Liquid rules. Get it? Only hard rules will remain. But seriously, even though this is old news, I am still annoyed that the TSA in Grand Junction, Colorado made me throw away my 5oz of toothpaste. I had traveled through many major airports without hassle, but Grand Junction clearly was on high alert and nabbed my tube. We should see the TSA relax rules this year:

New X-ray technology that can differentiate between “threat” liquids used in bombs and harmless liquids is on track to be deployed within a year, according to the TSA. These new X-Ray machines would allow the TSA to phase out its restrictions on carry-on liquids, first by increasing the quantity permitted and later by eliminating the need for passengers to remove their liquids to be X-rayed.

Thank you technology, but thank you especially to the voice of reason. The overreaction was stifling.

I have been asked by many to comment on the breach news regarding credit-card processor Heartland. Unfortunately I can not reveal too many details, but I would like to point out this smack down on Avivah Litan of Gartner.

“I would call this the largest breach ever,” Ms. Litan said.

But Robert Baldwin, Heartland’s president and chief financial officer, called her estimate a “totally fictional number.” The company added that, since it’s too early to say how many records were accessed, calling it the largest-ever breach would be “speculative.”

Ouch. Hahaha. But seriously, you can count on Litan to make some crazy statements about security, as I’ve pointed out before.

[Kiosks] are highly prone – given their public locations – to criminal tampering. They are a perfect target for thieves.

Perfect target. Largest breach ever. See what I mean?

I predict you will see the most fallout in this case from the sophistication of the attackers. It goes right to the core debate about encryption on the wire, as well as detection of customized malware (the sort of stuff your off-the-shelf anti-virus can’t see). A forensics investigator found the evidence of this breach, which should tell you a lot about the level of security awareness that is now required when dealing with major assets. Companies can no longer bank on simple log analysis if they want to run a safe shop. Thus, despite the sour economy, demand for correlation software as well as security investigators is rising for a reason. In this case PINs are not believed to have been exposed, but unencrypted data for hundreds of thousands of merchants was captured by attackers as it was transmitted to the card brands.

Kind of reminds me of the recent Nevada encryption law…any guesses where the regulations are going next?