Information Security

The risks from Cyber cime - Hacking - Loss of Data Privacy - Identity Theft and other topical threats - can be greatly reduced by implementation of robust IT Security controls ...

Retired Member 

eSecurity Infrastructures: Reflections and Lessons

In view of many eSecurity projects launched by banks & governments to secure their online services and organizations to secure remote access-control/ information assets, lets pause a little to reflect on key lessons in the last 10 years. Much of the lessons I will summarize below come from experiences within the Nordics, but hopefully are gene...

09 November 2011 /security /retail

Retired Member 

New Requirements for Point to Point Encryption

Well they have arrived. After more than a year of discussion and debate the new requirements for Point to Point Encryption (P2PE) have finally been released by the PCI SSC. These requirements, which are contained in the Point to Point Encryption: Encryption, Decryption and Key Management within Secure Cryptographic Devices (Hardware/Hardware) v1....

18 October 2011 /security /payments

Retired Member 

Mobile Doesn't Have to Mean Insecure

In my last blog, I stated that security is the number one concern for retail bank customers and investment bank managers. In fact, at one time or another, nearly all of our investment banking clients who are considering building mobile applications for their employees have asked, “what if they lose their iPad on the Tube?” – a good question. I thi...

22 September 2011 /security

Retired Member 

Are compromised certificates the root of all Evil?

I returned from holiday to find another attack vector has raised its ugly head. Reading the latest news, at least two hundred fraudulent SSL certificates (and oossibly over five hundred) have been issued from a trusted root certificate authority (CA). In this case, it appears that Diginotar, the Dutch trusted third party has been breached and spoo...

15 September 2011 /security /regulation

Lachlan Gunn Executive Director at European Association for Secure Transactions

Heat from your fingers could disclose your PIN at an ATM

Thermal cameras can apparently detect heat signatures from your fingers on the keys after you have left an ATM. The degree of heat residue can also indicate in which order you touched them! This technology will not work effectively on metal key pads, only on plastic ones, and the successs window is limited. The message "cover your PIN when ma...

30 August 2011 /security

Lachlan Gunn Executive Director at European Association for Secure Transactions

Do you get SMS alerts for debit card transactions?

Does your bank provide SMS alerts for debit card transactions? If it does, do you use the service? According to an article in the Times of India, with effect from July 2011, the Reserve Bank of India (RBI) has made it mandatory for ALL Indian banks to provide this service to debit card holders, and all debit card holders are required to register t...

18 August 2011 /security

Retired Member 

Comparing Mobile and Contactless Payments

As we have seen, contactless payments are beginning to move into the mainstream. As my colleague Mark Carpenter has previously noted in a blog, support for contactless transactions is moving out from the metropolis, even to the rarefied environs of his country retreat. According to Visa Europe, in 2010 it alone issued 10 million contactless card...

25 July 2011 /payments

Retired Member 

Assessing Risk? Ask a pigeon.

I was recently browsing, when I came upon an interesting article. It was discussing the Monty Hall problem. For those of you who don’t know, this problem is based on a US quiz show and has caused a huge amount of debate at various times in the past. The idea is as follows. A contestant is asked to look at three closed doors and told behind tw...

14 July 2011 /security /regulation

Retired Member 

The PCI SSC Publish Virtualisation and Cloud Advice

I have just been reading the new guidance provided by the PCI SSC on Virtualisation. This document has been long anticipated, having been pre - announced at the PCI SSC User Forum back in October 2010. The document includes advice for local virtualised servers and environments as well as advice for those merchants considering a wholesale switch t...

23 June 2011 /security /regulation

Retired Member 

Security: Be very worried NATO uses hbgary

I have to speak out. You must remember hbgary, the company which apparently conspired with BoA/DOJ on ways (some illegal) in which to tackle wikileaks? Well they were allegedly hacked by a 16yr girl in retaliation for their unethical actions and the CEO subsequently quit. The company emails & files for ...well several years... are circulating o...

23 June 2011 /security