Category Archives: data security

Microsoft HoloLens, Mobile vs. Good Web-Design, and Security Needs Innovation Not Gov’t.

Microsoft HoloLens1) We knew there would come another well-positioned company who makes a pair of smart glasses like Google Glass and that it will derive more competition and innovation. Microsoft raised their hand right away with their HoloLens glasses which are hologram based, slightly “gamified”, and seemingly better than Google Glass largely because they tied it in with known Windows functionality (broader offerings). See a video of this cool new technology here:

2) It is a fact that on average people now access more of their e-mail via mobile devices more often than on a traditional computer. This has forced websites, news makers, and companies to design their web offerings in a mobile compatible design so when you go to the web on a computer the sites are often overly mobile in their design aspects and sometimes look goofy and the buttons and frames are too big. CNN.com is a good example of a web-site that went too far with their mobile design so if you access it from a normal computer it looks more like a kids play web-site with big buttons and frames optimized for touch with little info presented. Yet their prior design was better especially if you want to read more on one screen view.

(Old vs. New CNN.com, respectively)
Old and New CNN WebsiteThere is no doubt that mobile will continue to grow and will be used on smaller devices like watches, ear buds, pacemakers, and contact lenses. Web design has shifted so fast to mobile that sometimes good web design and user experience is forgotten about for non-mobile users or business users who on average spend much more time on those same sites than mobile users. Thus a better balance of the two design types is needed, and an app is a separate project all together yet still needed. I also think Microsoft will take more mobile market share away from Android and Apple since they have learned a lot from their Windows 8 release and are quickly working to release Windows 10 as a better touch based mobility optimized O.S. that many are excited to try.

3) There will be more data breaches but many of them will be supported by the Western Governments who in effect devalue security standards by corroborating with large companies to quarry vast amounts of metadata all in the name of security. Sadly we know Governments have abused this power in the past and will continue to do so thus the private sector needs to collaborate and inspire innovation in this space for better security and transparency so the masses may have security and corrupt Governments can be exposed.

Equation group victims map

As it stands now hackers are a few steps ahead of antivirus makers and they are constantly tweaking their viruses so they can’t be detected. The newest types of viruses are suspected to be created by the Equation Group, one of the most sophisticated hacking groups ever known. These new viruses hide in your hard drives firmware and are undetectable. Antivirus maker Kaspersky commented on this in their Q&A doc on the Equation Group by stating, “We were able to recover two HDD firmware reprogramming modules from the EQUATIONDRUG and GRAYFISH platforms. The EQUATIONDRUG HDD firmware reprogramming module has version 3.0.1 while the GRAYFISH reprogramming module has version 4.2.0. These were compiled in 2010 and 2013, respectively, if we are to trust the PE timestamps” (http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/files/2015/02/Equation_group_questions_and_answers.pdf).

Kaspersky went on to further speculate that there were clues that the U.S. N.S.A. was involved in the latest hard drive firmware virus and even suggested they had the cooperation of major hard drive makers like Western Digital, Seagate, Samsung, and Toshiba in order to get the code needed to write the virus. Any reasonable technologist would likely agree with this. Yet this decreases innovation and free competition and you know big money likely traded hands to make these deals happen. How can a big company now trust paying a technology company for security or services when they are just going to give it away to supposed governments here or elsewhere? More importantly, if one government has the ability to get into a tech companies data, then other more ill-intentioned governments and organizations can quickly learn how to do that as well and that is the real threat.

If you want to hire me to speak at your next event or consult for your company on these and related topics please contact me.

Thought$ On The Future of Digital Curren¢y For A Better World

In the old days the gold standard was the way global economies secured their financial backing yet over time that got to be too costly to secure and too heavy to move. In all reality inflation and population growth far exceeded the amount of gold available for it to be widely used so nations moved away from the gold standard and adopted their own currencies and financial regulatory systems – for better or worse. Yet with growing curiosity around digital currency in conjunction with the decline of traditional cash usage I offer my commentary at an increasingly relevant time.

