sábado, 30 de agosto de 2008

ATTACKS CONTINUE ON RETAILS STORES

Criminals exploit wireless vulnerabilities, social engineering to collect large volumes of customer data

By Tim WilsonSite Editor, Dark Reading

Attacks on local retail establishments continue to net criminals large volumes of personal data, despite the recent arrest and indictment of a large group of criminals using the same attack vector.
Authorities late last week acknowledged that a ring of cyber-thieves has stolen tens of thousands of credit card numbers from Louisiana and Mississippi restaurants this year. One bank alone says it has lost more than $1 million as a result of the attacks, according to
news reports about the identity thefts.
And across the pond in Ireland, data thieves masquerading as bank technicians have fooled store owners into giving them access to credit card terminals and managed to download the details of over 20,000 credit and debit cards, according to an
Irish news outlet.
The attacks come on the heels of a huge arrest and indictment made two weeks ago, when 11 perpetrators allegedly involved in the hacking of nine major U.S. retailers, and the theft and sale of more than 40 million credit and debit card numbers were charged with engineering the largest hacking and identity theft conspiracy ever prosecuted in the U.S. (See
Feds Arrest Hackers of TJX, Other Retailers in Huge Conspiracy Bust.)
That case linked several high-profile data breaches of the last two years -- including TJX Companies, BJ's Wholesale Club, Barnes & Noble, and Dave & Buster's -- to a single group of conspirators. But apparently, it didn't break all of the rings of thieves who might use vulnerabilities in local retail wireless systems to crack credit card information.
The U.S. restaurants began reporting the thefts beginning in March in Baton Rouge, La. followed by similar cases in Flowood, Lafayette, Lake Charles, and West Monroe, Miss. The hackers stole credit and debit card numbers from 16 restaurants' computer systems, then sought to sell them for anywhere between $1 and $100 each, according to special agent Sean Connor of the U.S. Secret Service.
Law enforcement agencies in Louisiana and Mississippi did not give details on the methods used by the criminals, but they did say they believe that the thefts are connected and multiple thieves are likely working together. Experts speculate that the attackers are using a technique similar to the one used at TJX, in which criminals "eavesdrop" on in-store wireless systems and gain access to the database of customer and credit card data.
In Ireland, attackers are taking advantage of weaknesses in in-store security as well, but using a more brazen attack. The Irish Payment Services Organisation has warned that individuals pretending to be from Irish banks convinced shop owners that they were carrying out maintenance on point-of-sale systems on behalf of the banks. This enabled them to plug in wireless devices that pushed the data to the Internet, where the card numbers could be used overseas.
The scam has forced Irish banks to restrict cash withdrawals to about $200 a day for cardholders traveling outside the country. Law enforcement officials say they have retrieved closed-circuit TV footage of the gang in action.
The new attacks show that despite the blockbuster arrest, retail establishments are still being raided for large volumes of personal data. The PCI Standards Security Council issued further revisions to retail standards for handling credit card data earlier today. (See
PCI SSC Announces Changes to PCI DSS Specs.)

