Privacy & Security Sing-a-long: Monster Hospital

(Medical privacy sing-a-long with Metric)

Monster hospital, can you please release me?
You hold my hands down, I've been bad.
You hold my arms down, I've been bad.
I've been bad, I've been bad.
I fought the war but the war won't stop for the love of god.
I fought the war but the war won

(Watch the video)

Impacted Molars: Misguided Ninja Dudes and PCI Awareness

MESIAL
Dark Reading continues its obsession with physical security:
Network dude rassels potential bad guy, followed by a stern warning on what a scary world it is out there, cause physical attacks hurt.
Forgive me if I'm out of line, but why would I hire a network security guy to dress up as a maintenance dude to steal a laptop out from under an executive? Especially since there are skilled investigators who could get a signed confession and all his passwords from just talking to the accused. I wouldn't going to hire an investigator to secure my network, and I shouldn't ask a network security guy to conduct fraud investigations. I'm not going to hire the network guy to run my HR department either.

LINGUAL
The Bank Lawyer celebrates PCI Awareness Month early, with his take on the TJX Incident. Nice run down of all the parties involved. His characterization of the consumer is incomplete:

The consumers' concern for nuance extends only to the following extent: "I see a sturdy live oak right over yonder. Let's get us a rope and hang him."

The consumer is likely to be distracted by a shiny object on the way to the noose dealership, since he or she has no loss. Credit card numbers are becoming more a disposable commodity, unlike SSNs, HDL levels or Sudafed consumption. Coming this summer: Retailers v. Credit Cards v. Banks Smackdown at the Legislative Arenadome.

Photo from Henrier.

Everyday Privacy and Security: The Drug Store

After a conversation with a friend, I thought I'd cite some examples of how privacy and security impact day-to-day life. Here's the first in the series; though I admit, dissecting the CMEA would take more effort than I have time to fully understand. My ear is still ringing and Battlestar is on in 20 minutes.

The scenario:
Last week I went to see the doctor about my tendinitis and a persistent ringing in my right ear. I rarely go to the doctor, so you must take my word that these were annoying, persistent and painful condititions, resulting in grouchiness, restlessness, nonsensicalitude and Irritable Spouse Syndrome (ISS). I was processed through the HMO machine like a burger at Jack in the Box, with a shot of cortisone in my arm and an Rx for some OTC pseudo-ephedrine.

At Walgreens, I scan the aisles for Sudafed, a rare purchase since I'm not normally an allergy sufferer. I pick up a card for the store-branded Wal-Phed and head over to the pharmacy. The pharmacist asked for my drivers license. I show it to her, figuring it was an age requirement. She asks me to take it out of my wallet. I hand it to her, and she types my information into the cash register. She asks me to sign what looks like a receipt. What for? I'm paying cash. It's the law. It's for the Wal-Phed. So I pay her the $3.50 or so, grab the receipt, my license and leave.

What Just Happened Here:
An ingredient in the Wal-Phed is used to manufacture bathtub methamphetamines (speed/crank). To stem this scourge, the Combat Methamphetamine Epidemic Act (CMEA: part of the USA PATRIOT Act Reauthorization of 2005) placed additional controls on retail sale of ephedrine, pseudoephedrine, and phenylpropanolamine.
Consumers have to show ID and be tracked by retailers so they get just enough to take care of their stuffy nose, but not enough to start up a meth lab. The retailers have to protect the privacy of their congested customers according to the law, thusly:

C) PRIVACY PROTECTIONS.—In order to protect the privacy of individuals who purchase scheduled listed chemical products, the Attorney General shall by regulation establish restrictions on disclosure of information in logbooks under subparagraph (A)(iii). Such regulations shall— ‘‘(i) provide for the disclosure of the information as appropriate to the Attorney General and to State and local law enforcement agencies; and ‘‘(ii) prohibit accessing, using, or sharing information in the logbooks for any purpose other than to ensure compliance with this title or to facilitate a product recall to protect public health and safety.

The Data the Walgreens Now Has On Me:
Well, my name and my Texas Drivers License information (DOB, address, glasses wearer, motorcycle rider). According to the DEA website, I could also show my passport, or, if I were under 18, my report card. They also know that I bought Wal-Phed and paid cash.


What About the Data Now?
Good question. The CMEA states that the retailer has to keep it for 2 years. There is also a raft of conflicting state laws, some requiring the logbooks to be kept electronically. The retailers' association raises concerns regarding HIPAA, tracking consumer behavior (e.g., can Walgreens send me a coupon for Wal-Phed now?) and real-time tracking versus logbook maintenance. Ever since it went behind the counter, pseudoephedrine sales have decreased, so does it really matter anymore?

