Skip to content

Month: March 2015

1

Published on 1 Comment on EMV and PCI compliance

Good Security means doing good basic IT.

And sometimes it also means keeping up with new compliance initiatives by industry or government.

This year October 1, 2015 there is a new Payment Card Industry(PCI) rule going into effect. On October 1st the liability of a security breach will go to the merchant not the bank or processor.

Here is an article that discusses certain aspects of the http://news.investors.com/technology/032015-744412-latest-point-of-sale-endpoint-security-tackles-expensive-breaches.htm Point Of Sale system.

EMV (the Europay MasterCard Visa credit card standard) will come to the US by October 1st as well. And if you will get new machines anyway get ones which have point-to-point  encryption.

cardpresentvulnerabilitiesImage from visa.com
the problems in most small merchants are basic in nature. the PCI Industry has created a standard:
which is located in the following location: https://www.pcisecuritystandards.org/
  • Insecure remote access used by attackers
  • Weak or Default passwords and setting commonly used
  • Lack of network segmentation
  • Malware deployed to capture t card data.
  • Absence of antivirus tools to detect malware

 

If you add a firewall and Intrusion Prevention Systems  you will protect yourself even further.

http://oversitesentry.com/cyberwar-you-aint-seen-nothin-yet/

Then  add the Polliwall, now it will be almost impossible for the standard criminals to take your systems. None of us can defend against the nation states, but if we can defend against everyone else then we have created the defensive system for 2015.

Published on Leave a comment on How to create a more secure Work-home place.

One does not have to be on the cutting edge of technology to be secure.

But, in my hacking classes (where we try to attack other computers with Metasploit it is  obvious very quickly that with a patched machine, even a WindowsXP system it is much harder to crack.

Now of course, WindowsXP happens to be almost obsolete. On April 8th Microsoft has said it will no longer support updates to Microsoft WindowsXP operating system. Here is a link for Enterprises to help with the transition away from WindowsXP.

So other than End Of Life Oepraitng systems one does not need to stay up on the latest OS, to have a secure computer, just keep up with the patches and you will be more secure than many others.

the key is to review your systems and network environment for unknown gotchas.

Contact Us as we can help with your review process.  Our products:

(A – Σ – Ω)

 

 

Published on Leave a comment on Fixvirus Video Show: We’re Cyberstruck and #Cybersecurity Rowhammer problem

News of Day: The Rowhammer and this week is Patch Tuesday.

In tip of Day segment we have a serious problem, as Rowhammer opens a new security angle which cannot be patched for some machines.dramsmall

 

Some RAM has a bit-flipping problem in certain situations which can cause an escalation of privilege, so if the hacker is on the computer, they can get admin or root access.

We need to realize that today's researchers develop exploits that then criminals use to attack our computers, and then the script kiddies use to attack the people who don't know how to use computers.

 

So we have to develop a new method of thinking - security must be built into our processes and methods. Compliance means security first. Otherwise we will get blindsided by the newest researcher attacks.

 

Remember our systems were not built for security first, the internet was not built with security in mind. So we will have many other attacks and eploits to keep in mind.

 

This is why you need a security department, somebody who is thinking about the security angle all the time.

Contact Us