7 Lessons from Target's Breach

One Year Later, What Retailers, Bankers Have Learned

By Tracy Kitten, December 10, 2014.           

 

It's been a year since the breach at Target Corp., which exposed 40 million debit and credit cards along with personal information about an additional 70 million customers.
See Also: Account Takeover, Payment Fraud and Spoofed Identities: The Common Thread
Although the attack drew attention to the need for bolstered cybersecurity measures, retail breaches show no signs of abating. Other major payments breaches at retailers since Target have included Sally Beauty, Michaels, Home Depot, Kmart and Staples, to name a few.

Target was a watershed event that put the spotlight on payment card security. Here's a review of seven important lessons learned from the huge breach incident.

1. EMV Alone Is Not Enough

Target's breach spurred congressional hearings and renewed debate among retailers and bankers about the need for a speedy migration to EMV chip technology to help prevent breaches (see Target Hearings: EMV Not Enough).
It also was a catalyst in October for a presidential order to push adoption of EMV chip technology among U.S. retailers and banks.
Visa had years earlier set October 2015 as the counterfeit fraud liability shift date for U.S. merchants and issuers that had not yet transitioned away from magnetic-stripe card technology. But EMV didn't get that much publicity until the Target attack.
In the wake of the retailer's breach, experts and industry groups, including the Payment Card Industry Security Standards Council, said that in addition to EMV, merchants also should implement tokenization and end-to-end encryption, to ensure card data is completely devalued.
"Among all of the large retailers that I talk to, their attitude is that they won't talk to vendors unless they offer tokenization with EMV," says Avivah Litan, an analyst for the consultancy Gartner. "It has to be part of the POS solution."
End-to-end encryption, on the other hand, can be an add-on, she says. "But retailers want to work with vendors that can provide all three."

2. Network Segmentation Is a Necessity

The Target breach also proved how easy it is for hackers to tunnel from one part of a corporate network to another, which is why merchants have to segment their networks.
Hackers broke into Target's POS system after they stole network credentials from Fazio Mechanical Services Inc., a vendor that serves the retailer (see Target Vendor Acknowledges Breach).
Tom Kellermann, chief cybersecurity officer at the security firm Trend Micro, says network segmentation would have prevented many of the breaches suffered by retailers, including Target, over the last 18 months (see OCC: Retailers Accountable for Breaches).

3. Third-Party Oversight Is Part of Compliance

The Target breach put a spotlight on vulnerabilities related to third parties. In August, the PCI Council issued new guidance on managing third-party vendor risks that retailers and bankers alike can put to use.

Banking regulatory bodies, such as the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp. also have, in the wake of Target, repeatedly reminded banking institutions that they are responsible for ensuring the security of the third-party vendors and service providers with which they work.
See Also: Payments Security & EMV: Join CEO Bob Carr of Heartland Payment Systems

4. Log Monitoring Needs Analytics

A forensics investigation into the Target breach found that transaction logs raised alarms about anomalous activity, but no one picked up on the warnings, according to multiple reports. Thus, the breach went undetected for several weeks.
In November, the PCI Council announced it will issue guidance specifically aimed at log monitoring (see Why PCI Will Issue Log Monitoring Guidance). But experts says log monitoring has to be coupled with additional analytics to be truly effective.
"Everyone is inundated with alerts," Gartner's Litan says. "One retailer may get a half million alerts a day, so it's impossible to go through all of those. By putting context awareness and behavioral analytics to the transaction logs, you can start profiling users and devices. With this context-aware view of transactions, you're able to correlate anomalies across different systems. Then you can go from a few thousand high-priority alerts to a couple hundred."
Analyst Julie Conroy of the consultancy Aite says without analytics, basic log monitoring is counterproductive because of the high rate of false positives. "A key lesson is the ability to apply analytics to the tens of thousands of false positives that these solutions throw off, to help security teams separate the wheat from the chaff," she says.

5. Executives, Boards Are Accountable

In May, Gregg Steinhafel resigned as Target's chairman, president and CEO. In the statement issued about Steinhafel's resignation, the company noted that he "held himself personally accountable and pledged that Target would emerge a better company."
Steinhafel's announcement came just two months after the resignation of Beth Jacob, Target's CIO during the time of the breach.
The two resignations came shortly after Target's chief financial officer, John Mulligan, was first questioned about the breach before Congress (see Target, Neiman Marcus Differ on EMV).
The congressional attention given to Target's breach, coupled with the resignation of two of its key officers, made waves in the financial services industry, too. Over the summer, banking regulators launched a pilot cyber-exam program at 500 community banks to review the cyber-awareness of C-level executives and boards of directors at those institutions.
In November, the Federal Financial Institutions Examination Council noted that cybersecurity awareness among executives and boards was in need of improvement, and that cyber-awareness had to be a higher priority across the board (see FFIEC: Boards Need Cyber Training).

6. Retailers May Be Liable for Breaches

The debate over who should be liable when card data is compromised at the retail level also has heated up since the Target breach. For months, banking groups and retail associations have been at odds about who is responsible for bearing the losses associated with card breaches (see Hold Merchants Accountable for Breaches?).
While bankers argue they're stuck with expenses related to card reissuance and fraud, retailers say they indirectly cover these costs for banks through the interchange fees they pay to the card brands (see Card Breaches: Retailers Doing Enough?).
~Banking regulatory bodies, such as the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp. also have, in the wake of Target, repeatedly reminded banking institutions that they are responsible for ensuring the security of the third-party vendors and service providers with which they work.
See Also: Payments Security & EMV: Join CEO Bob Carr of Heartland Payment Systems

4. Log Monitoring Needs Analytics

A forensics investigation into the Target breach found that transaction logs raised alarms about anomalous activity, but no one picked up on the warnings, according to multiple reports. Thus, the breach went undetected for several weeks.
In November, the PCI Council announced it will issue guidance specifically aimed at log monitoring (see Why PCI Will Issue Log Monitoring Guidance).
But experts says log monitoring has to be coupled with additional analytics to be truly effective.
"Everyone is inundated with alerts," Gartner's Litan says. "One retailer may get a half million alerts a day, so it's impossible to go through all of those. By putting context awareness and behavioral analytics to the transaction logs, you can start profiling users and devices. With this context-aware view of transactions, you're able to correlate anomalies across different systems. Then you can go from a few thousand high-priority alerts to a couple hundred."
Analyst Julie Conroy of the consultancy Aite says without analytics, basic log monitoring is counterproductive because of the high rate of false positives. "A key lesson is the ability to apply analytics to the tens of thousands of false positives that these solutions throw off, to help security teams separate the wheat from the chaff," she says.

5. Executives, Boards Are Accountable

In May, Gregg Steinhafel resigned as Target's chairman, president and CEO. In the statement issued about Steinhafel's resignation, the company noted that he "held himself personally accountable and pledged that Target would emerge a better company."
Steinhafel's announcement came just two months after the resignation of Beth Jacob, Target's CIO during the time of the breach.
The two resignations came shortly after Target's chief financial officer, John Mulligan, was first questioned about the breach before Congress (see Target, Neiman Marcus Differ on EMV).
The congressional attention given to Target's breach, coupled with the resignation of two of its key officers, made waves in the financial services industry, too. Over the summer, banking regulators launched a pilot cyber-exam program at 500 community banks to review the cyber-awareness of C-level executives and boards of directors at those institutions.
In November, the Federal Financial Institutions Examination Council noted that cybersecurity awareness among executives and boards was in need of improvement, and that cyber-awareness had to be a higher priority across the board (see FFIEC: Boards Need Cyber Training).

6. Retailers May Be Liable for Breaches

The debate over who should be liable when card data is compromised at the retail level also has heated up since the Target breach. For months, banking groups and retail associations have been at odds about who is responsible for bearing the losses associated with card breaches (see Hold Merchants Accountable for Breaches?).
While bankers argue they're stuck with expenses related to card reissuance and fraud, retailers say they indirectly cover these costs for banks through the interchange fees they pay to the card brands (see Card Breaches: Retailers Doing Enough?).


While courts have dismissed numerous class action suits filed by consumers against breached retailers, a class action suit filed against Target by banking institutions, seeking to recoup their breach-related costs, has won court approval to proceed (see Target Breach Suit Won't be Dismissed).
See Also: Account Takeover, Payment Fraud and Spoofed Identities: The Common Thread
If banks win that suit, it could send a strong message about the financial responsibilities retailers should bear in the wake of a breach.

7. Cyberthreat Intelligence Sharing Must Improve

The Target breach also raised awareness about the need for more cross-industry information sharing. The sharing of cyberthreat intelligence among banking institutions has been on an upward swing since 2012, after numerous distributed-denial-of-service attacks targeted leading U.S. banks.
But it wasn't until the retail breaches of the last year that serious consideration was given to the need for similar information sharing among retailers, as well as across the payments and financial landscape.
In May, the Retail Industry Leaders Association announced the launch of the Retail Cyber Intelligence Sharing Center - an effort to improve sharing among retailers and other public and private stakeholders, including the Department of Homeland Security and law enforcement.
Then in June, Tim Pawlenty, CEO of the Financial Services Roundtable, explained why information sharing in the retail sector needed to mimic information sharing within the financial sector.

