The Security Ledger with Paul F. Roberts

Recent Posts

Online Authentication Group FIDO Alliance Grabs A Big Bone: Alibaba

September 23, 2014 Paul Roberts

The FIDO Alliance, an up-and-coming industry consortium aimed at simplifying online identity and doing away with passwords added IPO darling Alibaba to its Board of Directors, according to a statement on Tuesday. The FIDO (or “Fast IDentity Online”) Alliance announced that Alibaba Group’s payments business, Alipay will be among the first to deploy FIDO technology for secure payments authentication. On September 17, the company announced that it will use Nok Nok Labs’ FIDO-compliant NNL™ S3 Authentication Suite to enable secure online payments via the Fingerprint Sensor (FPS) technology on the Samsung Galaxy S5. Alipay customers will be able to make payments and transfers using Alipay’s mobile application, Alipay Wallet by applying their fingerprint to the Galxy’s fingerprint sensor. “We look forward to participating on the FIDO Alliance board, and assuring that commerce and authentication are uniquely cooperative and seamlessly compatible,” said Ni Liang, Alibaba group, senior director, department of security, in a statement. Mobile payments […]

You’re Invited: A Conversation on Password Security and Targeted Attacks

September 23, 2014 Paul Roberts

A note to Security Ledger readers that I’ll be facilitating a really interesting conversation this afternoon on password (in)security and how weak user authentication can undermine even the best laid security plans. The SANS Webinar, Security for the People: End User Authentication Security on the Internet” kicks off at 3:00 PM Eastern today (12:00 PM Pacific). You can register to join us using this link. My guest is DUO Security researcher Mark Stanislav, a frequent Security Ledger contributor and one of the smartest guys out there when it comes to passwords, authentication and securing the Internet of Things. There’s plenty to talk about: weak authentication schemes are the root cause of any number of prominent breaches – from the recent attacks the Apple iCloud accounts of A-list celebrities, to the breach at retailer Target (reportedly the result of a phishing attack on an HVAC contractor that Target used.) Mark and I […]

Report: Home Depot Fallout Reveals History of Lax Security, Hiring

September 23, 2014 Paul Roberts

Its a truism in cyber security that behind every great hack often lies a string of bad decisions and missed opportunities. Its also true that when you dig into the details of damaging cyber incidents, the root causes are personal and psychological as often as they are technical in nature. Organizations -even sophisticated and wealthy organizations – end up making bad decisions for all the wrong reason: failing to properly assess their risk, or pursuing short term savings when long term investment is needed. Home Depot learned via law enforcement that a breach of transaction data exposed as many as 52 million credit card transactions, the largest retail credit card breach to date. But as more comes out about the breach at home improvement giant Home Depot, it starts to look a lot more like the root causes there may have started in the HR department rather than the data center. The […]

Will Big Data Transform Fraud Detection? | SmartData Collective

September 22, 2014 Paul Roberts

The folks over at Smart Data Collective have an interesting story today on Big Data and its (expected) impact on a variety of industries and business practices. Fraud (and fraud detection), it turns out, may be one area that is transformed by better data analytics. According to the article, by Monte Zweben, fraud analytics are posed to be transformed not just by “Big Data,” but by better and faster analytics. The article looks at a variety of industries, including consumer marketing and logistics that stand to benefit from the growth in data and data analytics. Fraud detection is one of them. Zweben cites statistics on the growth of fraud as a global problem. Kroll’s most recent Global Fraud Report found the number of companies falling victim to fraud has increased to 70 per cent. Credit card companies were among the first to embrace “Big Dat” analytics to spot irregularities in patterns of charges […]

With Cars Connected to the Internet, What about Privacy? | Computerworld

September 19, 2014 Paul Roberts

Lucas Mearian has a long and quite thorough article over at Computerworld weighing the possible security and privacy risks posed by connected vehicles. Among other things, Mearian weighs the recent past and likely future of connected vehicles, noting that, “once mobile devices are connected to car infotainment systems and cars are connected to the Internet, vehicles will become a rich source of data for manufacturers, marketers, insurance providers and the government.” They’ll also be a target for hackers. The problem is that, unlike mobile phones, cars have useful lives that are measured in decades, not years – or even months. That makes it difficult for manufacturers, who want to make their vehicles state of the art, but also must deal with the reality of much longer development cycles and complex interactions between non-critical and critical on board systems. [Read more Security Ledger coverage of connected vehicles here.] A couple issues worth noting: […]