domingo, 17 de agosto de 2008

ANALISIS DE VIDEO: ENTRE LA EVIDENCIA E LA PRECISION

por Frans Kemper

Hay mucho qué decir acerca de las nuevas tecnologías y tendencias en CCTV. El mercado se está moviendo a una velocidad evidentemente rápida y difícil de mantener. Obviamente, la entrada de la trasmisión IP cambió el panorama de la industria y continuará haciéndolo por algún tiempo.
El CCTV es frecuentemente el sistema de seguridad dominante debido al hecho de que es el único utilizado proactivamente por los operadores. Los otros son reactivos por naturaleza, generalmente sin requerir acción del operador hasta que algo ocurre. Pero en realidad ¿qué puede un operador hacer?
Es normal esperar que un operador monitoree todas las cámaras en un turno de 8 a 12 horas. Pero ASIS International estableció que un ser humano puede observar eficazmente de 9 a 12 cámaras por cerca de 15 minutos.
Es claramente imposible para un oficial de seguridad mantener una supervisión efectiva del ambiente desplegado en los monitores sin la asistencia de tecnología para filtrar información que no es de interés.
Datos con valor
Una cosa es tener más y más datos de video disponibles pero otra muy diferente optimizarlos para proporcionar el mejor nivel de seguridad. Después de todo, la mayoría de secuencias de video serán solo un mundo de datos guardados sin ninguna consecuencia.
Aquí es donde el análisis de video entra en juego. No hace mucho tiempo el análisis de video era solo visto en lugares de mucha seguridad como instalaciones de defensa y aeropuertos.
Recientemente la tecnología ha entrado en el curso dominante y en algunos lugares sorprendentes también.Las soluciones de análisis de video más comunes hoy son los sistemas de Lectura Automática de Números de Placa, con muchas instalaciones alrededor del mundo. Son usadas en aplicaciones de control de acceso, peajes en autopistas y control de velocidad, adicionalmente a las aplicaciones de justicia criminalística y policial.
Otras aplicaciones para el análisis de video en el mercado de sistemas de tráfico inteligente incluyen encuestas de tráfico, verificación de problemas en túneles y control de vehículos que paran a un lado del camino.
Más allá del uso comercial
La administración de dos edificios de apartamentos residenciales en Japón llevó este sistema a una etapa superior al implementar una solución de video inteligente para reducir el crimen.
En una novedosa aplicación del análisis de video, las imágenes de personas sospechosas son proyectadas en una pantalla grande en las paredes externas de los edificios, a la vista púbica de la gente en las calles.
Utilizando aplicaciones con capacidades de rastreo automático y autónomo Pan Tilt Zoom, el sistema proporciona un rastreo auto dirigido guiado por visión para mantener el objetivo en movimiento en foco permanente, ofreciendo numerosas posibilidades de identificación y recolección de información.
La solución controlada remotamente ha reducido sustancialmente los costos para el complejo residencial eliminando la necesidad de tener oficiales de seguridad todo el tiempo monitoreando constantemente las imágenes de video.
Desde que el proyecto fue implementado, ningún crimen ha sido reportado. En otro ejemplo, una granja chilena de salmones aplicó satisfactoriamente el análisis de video inteligente para combatir el robo de salmón y de los huevos de salmón.
La primera generación de soluciones de análisis de video analizaba la video vigilancia en tiempo real, identificando potenciales amenazas a la seguridad mientras se desarrollaban, permitiendo responder inmediatamente y previniendo fallas serias en la seguridad. Y como el análisis de video está basado en tecnología digital, la video vigilancia migró del mundo análogo del CCTV al ambiente digital en red basado en IP.
Necesidades satisfechas
Actualmente, el análisis de video está yendo más allá de la seguridad hacia el mundo de la inteligencia de negocios, produciendo cantidades sin precedentes de información valiosa.
Los usuarios que buscan sistemas de seguridad de análisis de video descubrieron rápidamente que estos sistemas también pueden proporcionar inteligencia de video relacionada con procesos de negocios, de la misma manera eficiente y precisa.
Y al hacerlo, han entregado sistemas que efectivamente sirven un doble propósito al poder también monitorear procesos de negocios. (Para mayor referencia lea la primera edición de Zona de Seguridad:
http://www.alas-la.org/zonadeseguridad/_Edicion01/tendencias
Entender las necesidades específicas en seguridad es fundamental (como siempre) para determinar cuál es el paquete de análisis de video adecuado para una organización y buscar el sistema que mejor responda a sus necesidades.
El análisis de video cubre un amplio territorio: seguridad perimetral, detección de intrusión, vandalismo y grafitis, seguridad personal, seguridad de edificios, detección de objetos movidos o robados, detección de equipaje o paquetes sin atender, vehículos en la vía, vehículos que siguen otros muy de cerca, la dinámica de las multitudes, etc. Y la lista sigue creciendo.
Pero también hay que estar consientes de que mientras los sistemas actuales de análisis de video son de lejos mucho más precisos que sus predecesores, esta precisión demanda un escrutinio detallado.
Cada proveedor de análisis de video le dirá que su sistema “tiene la más alta precisión en la industria, con una tasa de precisión de más del 95% en probabilidad de detección (POD) y unas tasas extremadamente bajas de falsas alarmas”.
¿Le suena familiar? La pregunta aquí es bajo qué condiciones fueron tomadas esas medidas y si fue en un ambiente cerrado, con iluminación controlada y sin influencia del clima. ¿O si fue en exteriores durante un amanecer o en un día lluvioso o soleado?Suena como el uso de gasolina en un folleto, el cual yo personalmente nunca soy capaz de alcanzar.