Read more »

Why You Need Both a Hardware and Software Firewall - SecurityMetrics Blog

Why You Need Both a Hardware and Software Firewall - SecurityMetrics Blog

Read more »

Facebook Popup Like Box Widget For Blogger

Facebook has become the leading social media service on the Internet playing host to over 1.3 billion users; of those, 800 million login to their dashboard feeds at least once a day. Thanks to the vast number of active users on services like Facebook, acquiring new readers as a blogger or content provider has become easier than ever.

In order to produce an effective digital campaign, you absolutely must take advantage of social media by doing things like integrating Facebook on Blogger. Email marketing can be useful, but it comes with restrictions that could limit your blog's potential. Perhaps the most significant problem is that emails don't come with a face or personality like Facebook does.

Think of a time when you received an email in you inbox from someone you didn't know. Where you inclined to open it or did you send it right to the junk folder? If it's your first introduction to new consumer, they simply don't know who you are, what you want, and how you got their email. This sets off an initial breakdown of any type of trust that might have developed. The reputation of email marketing is further deteriorated with a study done by Kaspersky Lab, an Internet research firm. They estimate that around 70% of all the emails sent in the world are spam.

Sharing site content using a Facebook Like Box is just one of many strategies that can generate a regular flow of traffic from a diverse demographic that might have been previously inaccessible. Adding a Facebook Like Box to your site helps to reduces your individual workload, and instead distributes that ability equally among your readers.

When someone reads your content and appreciates the kind of work that you produce, they'll be willing to share that information to their followers and fans, setting off a viral reaction. The first step necessary to making this a reality is to make this change to your site. These next few steps will provide you with a quick and easy guide on how to add a 'Like Box' to your Blogger site so that you can began taking advantage of these great opportunities.

Click here for a DEMO

How to Add the Facebook Popup Like Box Widget

1. Log into your Blogger account and select your blog > go to 'Layout' & click the 'Add a Gadget' link on the right side
2. Once the popup window is open, select the HTML/JavaScript gadget from the list:

3. Copy and paste the following code inside the empty box:

<script src='http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js' type='text/javascript'></script>
<style>
#fbox-background {
    display: none;
    background: rgba(0,0,0,0.8);
    width: 100%;
    height: 100%;
    position: fixed;
    top: 0;
    left: 0;
    z-index: 99999;
}

#fbox-close {
    width: 100%;
    height: 100%;
}

#fbox-display {
    background: #eaeaea;
    border: 5px solid #828282;
    width: 340px;
    height: 230px;
    position: absolute;
    top: 32%;
    left: 37%;
    -webkit-border-radius: 5px;
    -moz-border-radius: 5px;
    border-radius: 5px;
}

#fbox-button {
    float: right;
    cursor: pointer;
    position: absolute;
    right: 0px;
    top: 0px;
}

#fbox-button:before {
    content: "CLOSE";
    padding: 5px 8px;
    background: #828282;
    color: #eaeaea;
    font-weight: bold;
    font-size: 10px;
    font-family: Tahoma;
}

#fbox-link,#fbox-link a.visited,#fbox-link a,#fbox-link a:hover {
    color: #aaaaaa;
    font-size: 9px;
    text-decoration: none;
    text-align: center;
    padding: 5px;
}
</style>
<script type='text/javascript'>
//<![CDATA[
jQuery.cookie = function (key, value, options) {
// key and at least value given, set cookie...
if (arguments.length > 1 && String(value) !== "[object Object]") {
options = jQuery.extend({}, options);
if (value === null || value === undefined) {
options.expires = -1;
}
if (typeof options.expires === 'number') {
var days = options.expires, t = options.expires = new Date();
t.setDate(t.getDate() + days);
}
value = String(value);
return (document.cookie = [
encodeURIComponent(key), '=',
options.raw ? value : encodeURIComponent(value),
options.expires ? '; expires=' + options.expires.toUTCString() : '', // use expires attribute, max-age is not supported by IE
options.path ? '; path=' + options.path : '',
options.domain ? '; domain=' + options.domain : '',
options.secure ? '; secure' : ''
].join(''));
}
// key and possibly options given, get cookie...
options = value || {};
var result, decode = options.raw ? function (s) { return s; } : decodeURIComponent;
return (result = new RegExp('(?:^|; )' + encodeURIComponent(key) + '=([^;]*)').exec(document.cookie)) ? decode(result[1]) : null;
};
//]]>
</script>
<script type='text/javascript'>
jQuery(document).ready(function($){
if($.cookie('popup_facebook_box') != 'yes'){
$('#fbox-background').delay(5000).fadeIn('medium');
$('#fbox-button, #fbox-close').click(function(){
$('#fbox-background').stop().fadeOut('medium');
});
}
$.cookie('popup_facebook_box', 'yes', { path: '/', expires: 7 });
});
</script>
<div id='fbox-background'>
<div id='fbox-close'>
</div>
<div id='fbox-display'>
<div id='fbox-button'>
</div>
<iframe allowtransparency='true' frameborder='0' scrolling='no' src='//www.facebook.com/plugins/likebox.php?
href=https://www.facebook.com/pages/Helplogger/120574614736021&width=402&height=255&colorscheme=light&show_faces=true&show_border=false&stream=false&header=false'
style='border: none; overflow: hidden; background: #fff; width: 339px; height: 200px;'></iframe>
<div id="fbox-link">Powered by <a style="padding-left: 0px;" href="http://helplogger.blogspot.com" rel="nofollow">Helplogger</a></div>
</div>
</div>

4. Press the 'Save' button to add the widget to your blog. That's it!

Customization

• After adding the code, replace the address in blue https://www.facebook.com/pages/Helplogger/120574614736021 with your site's facebook page URL.

• The widget will appear 5 seconds after the page finishes loading. If you want to change this delay, change the number 5000 to a greater or lesser number in this part:

.delay(5000)

• By default, the like box only shows up the first time the user visits your page.  If you would like the Facebook box to popup every time the page loads, then remove this line of code:

$.cookie('popup_facebook_box', 'yes', { path: '/', expires: 7 });

• If you want to display only when user visits your homepage, go to 'Template' > hit the 'Edit HTML' button on the right side and search by clicking anywhere inside the code area and pressing the CTRL + F keys for this tag:

</body>

Paste the facebook popup widget right above the body tag and make sure to include the conditional tags below:

&lt;b:if cond='data:page.type == "index"'&gt;ADD THE FACEBOOK WIDGET CODE HERE &lt;/b:if&gt;

After saving your work, you can test out your new feature by returning to one of your old posts which should bring up a little popup widget asking if you'd like to join the site's facebook page.

If you don't see the Facebook Like Box on the page, you may need to delete your cookies or check out the 'Customization' section above in order to display the widget every time a user visits your site. Once this widget is added to your site, all your hard work should start to translate into an increase in web traffic and number of Facebook fans.

Read more »

The ISO 27001 & ISO 22301 Blog

http://www.iso27001standard.com/blog/2013/11/25/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/?utm_source=twitter&utm_medium=mj&utm_campaign=blog

Read more »

Most Targeted Attacks Exploit Privileged Accounts

Most Targeted Attacks Exploit Privileged Accounts

by Brian Donohue    November 20, 2014     

We all like to write and talk about flashy zero-day vulnerabilities. However, a new threat report cautions enterprises not to flatter themselves, because the majority of criminals are not using valuable zero-days exploits to penetrate corporate networks: they’re phishing privileged account credentials from executives and IT staffs, or simply guessing passwords for automated service accounts and, in turn, exploiting that access to gather valuable information.
“Everyone thinks about the zero-day vulnerability, but they’re rarely exploited in a widespread pattern in the wild. They’re so valuable that attackers apply them in very limited way,” said Craig Williams, senior technical leader and security outreach manager for Cisco Talos Security Intelligence and Research Group. “For every zero day you hear about, there are millions of known vulnerabilities that are far more likely to be used against you.”

A report commissioned by CyberArk and based on interviews with a  variety of industry experts from Cisco, Deloitte, Mandiant, RSA Security and Verizon claims that attacks leveraging privileged accounts proceed faster and are more difficult to detect than those that rely predominately on malware or vulnerabilities. Some 80 percent of targeted attacks, the experts responded, involve a privileged account being hacked at some point.