Figs. 1. and 2.
blog post small

Governments are wrong to assume all or most forms of digital currency are associated with illicit activity. We all know there have been bad actors out there in the digital currency space, and we know that some platforms like Silk Road have been attractive to them. Yet we must not forget that most bad actors use normal currency more often, and more importantly, the form of the currency is not as important as what the actor does with it.

Since we are at the beginning of the digital currency revolution it scares big governments who use traditional currencies to govern and collect taxes, and in some countries like Venezuela, Rwanda, Iraq, and Libya, they commit war crimes, financial fraud, and they steal from their citizens under the auspice of a legitimate financial system. In these countries, could a new more secure digital currency inspire a government revolution showing more transparency in currency movement and tax records sustaining democracy, human rights, and economic growth? The point here is that governments have abused their power to collect taxes and regulate financial services since the beginning of time. Didn’t the United States fight the Revolutionary War to stop excessive and unjust taxation from the British, and prior to the formation of the United States (July 4, 1776) the Thirteen Colonies had their own contradictory currencies, used the Spanish dollar, and counterfeiting was widespread by government and non-government people alike. Indeed governments should discourage immoral activity via legislation but not innovation in payment methodologies because lots of good can come from these new technologies. We as a world must think harder, longer, and we must inspire debate among global leaders for a better currency form in the future as paper cash is too darn simple and will soon grow more insecure due to better printer technologies observing the endless capabilities of the 3d printer.

Figs. 3. and 4.
Bit Coin Apple Pay
Conservative Wells Fargo led the industry in a surprise joint effort with Apple for the iPhone Apple Pay application in Oct. of 2014, setting a new standard with a mobile digital currency that has great security. Wells Fargo’s move to Apple Pay is a step closer to a digital currency and it is gaining traction and according to Forbes.com 10 major banks have now signed up for it (http://www.forbes.com/sites/roberthof/2014/12/16/apple-pay-gets-more-bank-support-but-it-still-needs-a-lot-more-stores-to-succeed/). Yet like most new technologies it takes time for others to upgrade to it, and in this case that means retailers need new software and terminal equipment that will accept the mobile payment platform. Although this takes time and money, every new technology does, and over time I believe it will save retailers money and time. Imagine a busy retailer two years from now who has no ability to take mobile payments during a busy holiday rush, they will have to staff more people, suffer more human error via cash transactions and manually entered credit card transactions, risk employee theft of unmasked credit card numbers, and customers will leave feed up with how long it takes to be serviced. Conversely, imagine a busy retailer two years from now who has the ability to take mobile payments, they will staff less people, customers can check themselves out and the risk of human error is reduced while security has the potential to be better. Moreover, in a hyper competitive retail market this can bring prices down and service levels up to the benefit of the customer, the community, and the technology sector. This is where innovation is born and some Subway franchise owners have taken the lead as of Nov. 2013 (http://www.cnbc.com/id/101211284). Economic policy makers must not hide from this better future and should take note from the private sector.

Fig. 5. Subway entrepreneur using Bitcoin:

It is likely less costly to make and secure digital currency than it is to make and secure cash and coins. Every time the U.S. Mint releases a new version of its bigger bills it takes years to develop, billions to make, billions to secure, they have to burn and shred billions of old bills, and a credible 2013 Market Watch Report backs this up by saying, “the new hundred dollar bill costs 60% more to make than the prior version” (http://www.marketwatch.com/story/new-100-bill-costs-60-more-to-produce-2013-10-08). With this type of growth rate how can these costs be sustainable especially as the population grows and paper resources become sparser?

Fig. 6.
New 100 Bill

Conversely, we know that technology costs go down or stay even when balanced for inflation over time. We also know that RAM memory, CPU speed, CPU size, fiber optic cable connectivity, and data encryption have made exponential leaps in the last five years thus making the environment for digital currency ripe. After all, many governments including the U.S. claim to have cloud, server, metadata, and predictive analytic technologies that manage to monitor and track all the internet transactions in most of the world, and the private sector would agree with this. If technology is this good why then can’t we have digital currency?