terça-feira, 12 de agosto de 2008

THE NOT-SO-BEAUTIFUL GAME

By Brian Sims
Security Management Today’s Editor Brian Sims tackles the pressing issues of the day. This time around, the focus is on the policing and Government regulation of Premier League football grounds and stewarding and, once again, knife crime…
With the Barclays Premier League season’s big kick-off just days away now, the Association of Chief Police Officers has delivered a judicious boot of its own, calling on the 20 clubs involved to pay all the costs of policing games.
At the moment, Manchester United, Tottenham Hotspur, Arsenal and West Ham United et al only have to render the costs incurred for policing inside their grounds on matchdays (or on adjacent land that’s their property by law). Any other policing costs are left to be funded from police budgets. That’ll be the same police budgets already stretched to breaking point, one presumes. In real terms, this means local communities are subsidising the clubs.
Assistant chief constable Stephen Thomas of the British Transport Police serves as the ACPO ‘lead’ on policing football. Thomas states: “The funds we receive to police our various jurisdictional areas across the country are provided by Government and local residents through their Council Tax. If we have to take officers away from community policing to look after football, we are not able to recover the costs of doing so. That means our normal policing budget is being used for that purpose. In turn, we then have to provide a lesser service to the rest of the community.”
A Freedom of Information Act request submitted by the BBC’s Radio 5 Live to the police service has shown that the amounts paid for policing by Premier League clubs vary. Owned by the controversial billionaire Roman Abramovich, Chelsea allegedly pay less than half of the cost of policing their matches at Stamford Bridge. The same applies to West Ham United. Bear in mind that these are two clubs with pockets of ‘fans’ who have enjoyed a less-than-savoury reputation for decent behaviour towards opposing teams' supporters.
To my great surprise [says Editor with tongue firmly lodged in cheek], it emerges that the Premier League is less than happy with Thomas' comments. They say that the clubs already contribute £700 million to HM Treasury every year by way of taxation. “And don’t forget the tax taken from the 13 million fans who attend Premiership matches during the course of a season,” retorts Dan Johnson, head of communications at the Premier League.
Take, take, take
Excuse me? If anyone is ‘taking’ from the fans it’s the clubs, Mr Johnson. They charge extortionate amounts of money for tickets and merchandise to the extent that they’ve all but priced out the average family and working man from ‘paying homage’ more than once or twice a season. The cost of food and drink at the concession stands is disgustingly high, with the quality of what’s on offer often little better than pigswill.
The clubs have no option but to charge so much money for everything ‘on site’ for one simple reason. They pay ludicrously high wages to players who, frankly, I wouldn’t cross the road to watch because they are, at best, average. Suffice to say that if, on a regular basis, you or I performed in our own professions as badly as they do on so many Saturday afternoons we wouldn’t last five minutes. In the cosseted, surreal world of the Barclays Premier League, though, you can be jailed for beating people up, go out on regular drinking benders, smoke like a chimney, treat women with total disrespect and still be welcomed by your club with open arms.
What a great advert for the once-coveted societal values of decency, respect and morals.
Mr Johnson continues: “They [the clubs] have invested heavily in all-seater stadiums, CCTV and stewarding.” So they damn well should. If they’re going to fleece us, the least we should be able to expect is that they protect us all while they’re doing so.
“As a result, the numbers of police required to ensure public safety, and therefore the cost, has reduced over the past 15 years,” concludes Johnson. “We are always happy to discuss how it might be possible to further reduce costs, or indeed how football could help the police tackle youth crime, but we fail to see why fans should pay twice for policing.”
Well I fail to see why I should have to pay 50 quid to watch a match live, Mr Johnson, or fork out £60 for a new shirt every season when they’re manufactured in some Far Eastern sweat shop for around a tenner just to serve as billboards for ‘they who must be obeyed’ (ie the club sponsor). In fact, I’m no longer going to as, after 18 years, I’ve decided to give up my Season Ticket at Upton Park.
What we are talking about is a monopoly situation of the worst kind. The club bosses know it, and they prey on it.
I also fail to see why footballers should be paid more in a week than some people earn in years. It’s a disgrace. If the clubs can afford to do that then they can damn well afford to pay for whatever policing it takes to maintain law and order in and around their stadiums. As far as I’m concerned, they should do so out of a Duty of Care to the paying public (who keep them alive) and the local citizens who live nearby.
Politicians may have the casting vote
The bloated Premier League has become far too big for its own boots, and needs taking down a peg or two. In combination with Sky TV, this organisation has created havoc for police forces and fans alike, continually switching matches to suit armchair supporters rather than the genuine followers of the game who still wish to attend despite the horrendous price of doing so.