On average, the interviewees in this report said attacks often persist for months or years before they are discovered. The average attack, they said, is ongoing for six to eight months before anyone notices. That figure is corroborated by findings published by Mandiant claiming the median number for days in an ongoing attack is 229.
“Privileged accounts even enable attackers to destroy evidence of their activities and establish redundant access points and backdoors that make it nearly impossible to keep them off internal networks,” CyberArk says.
A significant part of the problem relates to inventory. CyberArk data suggest that, on average, organizations have at least three or four times as many privileged accounts as they have employees. Many organizations are not even aware how many privileged accounts exist. While it may seem easy enough to count accounts, the problem is more complicated than that, particularly when organizations must account for  the proliferation of corporate data and applications in cloud, as well as mobile and social environments.
Many privileged accounts are provisioned for machines rather than people. IT departments are said to set up “service accounts” to enable machine-to-machine access to software applications, data and computing equipment. These service accounts are often granted broad network access and sometimes the ability to connect to any machine on the network. There are so many of these service accounts at some organizations that many are forgotten about or nearly impossible to effectively monitor.
Interestingly, Christopher Novak, a global managing principal working in investigative response for the Verizon RISK Team notes that phishing, not brute-force nor dictionary attacks, are most commonly used to hijack human accounts, suggesting that weak passwords are not really the problem here. However, he says IT teams frequently assume  that service accounts will only be used internally, and many of those end up with default, easily guessable credentials.
“We’ve seen 25 or 30 attacks recently in which attackers used (publicly available) default passwords,” Novak says. “Also, account lockouts are usually turned off for service accounts to prevent breakdowns in dependencies between systems. And because it’s presumed individuals aren’t using [these accounts], analysts dial down the sensitivity on alerts. Service accounts are out of sight, out of mind. So, if a threat actor gets into the environment and enumerates the service accounts, which is easy to do, they can make a lot of headway very quickly with low risk of discovery.”
Furthermore, attackers are displaying increasing levels of sophistication when it comes to exploiting access to privileged accounts. They use these accounts to infiltrate a wide range of systems as a sort of access insurance in case one of their avenues into the network is sealed off. Security investigators in the report said attackers are increasingly hacking embedded devices in the so-called “Internet of Things” to establishing multiple privileged identities in Microsoft Active Directory to ensure redundant points of access.
In the end, CyberArk says companies need to know what privileged accounts exist within their organization and limit to the best of their ability the number of administrative or default or hard-coded credentials, application backdoors and SSH keys they maintain. They also need to make it harder to get privileged access to multiple systems changing default passwords and using different administrative passwords on each system. Privileged accounts that do exist need to be proactively monitored to ensure they are interacting with data assets in normal ways. Firms should also perform regular audits of their information assets and how those  assets are accessed, monitor and limit the privilege level of service accounts and apply patches early and often. Beyond that the report urges companies to practice classic defense in depth, because the more overlapping security layers that exist, they say, the more you lower your risks.

About Brian Donohue

- See more at: http://threatpost.com/most-targeted-attacks-exploit-privileged-accounts/109514#sthash.zFyXXWqX.dpuf

Read more »

Beth Israel fined $100,000 for patient data breach

The Boston Globe

Steven Senne/AP

Beth Israel Deaconess Medical Center will pay $100,000 after a physician’s laptop holding personal information for nearly 4,000 patients and employees was stolen in 2012.

By Jack NewshamGlobe Correspondent  November 21, 2014

Beth Israel Deaconess Medical Center agreed to pay $100,000 to settle a complaint by the Massachusetts attorney general’s office that its lax data security led to the theft of personal information of about 4,000 patients and employees.
In May 2012, a physician’s unattended laptop was stolen from his desk at the hospital. The laptop contained health information of 3,796 patients and Beth Israel employees, as well as personal information, such as Social Security numbers, of 194 other Massachusetts residents. The attorney general’s office argued the hospital’s lack of security and failure to encrypt patient data was against the law.
“The healthcare industry’s increased reliance on technology makes it more important than ever that providers ensure patients’ personal information and protected health information is secure,” said Attorney General Martha Coakley.
Dr. John Halamka, chief information officer at Beth Israel Deaconess, said the hospital has since improved its security procedures.
“After this incident, we worked closely with the federal and state governments, as well as security industry experts, to ensure that [the hospital] adopts state-of-the-art security policies and technologies,” Halamka said in a statement. “Every device we purchase is encrypted before it is used, and every employee must attest on an annual basis that his or her personal devices are also encrypted.”
Beth Israel is not the first hospital to be penalized for poor data security by Coakley’s office. Earlier this year, Women and Infants Hospital of Rhode Island agreed to pay $150,000, and South Shore Hospital settled a suit by the Attorney General for $750,000 in 2012.

Jack Newsham can be reached at jack.newsham@globe.com. Follow him on Twitter @TheNewsHam.

Read more »

Ingrijpende privacywet op komst: EU-toezichthouder gegevensbescherming Peter Hustinx blikt vooruit [interview]

21nov 2014

Buitenlandse opsporingsdiensten, de Nederlandse Belastingdienst en commerciële Big Data-exploitanten grasduinen in persoonsgegevens. De oude Europese richtlijn uit 1995 die het toezicht regelt, wordt eindelijk vervangen. Peter Hustinx, Hoofd van de Europese Toezichthouder voor Gegevensbescherming, richt zijn blik op de vergaande Europese Privacy Verordening.

Het voornemen van ING om – zo leek het – betaalgegevens van klanten door te verkopen aan externe partijen leidde eerder dit jaar tot een storm van kritiek. Het overheersende gevoel: inzage in het huishoudboekje vormt een te grote inbreuk op de privacy. Geschrokken door het oproer van klanten, de Consumentenbond, De Nederlandsche Bank en de Autoriteit Financiële Markten, trok ING het plan snel weer in. De privacy-kwestie zal de ‘megatrend’ Big Data niet remmen. Het verzamelen en samenvoegen van zoveel mogelijk data is de Heilige Graal van marketeers. De Boston Consulting Group voorspelt dat het in 2020 in Europa een economische waarde vertegenwoordigt van bijna 1 biljard euro.

Toezichthouder Peter Hustinx

Overheden laten zich ook niet onbetuigd, bleek uit de onthullingen van klokkenluider Edward Snowden over de voorheen onnavolgbare werkwijze van de Amerikaanse inlichtingendienst NSA. De Nederlandse Belastingdienst is ook volop aan het grasduinen. Zo wist de fiscus in augustus nog in hoger beroep toegang te forceren tot de klantgegevens van de parkeerdienst SMS Parking.

Peter Hustinx

De Nederlandse jurist Peter Hustinx (69) is als Hoofd van de European Data Protection Supervisor (EDPS) vanuit Brussel bezig om toezicht te houden op de gegevensbescherming bij alle EU-instellingen – van de Europese Commissie tot de tientallen agentschappen en de Europese Centrale Bank. Daarnaast geeft de EDPS advies aan de Raad en het Europees Parlement bij de totstandkoming van wetgeving waar gegevensbescherming een rol speelt.
De heetste aardappel momenteel: de nieuwe Europese Privacy Verordening die de gedateerde privacyrichtlijn uit 1995 moet vervangen. Het voorstel is in maart met grote meerderheid aangenomen door het Europees Parlement en gaat nu naar de Raad van Ministers die de Verordening, al dan niet geheel of gedeeltelijk, kunnen aannemen. De inwerkingtreding zal naar verwachting pas in 2017 plaatsvinden. De Europese Privacy Verordening is een stuk ingrijpender dan de verouderde richtlijn.

Europese Privacy Verordening

• Boetes tot maximaal 100 miljoen euro of 5 procent van de wereldwijde omzet bij overtreding van de regels
• Strengere eisen aan de beveiliging van privacygevoelige informatie en een meldplicht (aan de toezichthouder) bij datalekken
• Expliciete toestemming van klanten vereist zodra bedrijven persoonsgegevens (Big Data) willen verwerken. Klanten moeten deze toestemming ook weer kunnen intrekken
• NO-NSA clausule: Bedrijven mogen persoonsgegevens niet meer zonder toestemming van de toezichthouder delen met buitenlandse overheden
• Het ‘recht om vergeten te worden’ in zoekmachines
• De verplichting om een Functionaris voor de Gegevensbescherming aan te stellen bij instanties die persoonsgegevens verwerken van meer dan 5.000 mensen in een jaar

