PCI DSS Effective – According to Breach Reports

The new data is in. When I presented for the PCI Security Alliance and SafeNet at RSA in 2009 I used breach data in datalossdb.org to show that PCI DSS was working and we could prove it.

The following two reports explain this trend in much greater detail. I will handle them individually later, but for now here are a couple highlights:

Verizon has posted the “2011 Data Breach Investigations Report

After four years of increasing losses culminating in 2008’s record-setting 361 million, we speculated whether 2009’s drop to 144 million was a fluke or a sign of things to come. 2010’s total of less than four million compromised records seems to suggest it was a sign.

Imperva has posted “PCI’s Impact on Security Quantified

PCI is very effective in reducing breaches but it seems many companies don’t believe it.

USAID sends Elmo to Pakistan

You might have noticed my post the other day about USAID.

The agency is “waiving” iPads through security requirements straight into field use by government officials.

I wondered what they possibly could be doing with the iPads, besides trying to annoy Secretary of State Clinton. Now I get it. They have drafted Elmo into service.

U.S. officials are taking a different approach, hoping that “Sesame Street” can instill education values in very young Pakistani children, arming them with the learning tools to fend off extremism later in life.

[…]

The format will be largely the same as the U.S. version, with each episode highlighting one letter and number for children to learn. Like the U.S. version, the program will also have strong female characters, with the subtle aim of promoting tolerance and gender equality. But it’s not slated to touch on any political themes outright.

Slated to touch? If that’s not a giant hint, I don’t know what is. Elmo needs a distribution channel. I mean how will Elmo reach all those impressionable children across rural Pakistan?

Obviously iPads (slates with touch) will be dropped from the sky. Elmo will be playing on them as they fall, saying “I come without any political themes outright”.

This sounds a lot like the modern equivalent of Para leer al Pato Donald (How to Read Donald Duck) published in Chile in 1972

…the world shown in the comics [sent to Latin America from the US], according to the thesis, is based on ideological concepts, resulting in a set of natural rules that lead to the acceptance of particular ideas about capital, the developed countries’ relationship with the third world, gender roles, etc.

Phase two, after the youth Elmo-isation is complete, US soldiers will deploy in Elmo suits to blend in and win local support.


Look Mr. Chief! Look Everybody! Elmo is your friend!

FlyNano Safety Concerns

The recent announcement of a recreational ultralight aircraft in Europe called FlyNano has raised some concerns about safety. Critics doubt whether the “Harley of the Sky” can really avoid a pilot license requirement just because of its weight.

It is in truth more of a flying jet-ski than a motorbike, since it can only land on water, but its unique quality is its weight – at just under 70 kilos (154 pounds), it beats certain international regulations for license-only aircraft. This could potentially make it the ideal option for the recreational flyer who lacks the means to get a full pilot’s license.

FlyNano

Unlicensed inexpensive planes that take-off and land on water? I can see half of Tiburon trying to commute to San Francisco with these across complex shipping lanes and weather patterns. What could go wrong? Perhaps if it really takes off (pun not intended) in popularity they should rename it the jet-flea.

Hill Fort Theories Challenged

Archeologists working on a Hill Fort excavation in England have started to argue that ancient stone structures were meant for security during warfare in the Iron Age. This counters the more predominant theory, formed over the past 30 years, that stone walls served an ornamental function — represent prosperity and prestige rather than a military purpose.

The prestige theory apparently was based on an absence of evidence of threat, rather than evidence of the absence of threat (as Carl Sagan might have put it).

The dig site at a spot called Fin Cop is said to give new evidence of threats. It provides unique insight because the remains have been better preserved by limestone, which is harder and more acidic than other dig sites. Bones found in a mass grave, for example, are known to be women and children. Dr Clive Waddington of Archaeological Research Services suggests that they must have been victims who suffered a violent end after their fort was defeated.

“For the people buried at Fin Cop, the hurriedly constructed fort was evidently intended as a defensive work in response to a very real threat.”

The skeletons are of women, babies, a toddler and a single teenage male. The archaeological team believe they were probably massacred after the fort was attacked and captured.

All were found in a 10m long section of ditch, the only part to be excavated so far. The ditch was 5m wide with 2m deep vertical edges and would have guarded a 4m high perimeter wall.

Animal bones, also found in the ditch, suggest the fort’s inhabitants kept cattle, sheep and pigs. There were also remains from horses which indicate some of the fort’s inhabitants were of high status.

Ok, I’ll bite. What was the very real threat? It must have been something so powerful to eliminate or enslave all the men in the fort without leaving any trace of them. There is a curious disparity between bones found in the ditch. Was the ditch a pre-existing spot where animal waste was hauled outside the fort and then it was converted into a mass grave by attackers?

I wish they had given more evidence on how they formed the new hypothesis. The BBC fails to mention whether the skeletons have marks from iron or stone weapons, for example.

Given all that they’ve revealed to the BBC, maybe there are other angles to explore.

The men and women may have migrated away from another area to start a new fort and ran into harsh weather. The men went off to hunt or get help as the women hastily built the structure. The food soon ran out and the women died of natural causes.

Maybe the group was ostracized because of disease or other differences.

The men either died during the hunt or came back and found everyone expired. The bodies would have been dumped in the ditch, which already had the animal remains, and covered with the rocks of the failed settlement to make it into a grave.

The Guardian picks up some of these alternate theories.

There could be gentler explanations for the deaths: none of the nine skeletons show signs of violence, suggesting death would have been from flesh wounds or suffocation – or possibly disease.

Explanations could include a disastrous plague or the punishment of a household by the rest of the community.

We really don’t know whether the threat to the women and children was inside or outside the fort walls.

A clearer picture and more compelling analysis can be found on Diggings.

The fact that the bones were found together rather than scattered by weather or the depredations of wild animals indicated that she had been buried rather than simply discarded in the ditch – but all that buried her were the tumbled stones of the wall! In other words, whoever tossed her body into the ditch had then deliberately demolished the defences of the fort and covered her with the stones of the dismantled wall.

Jim Brightman, one of the project managers, said: “Quite a lot of very important finds cannot look like much on site, but when you get back to the lab and throw the scientific techniques and analysis at them, that’s when you start to get the story out. The bones are a great example of that, we found out so much more by analysing them.”

On the other hand, if you pull forensic data too far from the target you might lose the context necessary to make sense of it despite your best scientific techniques and analysis.