ACPO has now informed the Home Office that it would like to see a change in the law to allow it to charge clubs and other money-making events for the full costs of policing their events. Indeed, that very proposal has been included in its submission to the Government’s Green Paper on the future of policing.
Unfortunately, this means that the politicians may end up playing arbiter over the wishes of the Premier League and those of the police. No prizes for guessing who’ll end up with the wooden spoon in that particular contest.
...and what about the licensing situation?
Another hugely important issue that seems to have been buried with time is the football authorities’ continuing exemption from Security Industry Authority licensing for in-house stewards.
“They can damn well afford to pay for whatever policing it takes to maintain law and order in and around their stadiums”
You’ll recall that, back in August 2006, ministers announced all in-house stewards at sports grounds with a safety certificate were to be removed from the remit of the Act (achievable by using the Violent Crime Reduction Bill to amend the 2001 Act).
Section 63 of the Violent Crime Reduction Act 2006, which came into effect on 8 November that year, amends Section 4 of the Private Security Industry Act 2001 (exemptions from licensing requirements) to exempt certain persons from the licensing requirement under that Act.
It exempts from the licensing requirement all in-house personnel – up to 3,000 individuals, or 25% of all club stewards – who carry out licensable conduct within the meaning of Section 3 of that Act on any part of their home ground, if it is a premises covered by a safety certificate under either the Safety of Sports Grounds Act 1975 or the Fire Safety and Safety of Places of Sport Act 1987 and if the conduct is carried out in connection with the use of those premises for which that safety certificate has effect.
It also exempts in-house staff who accompany their club to other sports grounds where both the home ground and the sports ground being visited are covered by a safety certificate under the safety at sports grounds legislation, and “where the conduct is carried out in connection with the use of the host premises for purposes for which its safety certificate has effect”.
This exemption includes those who supervise contracted staff.
What the football authorities say
The football authorities’ line is this... Spectator safety and stewarding at football grounds is already regulated by local authorities under the oversight of the Football Licensing Authority (FLA). As far as they’re concerned, it would be “a duplication of effort and a waste of resources” if football stewards were also required to be licensed by the
SIA.
As things stand, all stewards have to be trained and assessed to a recognised national standard. There are two qualifications accredited by the Qualifications and Curriculum Authority, namely the NVQ in Spectator Control and the Certificate in Event and Matchday Stewarding. These replace the former Football Stewarding Qualification. The football authorities, the safety officers and the FLA have developed a new module on conflict management, and are adamant this has raised the training to “a level equivalent, but not identical, to that demanded by the SIA”.
I don’t know about you, but whenever I see phrases like “equivalent to” being bandied about I immediately become cynical.
The football authorities will claim they’ve fought so long and hard for this exemption that they’re not likely to place it in jeopardy by failing to comply with the conditions upon which the exemption is granted. There is ongoing talk of “proactive oversight”. Responses to any failure in adherence will “depend upon the scale and nature of non-compliance”. In extreme cases, it remains the case that clubs could “have their ground capacities reduced, be served with a prohibition order or alternatively face legal action”.
Let’s see the enforcement
The FLA oversees the necessary certificates for grounds hosting designated football fixtures, while the relevant local authorities are expected to check stewards’ training records.
Fine, but where’s the evidence that enforcement is happening? There has been the promise of the FLA providing officials at the Home Office with detailed assessments of the “integrity and efficacy” of the exemption, but has this happened?
If so, with what kind of regularity, and why have the results not been made public? I haven’t seen any evidence, that’s for sure.
At the very least, the supporters who pay their hard-earned money to attend games should be privy to the findings, or don’t they count any more after they’ve coughed up for their Season Ticket four months before a ball is even kicked?
A degree of transparency is warranted. A little open book accounting. If the FLA’s equivalent arrangements for in-house stewards are genuinely on a par with the SIA’s licensing process then let’s have some evidence to support that assertion. The SIA is willingly publishing plenty of material in relation to its enforcement activities. The football authorities should be made to do likewise.
In any case, how on Earth can this situation be allowed to continue, with in-house supervisors not licensed by the SIA presiding over contracted stewards who have to be by law? For me, it just doesn’t stack up, and there surely must have been problematic instances where it hasn’t.
If a level playing field is genuinely desired in the wake of SIA licensing, whether that be in the football ‘industry’ or any other, then this ‘mixed economy’-style scenario isn’t the way to go about providing one.
Points of order
Every now and again, something you write hits a nerve. My last SMT Editor’s View seems to have done just that.
“Retailers proven ‘guilty’ will have to be closed down for good. No slap on the wrist or measly fine this time, but closure...”