U als Europese toezichthouder, maar ook de nationale toezichthouders, werken met wetgeving die is afgeleid van een richtlijn uit 1995. Is dat nog wel houdbaar in het internettijdperk?
‘Een pak melk dat zuur is, ga je niet opdrinken. Dat doen wij helaas nog wel. De huidige regels in de richtlijn hebben hun houdbaarheidsdatum overschreden. Het was destijds een heel goede stap vooruit om zeker te maken dat alle landen in Europa ongeveer dezelfde maatregelen namen op het gebied van gegevensbescherming. Maar inmiddels 20 jaar later zijn er een aantal dingen gebeurd, zoals het internet, sociale netwerken en mobiele communicatie.’
In de voorgestelde Europese Privacy Verordening is een maximale boete vastgelegd van 5 procent van de geconsolideerde jaaromzet zodra bedrijven zich niet houden aan de nieuwe wetgeving. Wat voor krachten worden er losgemaakt zodra dergelijke boetes worden voorgesteld?
‘We hebben in jaren niet zoveel gelobby gezien, parlementsleden zijn werkelijk gebombardeerd. Er is hele zware druk uitgeoefend door buitenlandse regeringen en Europese en Amerikaanse bedrijven die op het internet in Europa actief zijn. Maar ik merk in de discussie dat er teveel uitgegaan wordt van worst case analyses. Zo zijn er bedrijven die zeggen: je moet dadelijk overal toestemming van klanten voor krijgen zodra we hun data willen gebruiken, dat is het einde van internet.
Nou, toestemming is een belangrijk element, maar het is niet altijd nodig. Een bedrijf kan er alleen niet meer van uitgaan dat ze wegkomen met dingen als “stilzwijgende toestemming” of “opt-out toestemming” – er is een hele reeks van woorden die ze daarvoor gebruiken. Dan onderschat je de problematiek ongelooflijk, want als dát toestemming is, dan weet ik bijna zeker dat het niet bindend is. En de volgende dag moet je het kunnen intrekken, daar heeft men helemaal geen rekening mee gehouden.’
In de nieuwe verordening wordt ook het principe van “one-stop-shop” toezicht geïntroduceerd: het land waar de hoofdvestiging van een bedrijf is gevestigd, krijgt de verantwoordelijkheid over het gehele toezicht op dat bedrijf. Hoe ziet dat er dadelijk uit in de praktijk?
‘Het toezicht is dadelijk zo verdeeld dat iedere nationale toezichthouder bevoegd blijft op zijn eigen territorium, maar er komt een lead authority, een one-stop-shop. Er is nu een hele discussie over ontbrand wát dat precies inhoudt. Is de toezichthouder dan enkel het land waar de hoofdvestiging van een bedrijf is gevestigd, of doet hij het samen met anderen?’
De toezichthouder in Ierland krijgt het dan druk omdat daar veel grote tech-bedrijven zoals Google, Facebook en Apple daar hun Europese hoofdkantoren hebben gevestigd.
‘Als zo’n bedrijf daar gevestigd is, wordt dat land de lead. In Ierland zijn veel bedrijven neergestreken die een grote rol spelen op internet, dat zal met de taal en het fiscale regime te maken hebben. Als je die one-stop-shop als een exclusieve operatie ziet – en dat was aanvankelijk toch een beetje de beeldvorming – dan is het zorgwekkend dat er misschien verschil in behandeling zou kunnen zijn in Ierland en andere landen. Gaan de Ieren wat soepeler handhaven? Onze ervaring is dat onze Ierse collega’s hun werk uitstekend doen.’
Maar bij hen staat wel een groot deel van hun BBP op het spel als ze besluiten om een boete van 5 procent van de jaaromzet van bijvoorbeeld Google te geven. Wie kan aangesproken worden op falend toezicht?
‘Dat is één van de vragen die nu in het laatste stadium veel hoofdbrekens kosten. Ik verwacht dat het toezicht in de verordening gebaseerd gaat worden op een vorm van samenwerking waarbij de lead een stevige rol krijgt, maar waar beslissingen van de lead op een of andere manier in een groep genomen worden. Door samenwerking moet voorkomen worden dat er forum shopping gaat plaatsvinden.’
Hoe realistisch is het volgens u dat grote internetbedrijven besluiten om hun hoofdvestigingen uit Europa terug te trekken?
‘Helemaal uitsluiten kun je dat niet, zo is nu eenmaal de wereld, maar het is niet erg realistisch. Bedrijven als Google hebben een sterke aanwezigheid op de Europese markt. Hun verantwoordelijkheid ligt daardoor hier. Zelfs als hun data in werkelijkheid in Jersey of op de Kaaimaneilanden zijn opgeslagen, of in de cloud en nobody knows where, zijn ze aansprakelijk voor de beveiliging. Als een bedrijf – ik ga geen namen noemen – de gegevens opslaat in de cloud, en accepteert dat de provider niet kan zeggen wáár dat is – moeten er wel afspraken gemaakt worden of deze de juiste beveiligingsmaatregelen heeft genomen. Het is volstrekt onverantwoord om zonder nadere bepaling van controls gegevens in de cloud op te slaan, want dan kom je je verantwoordelijkheden niet na. Dan ben je in gebreke. Als de markt zich bewust is van zijn verantwoordelijkheid dan zal de gegevensbescherming toenemen.’
Wie moet dat verantwoordelijkheidsbesef bijbrengen: de toezichthouder of de markt zélf?
‘Bedrijven moeten het zelf oppakken. In de huidige richtlijnen en toekomstige verordening staat dat het bedrijf de verantwoordelijke is voor naleving: het moet de noodzakelijke maatregelen treffen om te verzekeren dat gegevens worden beschermd. En als zij dat niet doen, moet een toezichthouder er iets aan doen. De nieuwe regels en het nieuwe beleid zijn belangrijk om onachtzaamheid aan te pakken. De nieuwe verordening zal een paar keer hard worden toegepast en dan krijg je: “Waarom krijg ík een boete?” Daarna gaat het zich verspreiden en dan zeggen mensen: het schijnt tegenwoordig zo en zo te moeten gebeuren. Ja, dat was eigenlijk al jarenlang zo, maar dat waren we vergeten. We moeten die olietanker zien te draaien – bedrijven die wel de gouden bergen zien, maar onvoldoende over gegevensbescherming hebben nagedacht.’
***********
Dit is een ingekorte weergave van een interview dat onlangs in Tijdschrift voor Compliance werd gepubliceerd. Het vijfde nummer van 2014 is geheel gewijd aan het thema Compliance en Privacy en gaat onder meer over de Big Data trend en gegevensbescherming. Klik hier voor een abonnement of proefnummer.

Read more »

Run-amok compliance officers cost Bank of Tokyo Mitsubishi $315 million for sanctions report whitewash

                      

By Richard L. Cassin | Tuesday, November 18, 2014 at 1:52PM

The New York State Department of Financial Services (DFS) Tuesday levied $315 million in penalties against Bank of Tokyo Mitsubishi UFJ (BTMU) for misleading regulators regarding its transactions with Iran, Sudan, Myanmar, and other sanctioned entities.
A year-long  DFS investigation found that BTMU compliance officers pressured the bank's consultant, PricewaterhouseCoopers (PwC), into removing key warnings to regulators in a supposedly "objective" report the bank submitted to the DFS.
Under the DFS consent order, BTMU will pay the additional $315 million penalty beyond a $250 million penalty it paid under a previous June 2013 DFS agreement over its sanctioned transactions.
"As such,"the DFS said, "the total monetary penalty that BTMU has paid in this case is $565 million."
At the direction of the DFS, the bank "will also take disciplinary action against individual BTMU compliance personnel involved in the watering down of the PwC report."
The DFS demanded that BTMU fire Tetsuro Anan (manager, anti-money laundering compliance office, compliance division). Anan has resigned from BTMU, the DFS said.
"On multiple occasions, despite being responsible for anti-money laundering compliance, Tetsuro Anan asked PwC to remove from its report specific issues of material concern to regulators about the bank's misconduct," the DFS said.
The DFS also banned two former compliance officers who now work at BTMU affiliates.
Akira Kamiya (deputy president, Mitsubishi UFJ Securities Holdings) and Tetsuji Kamisawa (executive deputy president, Defined Contribution Plan Consulting of Japan) can't do work involving any New York banks (or other financial institutions) regulated by the DFS, including BTMU's New York branch.
Benjamin M. Lawsky, head of the DFS, said: “We continue to believe that fines -- while often necessary -- are not sufficient to deter misconduct on Wall Street. We must also work to impose individual accountability, where appropriate, and clearly proven, on specific bank employees that engaged in wrongdoing.”
In August, the DFS suspended PwC Regulatory Advisory Services for two years for helping whitewash the BTMU sanctions and anti-money laundering compliance report.
PwC was also required to make a $25 million payment to the State of New York.
As part of Tuesday's order, BTMU will relocate its U.S. Bank Secrecy Act/Anti-money Laundering Compliance (BSA/AML) and Office of Foreign Assets Control (OFAC) sanctions compliance programs to New York, the DFS said.
Those programs will have U.S. compliance oversight over all transactions affecting the New York Branch, the DFS said, "including transactions performed outside the U.S. that affect the New York Branch."
BTMU said in a statement Tuesday it is "committed to conducting business with the highest levels of integrity and regulatory compliance, and to continually improving its policies and procedures."

*     *     *

The New York State Department of Financial Services consent order In the matter of Bank of Tokyo Mitsubishi UFJ, Ltd. New York Branch dated November 18, 2014 is here (pdf).
_______
Richard L. Cassin is the publisher and editor of the FCPA Blog. He can be contacted here.

- See more at: http://www.fcpablog.com/blog/2014/11/18/run-amok-compliance-officers-cost-bank-of-tokyo-mitsubishi-3.html#sthash.kwvVrjxU.dpuf

Read more »

Banks have lost so much consumer information to hackers this year that two members of Congress are asking them to come clean with the extent of the damage

Congress to banks: Admit you've been hacked!

By Jose Pagliery  @Jose_Pagliery November 18, 2014: 10:08 AM ET

Replay

Next up:

Replay

The gun range where you can buy booze

• 12
  TOTAL SHARES
• 8
• 1
• 1
• 2

NEW YORK (CNNMoney)

Banks have lost so much consumer information to hackers this year that two members of Congress are asking them to come clean with the extent of the damage.

Tuesday morning, 16 financial institutions will receive letters from Sen. Elizabeth Warren and Rep. Elijah E. Cummings asking them to admit that they have been hacked, explain how it happened and be transparent about what they lost.