The answer is that change takes time and government bureaucrats have insulated themselves with yes lobbyists who support the current status quo. Supporting the current status quo is big business after all there are secured vehicle companies, printing companies, risk management companies, and many other companies that make money off the current financial regulatory system; lots of jobs and money are at risk if the current model would change. A good example of this is what happened to the film based camera company Kodak when it failed to respond to digital, but with digital currency its worse because we are dealing with big government and elected leaders who are at best imperfect though at times well intentioned. Yes there are some true leaders out there like Congressman Steve Stockman (R-TX 36th District) who took Bitcoin donations on his campaign and introduced the Virtual Currency Tax Reform Act (http://www.forbes.com/sites/perianneboring/2014/04/08/breaking-rep-stockman-to-introduce-first-bitcoin-bill/) to get the dialogue on Capitol Hill started but the bill has not yet passed and more work and research needs to be done. We as business/tech people need to be a loud part of this research and discussion and then more elected leaders will support it.

Lastly, digital currency moves the world closer to a one world currency where foreign exchange risk is significantly reduced or eliminated. Thus tariffs and geopolitical economic sanctions will be easier to see, prevent, and private sector companies that do a lot of international trade can benefit from that. Are there too many currencies throughout the world and would one global currency be better? Well it would be better in that there would be fewer economic highs and fewer economic lows but it would be worse in that highly valued companies and individuals would be greatly devalued in the developed world and some in the U.S. would argue that violates the free market principles of the constitution and discourages private sector competition. Moreover, a one world currency would be impracticable to support and would violate state sovereignty across the world yet that didn’t stop China from advocating for it in 2009 and subsequent years according to this credible source (http://usa.chinadaily.com.cn/world/2014-01/29/content_17264069.htm).

In sum, I don’t think a one world currency is the answer as I do think it would violate free market principles. Yet I do think a leading digital currency is needed when it can have transparent transfer rates, a secure audit trail, and can enable some cross-border economic development to balance out the third world so they don’t have to go to loan sharks for their crop loans. Cheers to our digital future!

If you want to hire me to speak at your next event or consult for your company on these and related topics concerning financial services risk, process improvement, project management, and related areas please contact me.

Lessons Learned From The Target Data Breach: Part 1

In the holiday shopping rush of December 2013 Target (TGT), the 1,778 store middle market retailer, had one of the biggest data breaches in American business history.  The breach apparently affected more than 70-100 million customers over 40 million cards (varying estimates exist) across all U.S. stores but excluded Target.com and stores in Canada.
target date leakThe general consensus is that a HVAC contractor for Target, Fazio Mechanical Services, who had access to Target’s networks got their own networks hacked via an e-mail phishing attack, normally an elementary attack method; yet that attack installed malware that then got onto Target’s network and installed more malware that copied personal data from Target’s payment processing terminals when it was in the “working memory area” or “cache” of the software/system – that is before it gets encrypted to be sent to the bank to be authorized.  This is part of the reason why it was not detected so fast and yes these hackers were smart.

Yet Target also did a bad job separating their networks and servers while they were trying to save money by having less networks and broader access for those who needed them.  Yet I don’t see why an HVAC contractor would need to be so close to the networks that work the registers.  This is simply poor design.  I am sure the HVAC company could have done their job without access to the Target network.  Let’s not hope they just wanted to upload HVAC reports and browse the network.

According to a recent Business Week article, “Target had a team of security specialists in Bangalore to monitor its computers around the clock.  If Bangalore noticed anything suspicious, Target’s security operations center in Minneapolis would be notified.  On Saturday, Nov. 30, the hackers had set their traps and had just one thing to do before starting the attack: plan the data’s escape route.  As they uploaded exfiltration malware to move the stolen credit card numbers—first to staging points spread around the U.S. to cover their tracks, then into their computers in Russia—FireEye spotted them. Bangalore got an alert and flagged the security team in Minneapolis.” (http://www.businessweek.com/articles/2014-03-13/target-missed-alarms-in-epic-hack-of-credit-card-data)
target date leak2Yet Target did not take this alert seriously but why?  Fear of change, ego, poor leadership, and too much bureaucracy got in the way of the costly software’s effectiveness.  At the time of the breach FireEye was a new software tool for Target’s technology group and what I know about new technology is that people delay embracing and learning new systems of out of fear that those systems will be buggy or not as good as the old ones.  I understand this very well having worked part time in the P.C. dept. at Best Buy for more than 3.7 years representing Intel and related software makers Microsoft, Symantec, Trend Micro, and Adobe.  When Windows 8 came out all kinds of people were doubting it not because it was bad but because it was more work to get to know, and if they saw something really different about it, they were inclined to think it was a bug when in fact it was a useful design feature they didn’t yet understand.  The same bias can be applied to Apple computers.  People falsely think that they are immune from viruses because Apple designs them that way.  What a joke.  Apple computers are only as secure as their understanding of the latest virus.  Yes it is true the Apple operating system is not targeted as much for viruses but it is also not used as much and it is hardly used by large companies and governments.

