Category Archives: Security

PCI Security Standards Council

Officially launched today:

American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa International today jointly announced the formation of an independent council designed to manage the ongoing evolution of the Payment Card Industry (PCI) Data Security Standard, which focuses on improving payment account security throughout the transaction process. The founding of the PCI Security Standards Council, LLC, marks a significant milestone in the payment industry’s efforts to secure payment account data in a globally consistent manner. Ultimately this means that more than a billion global payment card users will benefit from a higher level of security protection against data theft and fraud.

This gives companies a more formal input process to manage the PCI standards and ensure global consistency:

Specifically, the PCI Security Standards Council will:

* Develop and maintain a global, industry-wide technical data security standard for the protection of accountholder account information;
* Reduce costs and lead times for Data Security Standard implementation and compliance by establishing common technical standards and audit procedures for use by all payment brands;
* Provide a list of globally available, qualified security solution providers via its Web site to help the industry achieve compliance;
* Lead training, education, and a streamlined process for certifying Qualified Security Assessors (QSAs) and Approved Scanning Vendors (ASVs), providing a single source of approval recognized by all five founding members; and
* Provide a transparent forum in which all stakeholders can provide input into the ongoing development, enhancement and dissemination of data security standards.

US behind in mobile market/infrastructure

This isn’t really news to anyone working in the mobile industry, but Brad Stone has a nicely written explanation of what it feels like to switch from the US devices to those overseas:

Thanks to early investments in high-speed mobile networks, Japan’s cellular telephone industry is about a year and a half ahead of America’s. Everywhere you look, it shows.

The global platform of the future is clear, even if the US is falling behind, yet a common idea of what and how security should work on these devices is less obvious. When adoption rates are king people usually are enticed by rapid release of gadgets/features, lured by status symbols and sometimes compelled by ease of use. However, they may not realize or bother to consider how their risk posture changes (both positive and negative) in a truly mobile environment:

…the three companies [in Japan] are fiercely trying to entice their customers to stay and lure new users from their rivals. Prices are dropping, new handsets are coming and the carriers are upgrading networks with even faster 3G technology. New applications on the horizon include video calls, biometric authentication (using your fingerprint to authorize phone purchases) and handsets that remotely program home electronics and open locked doors. Automobile-trapped, PC-addicted American’s haven’t shown nearly as much interest in these kinds of advanced mobile-phone applications. So there’s no telling when, or if, these futuristic features will ever make it across the ocean.

BioDiesel versus Hydrogen

I was reading a report from 2004 on converting algae to biodiesel when I came across this passage that highlights some of the giant problems (pun intended) with hydrogen:

Hydrogen as a fuel has received widespread attention in the media of late, particularly ever since the Bush administration proclaimed that developing a hydrogen economy would clean our air, and free us of oil dependence. There are many problems with using hydrogen as a fuel. The first, and most obvious, is that hydrogen gas is extremely explosive. To store hydrogen at high pressures for as a transportation fuel, it is essential to have tanks that are constructed of rust-proof materials, so that as they age they won’t rust and spring leaks. Hydrogen has to be stored at very high pressures to try to make up for its low energy density. Diesel fuel has an energy density of 1,058 kBtu/cu.ft. Biodiesel has an energy density of 950 kBtu/cu.ft, and hydrogen stored at 3,626 psi (250 times atmospheric pressure) only has an energy density of 68 kBtu/cu.ft.4 So, highly pressurized to 250 atmospheres, hydrogen’s volumetric energy density is only 7.2% of that of biodiesel. The result being that with similar efficiencies of converting that stored chemical energy into motion (as diesel engines and fuel cells have), a hydrogen vehicle would need a fuel tank roughly 14 times as large to yield the same driving range as a biodiesel powered vehicle. To get a 1,000 mile range, a tractor trailer running on diesel needs to store 168 gallons of diesel fuel. When biodiesel’s slightly lower energy density and the greater efficiency of the engine running on biodiesel are taken into account, it would need roughly 175 gallons of biodiesel for the same range. But, to run on hydrogen stored at 250 atmospheres, to get the same range would require 2,360 gallons of hydrogen. Dedicating that much space to fuel storage would drastically reduce how much cargo trucks could carry. Additionally, the cost of the high pressure, corrosion resistant storage tanks to carry that much fuel is astronomical.

Whew. And he is just talking about the risk of stored hydrogen. When you consider the risk of transporting hydrogen, another set of challenges quickly appears:

The process of transitioning to hydrogen delivery via the existing network is complicated by the diversity of materials used in natural gas piping systems and of operating strategies adopted by utility operators.

[…]

Hydrogen embrittlement can include surface cracking, slow crack growth, loss of ductility, and
decreases in fracture stress. This deterioration can lead to premature failure, possibly with little
warning. Safety is paramount to all aspects of natural gas operations so before hydrogen gas can be
introduced into the pipeline, operators must be assured that embrittlement risks have been minimized.

This seems to me almost identical to the process of evaluating data risks, as you have to consider stored as well as transit controls that prevent leakage. In that sense, biodiesel is like publically available information that requires little/no protection while hydrogen is like your most top secret data that you must protect at significant cost. Pop quiz: can something that needs to be handled as top-secret ever reach wide-spread adoption? Ok, besides a social security number or credit card number. :)

Speaking of evaluating risk, some friends who served in the special forces have been trying to convince me that the reason troops use diesel is because it was mandated by the Navy as a less dangerous fuel. They tell me that not only are diesel ships safer, since diesel is far less combustible, but they also require their cargo to be diesel-powered for the same reason. I tried to make the case that jet-fuel is carried on ships, but I was assured that it too was non-explosive — requires a proper fuel/air mixture to ignite. No wonder then why the military was so keen to convert to diesel motorcycles. Although an explosive fuel on a motorcycle is not a huge risk (compared to a HumVee or Ship) the logistics of having a ready supply of a stable/safe fuel source probably were reason enough to convert everything to diesel.

So, the military gets it, the farmers get it, the transportation industry gets it…security comes from stable fuel sources like biodiesel. Easy to store, easy to transport. Could this be the very reason the American auto industry prefers hydrogen? Such a dangerous substance requires a huge capital investment and central planning that makes it difficult if not impossible for individuals and small-companies to compete, thus ensuring dominance by the big guys. On the other hand, given the recent surge of gasoline-guzzling retro muscle cars to the American market, maybe the US companies just don’t get it in the way that the captain of the Titanic thought his rudder was big enough and his ship could never sink.

Maybe that is too dramatic a comparison, so here is another one to ponder: In the early 1990s a seasoned executive from the computer industry was trying to figure out how to get information into people’s homes through game consoles and interactive TV. As he found cable companies mired in regulations and fighting over who would set the standards (e.g. control), he also stumbled upon some enterprising students in Illinois quietly building something called a web browser. And thus Mosaic was born, forerunner to Netscape. To those of us who were on that bandwagon, it seemed obvious that the future was in cheap, easy and localized creation of content rather than giant traditional media. So the real question in today’s energy market seems similar. Who from the big automobile or giant petroleum companies will be the one to finally defect and light a fire under the alternative fuel market? Vinod Khosla is close, but gets no cigar for his presentation on Ethanol-only…

Peeing on the digital fence

Will Rogers once said:

There are three kinds of men. The ones that learn by reading. The few who
learn by observation. The rest of them have to pee on the electric fence for themselves.

Interesting to note that he suggests learning only comes from input. I suspect output also can teach. We certainly learn from doing…

His last category fits Ranum’s notion about security and user education, although Ranum might have sounded more like “users have to pee on the digital fence…”, which of course would be electrified.