In many cases, companies that are hacked never reveal it to their customers. Or they release vague, useless information that hides the seriousness of the breach.
Related: Hackers attack U.S. energy grid
Earlier this year, hackers broke into JPMorgan. The bank said hackers gathered information on more than 80 million customers. But sources close to the investigation told CNNMoney the hackers hit at least six other companies -- none of which came forward about it.
"The increasing number of cyberattacks and data breaches is unprecedented and poses a clear and present danger to our nation's economic security," Cummings and Warren wrote in the letter.
They noted that faith in banks' ability to keep consumer data safe "is central to earning and maintaining consumer confidence in our economic system." The letter referenced a recent USA Today report that hackers have stolen more than 500 million financial records over the past year.
Earlier this year, CNNMoney noted that half of American adults have been hacked.

Read more »

Corporate data security trust restoration

SafeNet : 14 November, 2014  (Special Report) Paul Hampton, Payment & Crypto management expert at SafeNet explains the four steps required to restore trust in corporate data security Results from the latest Breach Level Index report show there have been more than a thousand worldwide data breaches so far this year that compromised nearly 563 million data records of customers’ personal and financial information. Particularly worrying for consumers, is that the retail industry accounts for more than 30 per cent of all data records breached and has thus become the embodiment of the data breach epidemic. These are shocking figures, and should be a serious cause for concern, especially in the lead up to Christmas, when many more shoppers will be using their cards, and could be putting themselves at risk. Until now, consumers have appeared apathetic about identity compromise security breaches. But new research indicates unrest. A SafeNet survey of more than 4,500 adults across five of the world’s largest economies – U.S., U.K., Germany, Japan, and Australia has found that nearly two-thirds (65 per cent) of respondents would never, or were very unlikely to, shop or do business again with a company that had experienced a data breach where financial data or information was stolen. The research also indicated that only half of adults surveyed feel that companies take the protection and security of customer data seriously enough. What does all this mean? The traditional data security mind set does not work anymore.With companies collecting ever-increasing amounts customer information and with digital interactions becoming more diverse, vast amounts of data about who we are, what we do, and what we like is being stored online. We entrust our entire identity as individuals to the companies who gather this information and need to be reassured that it is being kept safe. For decades, the prevailing wisdom about cybersecurity has been that a perimeter “wall” should be built around the corporate network to keep intruders out. More recently, newer technologies such as real-time threat protection have been implemented to bolster security.  However, as the current breach epidemic shows, these approaches haven’t stopped today’s sophisticated cybercriminals. Companies can seize upon these four approaches to help restore customer trust in corporate data security: * Out With the Old, In With the New: Today’s security strategies are dominated by a singular focus on breach prevention that includes firewalls, antivirus, content filtering, and threat detection. But, if history has taught us anything, it is that walls are eventually breached and made obsolete. Companies should assume that prevention and threat detection tools can only go so far, and should be used as part of a layered approach to data security that can defend data once criminals get into the network. The next and last level of defence needs to be around the data itself and surrounding it with end-to-end encryption, authentication and access controls that provide the additional layers to protect both corporate and customer information. * Protect Customer Data As If It Were Your Own: If companies want to earn and retain customer trust, they must view the protection of sensitive data not as a compliance mandate, but as a responsibility essential to its success. Meeting the minimum legal requirements is no longer enough. If a breach hits, and companies have encrypted financial data, but not the 10 million records containing customer names, addresses and social security numbers, they’ve broken the bond of customer trust in its brand. Being a better steward of customer data is not just good PR, it makes good business sense, too. * Transparency Is the Road to Trust: Put security front and centre and tell customers about the security measures that companies have put in place to protect their data. With the recent dust-up about surveillance, the largest online companies are now much more open about what they are doing to protect customer information. If a company is doing something better than the rest of the industry, like encrypting data end-to-end, then it will be seen as a trusted innovator. * Security Is a Two-Way Street: Just as customers are informed about what companies are doing to protect them, they should also be told what to do in order to protect themselves. If a customer experiences identity theft or a data breach while doing business with a company, that brand suffers. A better-educated consumer is a safer consumer of services. As data breaches become increasingly severe and consumers become more educated on what is (or isn’t) being done to protect their data, their attitudes about what is acceptable will change. And with it, the corporate mind set on security must change. So far, customers may not have been concerned about having their credit card numbers stolen, because there are built-in protections for them. However, distress sets in if their location information is being used so thieves can rob their houses. Companies need to wake up to this new reality sooner rather than later, or else risk consumers severing ties with them and taking their business to trustworthy competitors.

Read more: http://www.prosecurityzone.com/News_Detail_Corporate_data_security_trust_restoration_22689.asp#ixzz3JJoQb3AA

Read more »

5 Cool Recent Post Widgets for Blogger

For bloggers that pride themselves on always staying up-to-date with new content, a recent post widget for Blogger can be an invaluable tool. A recent post widget for blogger is in many ways similar to a 'breaking news alert' that journalists love to use during their reports, providing the most recent and relevant posts that you have to offer.

Adding a recent post widget for Blogger helps to reduce the dependency on email marketing, because you don't have to send out an email just to let people know you made a new post. Instead, it updates automatically for everyone to see. You can then use this information to design scheduled email newsletters, and take advantage of what's often referred to as the 'Twitter effect' where audiences will regularly check back on your site for the possibility that new posts are available. Without this, you force people to do run their own search for information and content, increasing the likelihood that they'll leave the site and hurt your bounce rate.

Once you've managed to attract visitors to one of your posts using the recent post widget for Blogger, it will continue to act as an accessible secondary resource to navigate around your site. That way, you can avoid having them sifting through old content that might be outdated. If you'd rather show off some of your best posts instead of your most recent posts, you can do that instead, or add that feature to the bar with just a few alterations.

Apart from looking great and taking up minimal space, there are too many benefits for you not to have a recent post widget for Blogger. The best part about these add-ons is that they come in a wide variety of designs that will fit any theme. If you're interested in adding a widget to your site, here are 5 cool recent post widgets that might catch your eye and fit perfectly with your Blogger template:

Style #1

<script style="text/javascript" src="http://helplogger.googlecode.com/svn/trunk/helplogger/recentpoststhumbs.js"></script>
<script style="text/javascript">
var posts_no = 5;
var showpoststhumbs = true;
var readmorelink = true;
var showcommentslink = false;
var posts_date = true;
var post_summary = true;
var summary_chars = 70;
</script>
<script src="/feeds/posts/default?orderby=published&alt=json-in-script&callback=showlatestpostswiththumbs"></script>
<a style="font-size: 9px; color: #CECECE; float: right; margin: 5px;" href="http://helplogger.blogspot.com/2014/11/5-cool-recent-post-widgets-for-blogger.html" rel="nofollow">Recent Posts Widget</a>
<noscript>Your browser does not support JavaScript!</noscript>
<link href='http://fonts.googleapis.com/css?family=Ubuntu+Condensed' rel='stylesheet' type='text/css' />
<style type="text/css">
img.recent-post-thumb {width:50px;height:50px;float:right;margin: 5px -5px 0px 0px; border-radius: 100%; padding: 3px;background: #fff}
.recent-posts-container {font-family: 'Ubuntu Condensed', sans-serif; float: left;width: 100%;min-height: 55px;margin: 5px 0px 5px 0px;padding: 0;font-size:12px;}
ul.recent-posts-container {list-style-type: none; background: #fff;padding: 0px; }
ul.recent-posts-container li:nth-child(1n+0) {background: #F49A9A; width: 100%}
ul.recent-posts-container li:nth-child(2n+0) {background: #FCD092; width: 95%}
ul.recent-posts-container li:nth-child(3n+0) {background: #FFF59E; width: 90%;}
ul.recent-posts-container li:nth-child(4n+0) {background: #E1EFA0; width: 85%;}
ul.recent-posts-container li:nth-child(5n+0) {background: #B1DAEF; width: 80%;}
ul.recent-posts-container li {padding:5px 10px;min-height:50px; list-style-type: none; margin: 0px 5px -5px 5px; color: #777;}
.recent-posts-container a { text-decoration:none; }
.recent-posts-container a:hover { color: #222;}
.post-date {color:#e0c0c6; font-size: 11px; }
.recent-post-title a {font-size: 14px;color: #444; font-weight: bold;}
.recent-post-title {padding: 6px 0px;}
.recent-posts-details a{ color: #222;}
.recent-posts-details {padding: 5px 0px 5px; }
</style>

Style #2

<div class="recentpoststyle">
<script src="http://helplogger.googlecode.com/svn/trunk/helplogger/recentposts.js"></script>
<script>
var posts_no = 5;var posts_date = true;var post_summary = true;var summary_chars = 80;</script>
<script src="/feeds/posts/default?orderby=published&amp;alt=json-in-script&amp;callback=showlatestposts">
</script><a style="font-size: 9px; color: #CECECE; float: right; margin: 5px;" href="http://helplogger.blogspot.com/2014/11/5-cool-recent-post-widgets-for-blogger.html" rel="nofollow">Recent Posts Widget</a>
<noscript>Your browser does not support JavaScript!</noscript>
<style type="text/css">
.recentpoststyle {counter-reset: countposts;list-style-type: none;}
.recentpoststyle a {text-decoration: none; color: #49A8D1;}
.recentpoststyle a:hover {color: #000;}
.recentpoststyle li:before {content: counter(countposts,decimal);counter-increment: countposts;float: left;z-index: 2;position:relative;font-size: 20px;font-weight: bold;color: #fff;background: #69B7E2; margin: 15px 5px 0px -6px; padding: 0px 10px; border-radius: 100%;}
li.recent-post-title { padding: 5px 0px;}
.recent-post-title { font-family: "Avant Garde",Avantgarde,"Century Gothic",CenturyGothic,AppleGothic,sans-serif;}
.recent-post-title a {color: #444;font-size: 13px; text-decoration: none; padding: 2px; font-weight: bold;}
.post-date {padding: 5px 2px 5px 30px; font-size: 11px; color: #999; margin-bottom: 5px;}
.recent-post-summ { border-left: 1px solid #69B7E2; color: #777; padding: 0px 5px 0px 20px; margin-left: 11px; font-family: Garamond,Baskerville,"Baskerville Old Face","Hoefler Text","Times New Roman",serif; font-size: 15px;}
</style></div>