Everyday Privacy For Me?
Walgreens knows I ride a motorcycle because my ear rings.
This data for a cash transaction will be maintained for two years.
It may or may not be subject to any privacy rules, depending on when/if the DEA writes the regulation.
I may have no recourse if Walgreens decides to use the information in a way to which I haven't consented.
I may have no recourse if Walgreens loses, misplaces, or sells the information to unsavory third parties.

Infosecalypse Now

A number of links in the chain:
Mr. Walsh asks Why We Fight?
Which spurs Mr. Hoffman's Nam flashback.
Bloginfosec says it's safe to surf this beach, so its safe to surf this beach.
Meanwhile, Charlie squats in the bush, everyday getting stronger, and the BS piles up so fast, you need wings to stay above it.

Me? I'm an errand boy sent by grocery clerks to collect the bill.

With The AM Radio On

The imperial raftload of opinions on who really is the victim of credit card fraud, stemming from the Boston Globe article on the legislative reactions to the Stop and Shop Skimming Shenanigans, is centered around this quote as much as any:

"If this legislation passes, all retailers, all companies, and all
banks will know they'll be responsible for absorbing every cost
associated with a data breach."

Of course that quote doesn't make a whole lot of sense once you parse it, it just seems to be pluralizing the victims in a bizarre twist on bystanderism, i.e., if were just going to sit around and watch the crime happen, let's all be victims!

Most puzzling to me are the voices of the outraged merchants on the Slashdot thread, sounding too much like a hoodlum's fence pleading ignorance to the cops on the legal state of goods in his possession. The merchants are no doubt getting the shaft in the current credit card fraud scheme. They may not have the financial resources and high powered lobby as the banks and credit card outfits, but the merchants do have the capacity to do more to validate a transaction that to make sure the magnetic strip is functional. Are credit card transactions getting to the point were they need to be validated as vigorously as a personal check. Remember those?

I see a business opportunity here. Heck, I'm in love with the modern world and I'll be out all night.

No Ethics, No Guild, No Credibility

An article in the hometown press on our great state's efforts to protect its citizens from crooked locksmiths and security guards with misdemeanors.

Like many state licensing agencies, such as those watching over doctors, electricians and architects, the Private Security Bureau checks the criminal backgrounds of applicants. But unlike virtually every other such agency, the bureau doesn't then evaluate whether applicants' past behavior has any relevance to their current work, how long ago the crime occurred or whether they have tried to rehabilitate themselves. Instead, applicants with a record sullied by most crimes above a traffic ticket are automatically rejected.

The result: Locksmiths and other professions regulated by the Private Security Bureau must have cleaner legal backgrounds than child care workers.

I also thought about the numerous unlicensed, unmonitored quasi-professionals that serve the security of consumers, businesses and government in the electronic rather than physical realm. Configuring a server, or setting up a home PC may grant access as lucrative as whatever a locksmith or security guard may obtain. Who configured the server for the accounting firm who does your taxes? Is the guy from Geek Squad who just serviced your computer a part-time carder? (I tried to see if there are any ethical or background requirements to become a member of the Geek Squad, but my mind boggled at their Ranks and Titles page. It's the Masons meets Homeland Security. I'd wager their pee is clear of non-approved substances, though.)

I'm not calling on the State of Texas to regulate this issue, but ethics and compliance with ethics doesn't seem a priority for the ISC2 and the CISSP designation, a point made eloquently elsewhere. I have more thoughts on how the CISSP could be salvaged, but I'll make them later.

photo by Monceau

Too important to be left to the generals

Interesting discussion on the secret language of security.

Which shovetails nicely into a panel discussion I saw yesterday. An assortment of CSOs and a Forrester analyst discussed the future of security. Essentially all the tech stuff is being outsourced, and the head of security is being molded into a Risk Officer. I can infer from this that the tech stuff (firewalls, antivirus, and the three letter acronyms) can scale. But the risk cannot. Risk is corporation's own, to be honed, polished and cherished like a treasured logo that no can quite figure out what it means. Risk is the new black, a point made elsewhere, and with more vigor.

One of the CSOs also mentioned that privacy will be shoved aside as a compliance thing, over with the lawyers. I stifled my desire to spring up and shout "HERESY!" for fear that it would awake my CEU seeking comrades from their deep and well deserved slumber.