The BBC reports on fraud in the German car scrap

According to police, the owners had already received the government subsidy under the scrappage scheme, but instead of being destroyed the cars ended up in the hands of criminal gangs who sold them on.

This is not an isolated case and police say a number of factors are to blame.

Thanks to the global downturn the scrap metal market has crashed, so many scrapyard dealers are sitting on a mountain of old cars they need to get rid of.

There are lax controls and criminal gangs are becoming more savvy.

The government now estimates around 10 percent of the plan, as many as 50,000 cars, have been diverted by criminals. It seems that it would not be terribly hard to track the scrapped automobiles but apparently no one noticed until a Hamburg port cargo check revealed 40 old cars headed to Africa.

Well, why not? Here’s a quick attempt to generate one of my own:

This is much more fun than the latest “ASS certification” joke seal.

Given all the hype about application security expertise, those guys so far have only generated a boring generic image file.

Certified Application Security Specialist

A certified ASS hat is funny, but not that funny. The members of the ASS movement should also reject all forms of training. They do not explain whether, for example, they can support a high school diploma and university or college degree but not other forms of education and testing. Is it a total rejection of any form of achievement and measure, or are they targeting certain certificates for specific reasons? Would they even reject certificates of birth, like this one?

Trey Ford raises some good questions that are very much the same as asking about systems that may (or do not have) cardholder data but are important enough to beg scope creep analysis.

Of course it’s easy for us to say “test all of them” when we sell security testing services. However, in my experience explaining ways to reduce scope without increasing risk are far more popular. :)

Security managers are not always blessed with a budget that can afford a “test all” approach. They usually only get support to build a keep smaller than the entire castle, if you will. Although you hinted at it, I would add that PCI DSS compliance should come from a risk-based approach. This is how to safely reduce scope as well as costs for validation.

Note that DSS 1.2 changed Requirement 6 to say “a risk-based approach may be used to prioritize patch installation”. Can the same be said for selecting sites and systems to be in scope? If cardholder data is transmitted, processed or stored, then it’s for sure in scope, if it doesn’t exist, then the asset value, frequency and likelihood of compromise related to the non-CHD could bring them into scope. Know your sites, but more importantly know your processes.

Back to my cheesy castle example, this is like saying if you are someone within the walls who has access or potential access to the king, then you also should be within scope of a keep security assessment. Your identity and your possessions are important to know, but your routine (processes) are also a key to understand (pun intended). The king’s security should assess the risk from this perspective and consider changing to a more isolated routine, which would thus reduce the scope/cost of protection.

All that being said, I noted a curious mistake in Trey’s writing:

Four good questions ome

Don’t you just hate when that happens? Automated checks, visual cues (e.g. code highlight)…and yet bugs still creep into web sites, even those of web security experts.