Style #3

<script style="text/javascript" src="http://helplogger.googlecode.com/svn/trunk/helplogger/recentpoststhumbs.js"></script>
<script style="text/javascript">
var posts_no = 5;
var showpoststhumbs = true;
var readmorelink = true;
var showcommentslink = true;
var posts_date = true;
var post_summary = true;
var summary_chars = 70;</script>
<script src="/feeds/posts/default?orderby=published&alt=json-in-script&callback=showlatestpostswiththumbs"></script>
<a style="font-size: 9px; color: #CECECE; float: right; margin: 5px;" href="http://helplogger.blogspot.com" rel="nofollow">Recent Posts Widget</a>
<noscript>Your browser does not support JavaScript!</noscript>
<link href='http://fonts.googleapis.com/css?family=Oswald' rel='stylesheet' type='text/css'/>
<style type="text/css">
img.recent-post-thumb {padding:2px;width:65px;height:65px;float:left;margin: 0px 10px 10px; background: #fff; border: 1px solid #69B7E2;}
.recent-posts-container {font-family: 'Oswald', sans-serif;  float: left;width: 100%;min-height: 70px;margin: 5px 0px 5px 0px;padding: 0;font-size:12px;}
ul.recent-posts-container li {padding:5px 0px;min-height:65px; list-style-type: none; margin-bottom: 5px;}
ul.recent-posts-container {counter-reset: countposts;list-style-type: none;}
ul.recent-posts-container li:before {content: counter(countposts,decimal);counter-increment: countposts;z-index: 2;position:absolute; left: 15px; font-size: 13px;font-weight: bold;color: #fff;background: #69B7E2;padding: 4px 10px; border-radius: 100%;}
.recent-posts-container a { text-decoration:none; }
.recent-post-title a {font-size: 13px; text-transform: uppercase; color: #2aace3;}
.recent-posts-details {margin: 5px 0px 0px 92px; }
.recent-posts-details a{ color: #777;}
</style>

Style #4

<script style="text/javascript" src="http://helplogger.googlecode.com/svn/trunk/helplogger/recentposts2.js"></script>
<script style="text/javascript">
var posts_no = 5;
var showpoststhumbs = false;
var readmorelink = true;
var showcommentslink = true;
var posts_date = true;
</script>
<script src="/feeds/posts/default?orderby=published&alt=json-in-script&callback=showlatestpostswiththumbs"></script>
<a style="font-size: 9px; color: #CECECE; float: right; margin: 5px;" href="http://helplogger.blogspot.com">Recent Posts Widget</a>
<noscript>Your browser does not support JavaScript!</noscript>
<link href='http://fonts.googleapis.com/css?family=Oswald' rel='stylesheet' type='text/css'/>
<style type="text/css">
img.recent-post-thumb {padding: 2px; width:35px;height:35px;float:right;margin: -14px 0px 0px 5px; border: 1px solid #cea5ac; border-radius: 10%;}
.recent-posts-container {font-family: 'Oswald', sans-serif;  float: left;width: 100%;min-height: 70px;margin: 5px 0px 5px 0px;padding: 0;font-size:12px;}
ul.recent-posts-container li {padding:5px 0px;min-height:65px; list-style-type: none; margin: 0px 10px 5px 35px;}
ul.recent-posts-container {counter-reset: countposts;list-style-type: none;}
ul.recent-posts-container li:before {content: counter(countposts,decimal);counter-increment: countposts;z-index: 2;position:absolute; left: 5px; font-size: 16px;color: #4D4D4D;background: #F7F7F7;padding: 9px 14px; border: 1px solid #efefef;}
.recent-posts-container a { text-decoration:none; }
.recent-posts-container a:hover{color: #4DACE3;}
.post-date {color:#e0c0c6; font-size: 11px; }
.recent-post-title a {font-size: 13px; text-transform: uppercase; color: #5C4D4D;}
.recent-post-title { margin: 5px 0px; }
.recent-posts-details {border-top: 4px solid #AC707A; margin-top: 5px; padding-top: 5px;}
.recent-posts-details a{ color: #888;}
a.readmorelink {color: #4DACE3;}
</style>

Style #5

<script style="text/javascript" src="https://helplogger.googlecode.com/svn/trunk/helplogger/recentposts2.js"></script>
<script style="text/javascript">
var posts_no = 5;
var showpoststhumbs = true;
var readmorelink = true;
var showcommentslink = true;
var posts_date = true;
</script>
<script src="/feeds/posts/default?orderby=published&alt=json-in-script&callback=showlatestpostswiththumbs" rel="nofollow"></script>
<a style="font-size: 9px; color: #CECECE; float: right; margin: 5px;" href="http://helplogger.blogspot.com/2014/11/5-cool-recent-post-widgets-for-blogger.html" rel="nofollow">Recent Posts Widget</a>
<noscript>Your browser does not support JavaScript!</noscript>
<link href='http://fonts.googleapis.com/css?family=Lobster|Gloria+Hallelujah' rel='stylesheet' type='text/css' />
<style type="text/css">
img.recent-post-thumb {width:50px;height:50px;float:right;margin: -4px -35px 0px 0px; border: 4px solid #FCD6CB; border-radius: 100%;}
.recent-posts-container {font-family: 'Gloria Hallelujah', cursive;  float: left;width: 100%;min-height: 55px;margin: 5px 0px 5px 0px;padding: 0;font-size:12px;}
ul.recent-posts-container {counter-reset: countposts;list-style-type: none; background: #fff; }
ul.recent-posts-container li:before {content: counter(countposts,decimal);counter-increment: countposts;z-index: 2;position:absolute; left: -20px; font-size: 16px;color: #616662;background: #FCD6CB;padding: 9px 14px; border-radius: 100%; margin-top: 15px;}
ul.recent-posts-container li {padding:5px 0px;min-height:50px; list-style-type: none; margin: -2px 5px 5px 5px;  border-top: 2px solid #FCD6CB;}
ul.recent-posts-container {border: 2px solid #FCD6CB; }
.recent-posts-container a { text-decoration:none; }
.recent-posts-container a:hover { color: #222;}
.post-date {color:#e0c0c6; font-size: 11px; }
.recent-post-title a {font-size: 14px;color: #616662;}
.recent-post-title {padding: 6px 0px;}
.recent-posts-details a{ color: #888;}
.recent-posts-details {padding-bottom: 5px;}
a.readmorelink {color: #4DACE3;}
</style>

How to Add Recent Posts Widget on Blogger

Want to add one of the styles above? Just follow the following steps below:

Step 1. Log in to your Blogger dashboard and click on your blog
Step 2. Go to "Layout" and click the "Add a gadget" link on the right side
Step 3. From the pop-up window, scroll down and select the "HTML/JavaScript" gadget:

Step 4. Paste the code of the chosen widget found below it.
Step 5. Hit the "Save" button... and that's it!

Keep Your Blog Updated

Using a recent post widget for Blogger can truly benefit you and improve your skill as a blogger. As you can see, these designs can look great on Blogger sites, but they do act a little bit like a progress report for the author. If you start to fall behind, the dates on your recent post widget will definitely give you away.

Set a schedule and make sure that you are making regular posts on the blog. These posts will be automatically updated on your widget and readers can view this information whenever they want. Add your recent post widget for Blogger on the every page of the blog or in your template so that these posts can encourage others to continue reading, thus increasing the total time spent on your site.

Read more »

15 reasons not to start using PGP

Because of popular demand, here's the collection of reasons to stop using PGP, or at least not to start.
Pretty Good Privacy is better than no encryption at all, and being end-to-end it is also better than relying on SMTP over TLS (that is, point-to-point between the mail servers while the message is unencrypted in-between), but is it still a good choice for the future? Is it something we should recommend to people who are asking for better privacy today?
The text concludes mentioning some of the existing alternatives, so, again, this is NOT about not using encryption as some critics like to presume!!!

Contents

• 1. Downgrade Attack: The risk of using it wrong.
• 2. The OpenPGP Format: You might aswell run around the city naked.
• 3. Transaction Data: Mallory knows who you are talking to.
• 4. No Forward Secrecy: It makes sense to collect it all.
• 5. Cryptogeddon: Time to upgrade cryptography itself?
• 6. Federation: Get off the inter-server super-highway.
• 7. Discovery: A Web of Trust you can't trust.
• 8. PGP conflates non-repudiation and authentication.
• 9. Statistical Analysis: Guessing on the size of messages.
• 10. Workflow: Group messaging with PGP is impractical.
• 11. Complexity: Storing a draft in clear text on the server
• 12. Overhead: DNS and X.509 require so much work.
• 13. Targeted attacks against PGP key ids are possible
• 14. TL;DR: I don't care. I've got nothing to hide.
• 15. The Bootstrap Fallacy: But my friends already have e-mail!