The whole knife crime debate is really beginning to take off. Steve Collins from PS5 and The Security Institute’s chairman Bill Wyllie are both in Dubai on business at the moment, but as soon as they return the three of us are meeting up to discuss how we progress our industry campaign to make the Government do something about the horrendous death and injury toll in this country as a result of edged weapons. Watch this space...
In the meantime, the discourse does indeed roll on. Travelling home from work last night I picked up the London Lite and on page 4 there was the headline... ‘Knife crime arrests are down 50%’. However, the first paragraph tells you all you need to (as indeed it should do). It reads: “The number of people charged with knife crime has fallen by half in London – despite a rise in teenage murders”. Apparently, Metropolitan Police figures – yes, those good old statistics again – show that in the 12 months to April this year, 1,361 people were taken to Court for possessing a blade.
Of 22 teenagers killed in the Capital so far this year, 17 were knife crime victims. A pretty big percentage, wouldn’t you say? In the year to April 2004, when 2,810 people were charged with offences, 12 teenagers ‘met their maker’.
In the first instance that’s 1,361 people too many carrying a knife with likely intent to harm, but there is an even bigger factor at play. If these figures are to be believed, it shows that when fewer people are charged with knife crime, the number of murders bursts through the roof. Even more reason for the Government to do something about it, I would suggest.
Yesterday, I was in Northampton for a meeting with the senior management team at Unipart Security Solutions. For three hours or more, I chatted with managing director Colin Moore and operations directors Andrew Hayes and Peter Wilkins. All are ex-policemen, and I wondered what they thought of the current knife crime trends?
They made an interesting point. The key to the whole thing is where the victims sit. When Moore, Hayes and Wilkins were in the force, the demographic of victims included people in their 20s and 30s. Now, it’s the teenagers who are involved. This is where the Government’s focus ought to be.
How about a ‘decoy’ or three?
In light of that belief, what of Labour’s latest plans? Well, security minister Vernon Coaker has duly unveiled a project to prevent the illegal sale of knives to anyone under 18. The Government is going to round up some 16 and 17-year-old ‘decoys’ and send them into shops across the country to attempt to buy blades.
What’s that going to do? The ‘decoy’ tactic has been used in relation to alcohol and cigarettes more times than I care to remember, but it hasn’t had much effect in stopping the binge drinking culture and the rising numbers of lung cancer victims.
For this ploy to work, retailers proven ‘guilty’ will have to be closed down for good. No slap on the wrist or measly fine this time, but closure. That is the only way to make a difference and send out a genuinely serious message to all concerned.
Here’s an analogy for you. The reason so many people abuse the drink-drive laws is that they know this legislation isn’t strong enough to really hurt them. Watch any of the ‘fly on the wall’ police programmes on TV and there’ll be people weaving all over the road who are not fit to be in charge of themselves let alone a motor vehicle. They’re taken to the station, a few points will be slapped on their licence – if the presiding Crown Prosecution Service official deems it necessary, that is – and they’ll have to pay a few quid in fines and/or costs. Not long after, it’s all forgotten and that individual can nip down the local again with the car.
What about the families of people disabled for life or murdered by the actions of drink drivers? Who is thinking about them? The lives of too many individuals have been ruined by drink drivers. They’ll not be lucky enough to have a second chance, so why should those who are the cause of their misery and sorrow?
Anyone who drinks and drives and is caught doing so should be banned for life. No argument. Call me Draconian, but that’s my opinion. There’s no excuse for drink driving. There never has been, and nor will there ever be.
With a life sentence totalling about ten years these days, the judicial system has become little more than a joke. Politicians and the men and women in wigs drone on about us not having enough prisons to lock people up for long terms and that’s why we now have Judiciary Lite at play. Well build some more prisons then, Mr Brown. There are plenty of construction workers looking for a job, and we are all certainly paying enough taxes, so what’s the issue here (aside from the fact that the economy is presently in a total shambles)?
Policing the Internet and mail order outlets
The Government is also said to be looking at cracking down on the sale of knives over the Internet and from mail order catalogues. There is a need to do so. Last month, researchers working over a three-day period found that over 9,000 knives, from flick blades through to full-blown machetes, were available for sale on online auction sites. More than half of those implements could be bought without warnings or restrictions.
Worse still, it emerges that four of Britain’s six foremost department stores are currently selling knives with no age limits for purchasers.
One specialist seller has been running no less than five auction sites offering illegal ‘semi-automatic’ daggers with blades that flick out at the touch of a button.
Why aren’t these people being stamped on? How many more innocent teenagers will have to die before something is done?
Until next time.
Brian Sims, Editor, SMT (12.08.2008)