Moving on, the CIO really needs to get behind any major software change like this, and if Target’s former CIO Beth Jacob was really behind FireEye she probably would have done something about the alerts they were giving her.  You would think as CIO she would want to immediately act and reduce any risk.  What was she doing at the time, giving some speech about how she was such a great leader in the industry while some high buck corporate partner pays for her three-course lunch?  Clearly, her eye was not on the ball or even on Target (no pun intended), and she had a big enough ego to think she was smart enough and had put the right people on her team to take care of this.  Yet what an epic fail.  It is also likely that there were people some layers below Jacob that tried to inform others to the alert but I am sure their voice of concern and reason got squashed by Jacob’s massive ego, after all you can’t doubt a CIO – right?  I highly doubt everyone in Target’s IT security team was going to ignore these alerts but it is too many layers of bureaucracy that got in the way of Target’s safety.  Target is better off with a more open style of bureaucracy where concerns can be heard at all levels and tools and processes are shared for innovative solutioning – Google’s culture is a good example of this.

Target has also grossly underestimated the costs associated with the data breach to keep their stock price up but of course they would never say it like that, however I am not alone in thinking Target’s $147 million figure is too low.  According to one analyst, “costs would rise even more over time. “I don’t see how they’re getting out of this for under a billion, over time,” he said, adding, “$150 million in a quarter seems almost like a bargain.” (http://www.nytimes.com/2014/08/06/business/target-puts-data-breach-costs-at-148-million.html?_r=0)

Those who have the stolen data are likely outside of the U.S. and when and if they use the data to commit fraud the ability of a U.S. corporation or court to go after them is diminished, timely, and costly.  Moreover, since the U.S is the midst of negative geo-politics with parts of Europe, particularly Russia where some sources have traced the hack, those who have the data are likely to be bold in how they use it and that’s where the cost to Target will add up.  The other areas where the costs will grow is in Target’s own internal policy and procedure changes as well as the growth of their IT security staff and tools, but most importantly their investment in training must grow.  At present Target has over more than 90 lawsuits against them regarding the breach and that number is likely to grow so the costs here are going to be huge overall.

Lastly, I am not all negative on the Twin Cities’ favorite corporate hometown hero as I shop at Target often, have the REDCard, have been to their diversity events, and I have also seen a lot of concerts and sporting events at both Target Field and the Target Center.  However, the mere fact that Target has the money and lobbying power to get their name in the community does not mean they are a true leader in the community.  As the data security community increases consumer awareness retailers like Target will continue to be challenged to innovate and that’s better for all people.

By Jeremy Swenson

Former FDIC Chair Shelia Bair Comments On Bank Bailouts, Peer-To-Peer Lending, And Tax Reform

On Tues, 04/08/14, former FDIC Chairperson Shelia Bair visited Minneapolis and offered commentary on the financial services industry, peer-to-peer lending, systemic risk, and the recent recession.  Bair is educated as an attorney and was Assistant Secretary for Financial Institutions at the Treasury Dept. and a professor at the University of Massachusetts Amherst before she moved over to Chair the FDIC from 2006 to 2011.  At the FDIC Bair helped the nation’s financial system out of an exacerbated recession and unprecedented bank run from 2007 to 2010 but not without ruffling a few feathers.