But what should I do then!??

• There is no one magic bullet you can learn about.
• Thank you, PGP.
• No wait, let's use PGP just a little bit longer.

Questions and Answers

• • What's the threat model here?
  • Is this about PGP or rather about e-mail?
  • What about S/MIME?
  • We need a new open standard first!
  • Why don't we fix all of these problems with PGP and e-mail?

1. Downgrade Attack: The risk of using it wrong.

With e-mail the risk always remains that somebody will send you sensitive information in cleartext - simply because they can, because it is easier, because they don't have your public key yet and don't bother to find out about it, or just by mistake. Maybe even because they know they can make you angry that way – and excuse themselves pretending incompetence. Some people even manage to reply unencrypted to an encrypted message, although PGP software should keep them from doing so.
The way you can simply not use encryption is also the number one problem with OTR, the off-the-record cryptography method for instant messaging.
This opens up for a great possibility for attack: It's enough to flip a bit in the communication between sender and recipient and they will experience decryption or verification errors. How high are the chances they will start to exchange the data in the clear rather than trying to hunt down the man in the middle?
The mere existence of an e-mail address in the process is a problem. Modern cryptographic communication tools simply do not provide means to exchange messages without encryption, so if something goes wrong at least there is no doubt it could be you doing it wrong -- and giving up on privacy becomes at least a very conscious choice.
Update: And it's not like it's a problem only for the less careful or less tech-savvy. A notable cryptographer recently sent out confidential mail unencrypted. People told him, but he didn't believe it. He wrote himself encrypted mail and indeed, there it was, the mail in the clear. Turned out that one specific version of enigmail was in some strange way incompatible with a specific version of Thunderbird, sufficiently to pretend a completely normal user experience, yet the mails would go out unencrypted, leaving just a remark somewhere in the messages log. There was no way even for the most experienced user to protect himself from a software attack of this kind. This can happen to you, too. Anytime you upgrade your operating system. But only with encryption-on-top systems like PGP.

2. The OpenPGP Format: You might aswell run around the city naked.

Thanks to its easily detectable OpenPGP Message Format it is an easy exercise for any manufacturer of Deep Packet Inspection hardware to offer a detection capability for PGP-encrypted messages anywhere in the flow of Internet communications, not only within SMTP. So by using PGP you are making yourself visible. Stf has been suggesting to use a non-detectable wrapping format.
Update: Gregory mentions that by using the –hidden-recipient flag you can tell PGP to, at least, hide who you are talking to. Hardly anyone does that: "PGP easily undoes the privacy that an anonymity network like Tor can provide" (by including the recipient's public key in the message).

3. Transaction Data: Mallory knows who you are talking to.

Should Mallory not possess the private keys to your mail provider's TLS connection yet, he can simply intercept the communication by means of a man-in-the-middle attack, using a valid fake certificate that he can make for himself on the fly. It's a bull run, you know?
Side note: Did you ever see a mail returned to you because of an invalid TLS certificate? And you can bet the net is full of invalid certificates. In most cases the mail will be delivered anyway, so Mallory doesn't even have to fake a valid certificate. He can use an invalid one, too.
Even if you employ PGP, Mallory can trace who you are talking to, when and how long. He can guess at what you are talking about, especially since some of you will put something meaningful in the unencrypted Subject header.
Should Mallory have been distracted, he can still recover your mails by visiting your provider's server. Something to do with a PRISM, I heard. On top of that, TLS itself is being recklessly deployed without forward secrecy most of the time.

4. No Forward Secrecy: It makes sense to collect it all.

As Eddie has told us, Mallory is keeping a complete collection of all PGP mails being sent over the Internet, just in case the necessary private keys may one day fall into his hands. This makes sense because PGP lacks forward secrecy. The characteristic by which encryption keys are frequently refreshed, thus the private key matching the message is soon destroyed. Technically PGP is capable of refreshing subkeys, but it is so tedious, it is not being practiced – let alone being practiced the way it should be: at least daily.

5. Cryptogeddon: Time to upgrade cryptography itself?

Mallory may also be awaiting the day when RSA cryptography will be cracked and all encrypted messages will be retroactively readable. Anyone who recorded as much PGP traffic as possible will one day gain strategic advantages out of that. According to Mr Alex Stamos that day may be closer than PGP advocates think as RSA cryptography may soon be cracked.
This might be true, or it may be counter-intelligence to scare people away from RSA into the arms of elleptic curve cryptography (ECC). A motivation to do so would have been to get people to use the curves recommended by the NIST, as they were created using magic numbers chosen without explanation by the NSA. No surprise they are suspected to be corrupted.
With both of these developments in mind, the alert cryptography activist scene seems now to converge on Curve25519, a variant of ECC whose parameters where elaborated mathematically. "They are the smallest numbers that satisfy all mathematical criteria that were set forth" explains Christian Grothoff of GNUnet.
ECC also happens to be a faster and more compact encryption technique, which you should take as an incentive to increase the size of your encryption keys.
Unfortunately, thanks to RFC 6637 GnuPG will soon support ECC with the suspicious NIST curves. Should it better break with OpenPGP and support Curve25519 instead?
Nadia Heninger tells us some more on the topic, and concludes that there is no proof that mathematical discoveries cannot cause a cryptographic meltdown anytime: "Just because nothing has happened for two decades doesn't mean that something cannot happen." It is up to you to worry if it's more likely that RSA or ECC could be cracked in future. Should a mathematical breakthrough drop from the sky, probably both would be affected.
As a side note, OpenPGP requires the use of SHA1 for its fingerprinting. That means the way most people are authenticated in PGP may someday fall apart.

6. Federation: Get off the inter-server super-highway.

NSA officials have been reported saying that NSA does not keep track of all the peer-to-peer traffic as it is just large amounts of mostly irrelevant copyright infringement. It is thus a very good idea to develop a communications tool that embeds its ECC- encrypted information into plenty of P2P cover traffic.
Although this information is only given by hearsay, it is a reasonable consideration to make. By travelling the well-established and surveilled paths of e-mail, PGP is unnecessarily superexposed. Would be much better, if the same PGP was being handed from computer to computer directly. Maybe even embedded into a picture, movie or piece of music using steganography.

7. Discovery: A Web of Trust you can't trust.

Mike Perry has made a nice collection of reasons why the PGP Web of Trust is suboptimal. It is in many ways specific to the PGP approach and not applicable to other social graphs like secushare's. Let's summarize: The PGP WoT

1. is publicly available for data mining,
2. has many single points of failure (social hubs with compromised keys) and
3. doesn't scale well to global use.

So these are actually three more reasons not to use PGP, but since you can use PGP without WoT we'll count them as one.
Update: Just found out that when you look up a key your amazing PGP client will by default do a cleartext HTTP request to the key server. Thus anyone can see who your conversation partners are. Maximum total privacy failure!

8. PGP conflates non-repudiation and authentication.

"I send Bob an encrypted message that we should meet to discuss the suppression of free speech in our country. Bob obviously wants to be sure that the message is coming from me, but maybe Bob is a spy … and with PGP the only way the message can easily be authenticated as being from me is if I cryptographically sign the message, creating persistent evidence of my words not just to Bob but to Everyone!" (Thanks, Gregory, for providing this eleventh reason ;-)).

9. Statistical Analysis: Guessing on the size of messages.

Especially for chats and remote computer administration it is known that the size and frequency of small encrypted snippets can be observed long enough to guess the contents. This is a problem with SSH and OTR more than with PGP, but also PGP would be smarter if the messages were padded to certain standard sizes, making them look all uniform.

10. Workflow: Group messaging with PGP is impractical.

Have you tried making a mailing list with people sharing private messages? It's a cumbersome configuration procedure and inefficient since each copy is re-encrypted. You can alternatively all share the same key, but that's a different cumbersome configuration procedure.
Modern communication tools automate the generation and distribution of group session keys so you don't need to worry. You just open up a working group and invite the people to work with.

11. Complexity: Storing a draft in clear text on the server

Update: These days mail tools are too complicated. Here come enigmail that is in charge of encrypting mails before they leave Thunderbird. But wait, didn't Thunderbird just store a draft? Yes, and since I happen to have IMAP configured it stored the draft to my server. Did it bother that I had checked the flag that I intend to encrypt the mail? No, the draft is on the server in the clear. I look around and find out that Claws has been having the same bug. I'm not surprised, after all it's the most natural way of doing things. One person implements IMAP, another implements PGP support, and they never bump into each other and realise that the default behaviour of a mail agent that supports both is to do what it should in no way ever do: send the unencrypted mail to the server. This makes the entire effort to use PGP useless. I looked around for warnings, but even the best manuals for doing PGP correctly are aware of a lot of problems, but not this one. I am only on day three of really using PGP, and I already discovered a security flaw that no-one has talked about much ever before. Is this normal? I have Thunderbird 17.0.8 and you?
P.S. I recommend you to turn off saving mail drafts to the server.

