the issue of skimming, please use the correct approach which is to clarify the need for a more secure payment card.  That of course gives way to the larger question of what is proper capital allocation and the conundrum of offline transactions and backwards compatibility.

I agree, sadly, with the blog post when it says, “PCI is not the minimum standard, it’s the maximum effort that many organizations make.” The question I have is, based on historical precedent (see above): are we better off with or without a carrot-and-stick approach? What impact has HIPAA had on the security of health care records vs PCI on the payment card industry?  In which area do we see more movement?

Certainly, movement does not always imply movement in the correct direction, but I would claim that basic items such as PCI DSS Requirement 3.2 which tells merchants and service providers to not store sensitive authentication date post-authorization has done wonders to the security of our payment card data.  How better to secure the data than to remove it in the first place?  We are seeing trends in this direction more and more in this industry and others.

But isn’t it better to have a minimum standard than none?  What if the minimum was for companies to do nothing?

Jeremiah Grossman stated, “nothing did more to build webappsec awareness than pci-dss. Now we need something to improve webappsec security.” I could not agree more, but let’s please remember that without awareness of a problem you cannot bring clarity or correction. People love to lambaste and transfer responsibility to others, all the while stomping away from personal responsibility.

If your company or those around you fail to see the forest through the trees of ‘industry best practices’ when I wonder if they are fit to run the information security department.  Those who complain that ‘compliance’ is the problem are transferring responsibility to industry standards instead of working to secure their own infrastructure.

Do such standards need correction and evolution to mirror the evolving threat of attackers and the continued evolution of information security practices and technology?  Certainly!  I support Mr. Selby in his goal to drive higher standards and move towards risk management, but let’s do so by taking individual responsibility for our own management of risk.

Mr. Selby claims, “all this compliance stuff is preventing us from addressing risk and performing, you know, security.” Why?  Did someone tell you that you cannot secure your data? Did someone tell you that by using proper the proper risk management practices you claim work so well that you cannot pass the “minimum standard”?  I support you in questioning and ferreting out anyone who makes such statements.  For the rest of the unwashed masses, we need standards.

Mr. Selby ends his rant with a statement everyone should agree with, “Compliance – the state of being – is achieved as a by-product of well-managed risk, not through a relentless ticking of boxes”, which is then followed by high-level statements of positive thinking.  The problem is that we need some tactical examples and guidelines to match the ever increasingly vague strategic statements.  GLBA says to safeguard customer information, but how?  And left to their own devices most companies will chose the cheapest possible way to implement optics of compliance.

I argue, that the PCI DSS has given concrete statements to how one secure their infrastructure, while giving the flexibility one needs to adjust for business and risk management (e.g., compensating controls, wireless and end-t0-end encryption guidelines.)

The problem lies not with our industry “best practices” but with the diffusion of responsibility that happens throughout every company.  Let’s reference back to that Information Security Management Handbook article:

The effects of de-individualization and individualization are real and play a role in how users perceive their role in an information security awareness program.  In the credit card processing call center example, de-individualization can encourage theft, carelessness, and loss of productivity.

I’d like to stop the blame game and see everyone start at home, transforming their company and being neighborly enough to share the information and results with others.  Revolution has often come from emerging evolution of ideas and conversations. I commend Mr. Selby for the conversation, but wish it involved a greater focus on personal responsibility.

Take responsibility for your own security, risk management, and data protection. Start today.