Addressing a sold out crowd including former Congressman Tim Penny and other elected officials, business people, students, and ethically minded community members, Bair had the honor of being the keynote speaker at Saint Mary’s University of MN’s publically broadcasted Hendrickson Forum on Ethical Leadership.  Bair opened her keynote by describing how unimpressed she was that when she arrived at the FDIC in 2006 the organization had little to no info on sub-prime lending and had to buy a database to conduct research on it.  This was in part due to the fact that sub-prime lenders were private and not a part of deposit institutions and thus slightly out of scope for the FDIC at that time.  Bair did not inherit a perfect FDIC, and it can be inferred that the FDIC should have been paying attention to sub-prime lending far sooner as it was directly related to many elements that affect deposit institutions including real estate, entrepreneurship, income and tax, and community redevelopment.

Image

Bair now free from the constraints of holding a Washington office spoke openly about how she felt hindered to speak to the human element of the financial crisis while at the FDIC.  She indicated that although she was a part of the team that brokered the historic bank bailouts (2008-2009), that she has some serious reservations about that, because it was “too generous and uneven” and “helped the banks far more than it helped homeowners and families”.  She also described regular disagreement with then Treasury Secretary Timothy Geithner and suggested he was too close to many of the bank executives who benefited from the bank bailouts.

She further described miscommunication and lack of collaboration as Geithner worked around her efforts at the FDIC, and the undertone of this was political disagreement over which agency should lead the recession resolution in terms of the banking industry.

At present, Bair supports the Dodd-Frank Act because it favors bankruptcy and a three-year claw back for executives over a bailout in the event of a bank failure.  Although Bair in the past has said she disagreed with Janet Yellen’s support to repeal the Glass-Steagall Act, she presently indicated she still supports the new Fed Chair and viewed her as a reliable Washington outsider.

Image

When I directly questioned Bair on the growth of peer-to-peer lending she seemed cautious about its long-term viability citing an unknown regulatory landscape and even recounted that peer-to-peer lender Prosper lost many investors during the worst months of the recession.  In discussion with Bair I observed that she, like many banks, is in a wait and see mode with peer-to peer-lending, but she did indicate that for customers consolidating higher interest rate debt it can be a good thing and that could in turn force banks to be more customer centric with better terms.

Yet I am more optimistic on peer-to-peer lending than Bair in partnership with many respected peer-to-peer investors including Google who invested $125 million in Lending Club and the former CEO of Citi Group, Vikram Pandit.  It is really telling when the former Citigroup CEO goes against his own industry in favor of a tech-heavy new lending model, but he is right because most customers no longer need the big bank branches and elaborate services that are fee heavy.  Moreover, peer-to-peer lenders offer attractive rates, diverse portfolio options, and low operational costs and that keeps investors and borrowers happy.  Just like online news slaughtered traditional print media, as soon as peer-to-peer lending gets more regulatory backing it will slaughter traditional fee-heavy banks if they don’t adapt to this new environment.

When commenting on federal sequestration Bair showed frustration and disagreement over the automatic spending cut approach and instead suggested that tax rates be reduced and restructured in a number of areas to encourage more employment, keep businesses in the U.S., and encourage business innovation which would in turn provide more income and employment thus bringing in a greater amount of taxable income to offset her proposed tax reduction.  This truly can be a helpful aspect of the budget deficit issue in that taxes in the U.S. are far too high and there are some needless loopholes that harm many and help few.  The 2.3% Medical Device Tax is an example of this as it encourages the many medical device companies in MN to move their operations outside the U.S. due to the high tax cost, and it adds to their cost of doing business thus reducing their ability to get favorable loans.

Lastly, as an advocate for consumer protection and creative thinking I asked Bair if she had any insight on what the massive Target data breach might mean for the banking and related industries — where an estimated 10-15% of the 40 million affected cards have encountered some type of fraud — and she reminded me that the banks are taking the losses before the retailer does.  Although she offered no specifics other than suggesting that debit cards are more relevant, she shared my concern that data security is a growing factor in financial regulation yet I was then reminded that Bair is more of a politician and economist than a technologist.  Yet from an economic policy standpoint if the nation encounters more data breaches like this it could drive the cost of goods up thus forcing more costly and secure card payment products perhaps with biometrics on them.

Photos by Rick Busch.

Written by Jeremy Swenson (c)