12. Overhead: DNS and X.509 require so much work.

This may seem unrelated, but PGP builds upon e-mail, and e-mail unnecessarily enforces a dependency on DNS and X.509 on us (the TLS and HTTPS certification standard that makes us need certificates, signed by an /authority,/ and then can be fooled and broken anyway). Both cost money to participate in and have to be meticulously administered. Anyone who tried to do it, knows: Mail (and also Jabber) server administration is annoying and expensive.
All the modern alternatives are either based on DHT technology, social graph discovery or opportunistic broadcast. All of them are powered by the mere fact that you are using the software. Frequently there will be sponsored servers providing for faster service, as it has become the standard for Tor, but the administration of such servers is trivial: Just unpack the software and run it (exit nodes are a special case).
Why are you accepting being enslaved by e-mail?

13. Targeted attacks against PGP key ids are possible

PGP has a bad habit of using truncated fingerprints as key ids, organizing keys in its database by short key id and dealing keys with the same short key id as probably being the same, although it isn't so hard to make a new key pair that resolves to the same key id as an existing one. This seems to be a problem even with long key ids. Now people say you should use the full fingerprint, but I remember a time when it was said that the purpose of fingerprints is just for simplifying the comparison of keys among human beings. Computers should always ensure the identity of a public key by comparing nothing less than the public key. By using short ids for maintaining keys the PGP software implementations are doing it wrong.
One possible consequence of this is that users could be tricked into accepting a false replacement key from a key server or in some other way confuse their key management to the point of corrupting a communication path that used to be safe and allowing a man in the middle into the game. People who have just their short key id printed on their business card could suffer targeted man in the middle attacks: The MITM just needs to intercept the keyserver look-up, which as we know is unencrypted by default, and produce the false recipient data. The MITM must then also intercept in- and outgoing SMTP traffic in order to re-encrypt the mail conversation on the fly to the actual key the recipient expects and vice versa. This can in fact be automated to undermine the PGP infrastructure on a large scale, but it would not go unnoticed whereas a targeted attack most likely would.
You can make the attack slightly more difficult by using encrypted key server look-ups (= learn to configure gpg to use sane defaults), but since the key servers do not use PGP to authenticate themselves you can still suffer a MITM attack on the TLS certification level (see X.509 above). And of course there is also the possibility of the key server itself being used in a targeted operation against you. In practice the only currently secure way to communicate a key on a business card is to print its entire fingerprint along with the look-up id – and not forget to actually check it (happened to me, so I bet it happens to you).

14. TL;DR: I don't care. I've got nothing to hide.

So you think PGP is enough for you since you aren't saying anything reaaally confidential? Nobody actually cares how much you like to lie to yourself stating you have nothing to hide. If that was the case, why don't you do it on the street, as John Lennon used to ask?
It's not about you, it's about your civic duty not to be a member of a predictable populace. If somebody is able to know all your preferences, habits and political views, you are causing severe damage to democratic society. That's why it is not enough that you are covering naughty parts of yourself with a bit of PGP, if all the rest of it is still in the nude. Start feeling guilty. Now.

15. The Bootstrap Fallacy: But my friends already have e-mail!

But everyone I know already has e-mail, so it is much easier to teach them to use PGP. Why would I want to teach them a new software!?
That's a fallacy. Truth is, all people that want to start improving their privacy have to install new software. Be it on top of super-surveilled e-mail or safely independent from it. In any case you will have to make a safe exchange of the public keys, and e-mail won't be very helpful at that. In fact you make it easy for Mallory to connect your identity to your public key for all future times.
So installing a brand new software that only provides for safe encrypted communications as actually an easier challenge then learning how to use PGP without messing it up.
If you really think your e-mail consumption set-up is so amazing and you absolutely don't want to start all over with a completely different kind of software, look out for upcoming tools that let you use mail clients on top. Not the other way around.

But what should I do then!??

So now that we know n reasons not to use e-mail and PGP, let's first acknowledge that there is no obvious alternative. Electronic privacy is a crime zone with blood freshly spilled all over. None of the existing tools are fully good enough. We have to get used to the fact that relevant new tools will come out all the time, and you will want to switch to a new software twice a year. Mallory has an interest in making us believe encryption isn't going to work anyway – but internal data leaked by Mr Snowden confirms that encryption actually works. We should just care to use it the best way.

There is no one magic bullet you can learn about.

You have to get used to learning new software frequently. You have to teach the basics of encryption independently from any software.
In the comparison we have listed a few currently existing technologies that provide a safer messaging experience than PGP. The problem with those frequently is, that they haven't been peer reviewed. You may want to invest time or money in getting projects reviewed for safety.
Pond is currently among the most interesting projects for mail privacy, hiding its padded undetectable crypto in the general noise of Tor. Tor is a good place to hide private communication since the bulk of Tor traffic seems to be anonymized transactions with Facebook and the like. Even better source of cover traffic is file sharing, that's why RetroShare and GNUnet both have solid file sharing functionality to let you hide your communications in. Bitmessage even tries to get it working on top of a Bitcoin-like architecture. Very daring. Other interesting developments are Briar and our own, secushare, but they aren't ready yet.
Mallory will try to adapt and keep track of our communications as we dive into cover traffic, but it will be a very hard challenge for him, also because all of these technologies are working to switch to Curve25519. GNUnet intends to only support Curve25519 to impede downgrade attacks. Until the next best practice comes out. It's an arms race. Time to lay down your old bayonet while Mallory is pointing a nuclear missile at you.

Thank you, PGP.

Thank you Mr Zimmermann for bringing encryption technology to the simple people, back in 1991. It has been an invaluable tool for twenty years, we will never forget. But it is overdue to move on.

No wait, let's use PGP just a little bit longer.

Jacob Appelbaum recommends to use PGP over Pond instead of over E-Mail. Indeed, in that case most weaknesses listed above are no longer a problem. Also you don't depend totally on the safety of Tor and Pond, so it doesn't matter if Pond hasn't been peer-reviewed yet as long as it works. You can even use PGP in a non-repudiable way, since Pond takes care of authentication. Actually this should work with any of the P2P alternatives to SMTP.

Questions and Answers

Some questions were posed on libtech which deserve an answer:

What's the threat model here?

What if Mallory isn't a well-funded governmental organization but is the admin who runs your employer's email servers?
That's a good point. The reason why I don't pay attention to lesser threat models is that the loss in quality of democracy we are currently experiencing is large enough that I don't see much use for a distinction of threat models - especially since alternatives that work better than PGP exist, so they are obviously also better for lesser threat models.
For example, I don't think that a dissident in Irya (ficticious country) is better off if no-one but Google Mail knows that he is a dissident. Should at any later time in his life someone with access to that data find it useful to use it against him, he will. And who knows what the world looks like in twenty years from now?
Not saying give up and die. Saying if you can opt for better security, don't postpone learning about it. If you can invest money in making it a safe option, don't waste time with yet another PGP GUI project or the crowdfunding hype of the day.
If employers, schools, parents, skiddies can find out who you are exchanging encrypted messages with, that can be a very real threat to you. Using a tool that looks like it does something totally different.. on your screen, over the network and even on your hard disk.. can save your physical integrity.

Is this about PGP or rather about e-mail?

I don't think it makes much difference for the end user whether SMTP federation or actual PGP is failing her. It's slightly more about SMTP.

What about S/MIME?

"S/MIME unfortunately suffers from many of the same issues as OpenPGP, and then some more." I don't find S/MIME worth mentioning anymore. It has so failed us.

We need a new open standard first!

Open standards are part of the problem, not the solution. It is a VERY BAD development that it has become en vogue to require standardization from projects that haven't even started functioning. It has been detrimental to the social tool scene: None of them work well enough to actually scale and replace Facebook, but the scalability problems are already being cemented into "open standards," ensuring that they never will function. Same thing happened with Jabber as it turned into XMPP.
You must ALWAYS have a working pioneer tool FIRST, then dissect the way it works and derive a standard out of it. Bittorrent is a good example for that. It's one of the few things that actually works. Imagine if Napster and Soulseek had developed an open standard. It would only have delayed the introduction of Bittorrent, promoting an inferior technology by standardization.

Why don't we fix all of these problems with PGP and e-mail?

Even if all the effort is done that a project like LEAP is striving for, you will still be receiving SPAM and unencrypted mail, just because you have a mail address. You will still have a multitude of hosts that are still "unfixed" because they don't care to upgrade. You will still carry a dependency on DNS and X.509 around your neck just to be able to be backwards compatible to an e-mail system of which you hope you won't have to send or receive any messages since they will damage your privacy. And I still don't see by which criteria a dissident should pick a trustworthy server. I know I can rent one, but even if I have a root shell on my "own" server, it doesn't mean it is safe. It's better not to need any!
So what is this terrific effort to stay backward compatible good for? I don't see it being a worthwhile goal. There is so much broken about it while a fresh start, where every participant is safe by definition, is so much more useful. Especially you don't have that usability challenge of having to explain to your users that some addresses are superduper safe while other addresses are lacking solid degree of privacy.
One major problem with the new generation of privacy tools is, they are so simple, people have a hard time believing they are actually working.

Read more »