
Enex TestLab is moving forward on its marketing strategies producing this advertisement highlighting our independent security testing services
A regular blog about all things Enex TestLab
The pitfalls of social networking
Social networking sites are big at the moment. Almost everyone I know has at least one account - whether it’s Facebook, MySpace, Twitter or any of the multitude of other options. Social Networking sites are a fantastic idea and offer something to all types of users.
This new craze has allowed old friends who live on different sides of the world to get back in touch. Friends who live next door are, of course, even using them to chat instead of using the phone (or getting off the settee to visit).
While these sites have been provided by reputable companies who are doing all they can to ensure online safety, there are still dangers that everyone should be aware of when using social networking sites.
A vast number of social site users are more than happy to enter all their information into the ‘about you’ information fields on these sites. “I had to log in - it’s safe isn’t it?” Well, the new friend you made using that chat application last night can now see everything about you - name, address, date of birth, next of kin, etc. Incidentally, this is all the information needed to open a bank account; do other people really need to know all this about you?
A big problem that appeared a couple of years ago was that people were putting all this personal information on their profiles, then broadcasting upcoming family holidays through their status updates and were returning home to find they’d been burgled.
Identity theft is not the only pitfall. Malware has been specifically designed to exploit social networking sites. How many times have you had an email from your friends’ social network account asking if it really is you in the office party video?
Or perhaps a video link tells you that you require a Flash upgrade, but instead of installing any upgrade it installs the Koobface worm. The fun part about the Koobface worm is that it sends messages to all your contacts (making you very popular) as it tries to infect their systems as well.
It is not only individuals that can fall prey to the pitfalls of social networking, businesses have seen the problems too.
As people become more obsessed with social networking sites, gaming with their friends on Mafia Wars or Zombie applications, businesses have started to feel the strain. Employee productivity plummeted and the increased usage often strangled corporate bandwidth. Most companies have now banned these sites.
Social networking sites are not bad for companies per-se, they can be used as a great promotion and engagement tool.
Social networks have also caused their share of curly management issues; such as employees ringing in sick, and then update their Facebook status claiming to have the mother of all hangovers. Awkward if you’ve forgotten you added your boss as a friend.
All in all, social networking is a good thing – a great thing. It has opened up the internet and communication in a whole new way. The thing to remember is to always be mindful of what information you put out there for the world to see. While most people are mostly nice, there are others that will have ulterior motives and the internet offers enormous reach for those that are hunting.
PCI Compliance In The UK
Hands up any who still uses cash for most of their purchases? Hmm, very few.
Nowadays the majority of people pay for everything by debit or credit card. Paying by card is so easy that you can walk in to a corner shop, pick up a couple of chocolate bars and use your card. The ability to walk around without having to worry about cash or change is a great feeling. As anyone will testify, when you don’t need a cash machine they’re everywhere, but when you do need a cash machine…
With all this new found freedom and everybody willing to swipe my card, are my details safe?
The banks and card providers have been asking the same question and, as a result, have come up with PCI Compliance. PCI stands for Payment Card Industry, and every single business that takes payment by card will have to become compliant. That’s right, not just the Amazons and PayPals, but your local take away and corner shop as well. Everyone will have to be compliant.
Why?
The banks and card providers are fully aware of problems such as customer’s card details being sold or stolen. For this key reason (and many others) PCI regulations have been brought in to ensure that any company holding card data has proven - through audits - that the data they hold is secure. As it currently stands, we consumers don’t know if a company has a secure server behind a firewall or whether the data is simply held on the store owner’s home computer - with a weak password. The banks and card providers are hoping that these measures will mean consumers have the confidence to use their cards. This is a problem that these organisations are taking very seriously. If consumers don’t have faith in using their cards safely, they just won’t use them.
When?
The original deadline set for all businesses to become compliant in the UK was September 30th 2010. The aim was to ensure Level 1 businesses were compliant first, and then all other level businesses meet compliance thereafter.
A level 1 business refers to Amazon-type companies with over 6 million transactions annually. At the other end of the scale are level 4 businesses, local shop less than 20,000 transactions annually.
In September 2010, Tripwire published a white paper that revealed the readiness of UK businesses for compliance. Below are the key findings from that report.
KEY FINDINGS
• Only 12% of United Kingdom (UK) organisations processing credit and debit cardholder data are currently certified as being PCI compliant.
• 58% of Level 1 merchants have been audited and certified as compliant. This falls to 6%, 8% and 4% for Level 2, 3 and 4 organisations.
• Over half (57%) of retail organisations admit to not fully understanding the requirements of the Payment Card Industry Data Security Standard (PCI DSS).
• Brand awareness and fear of reputation damage is a significant driver for achieving PCI compliance.
• Over three quarters (77%) of organisations have had no difficulty in securing funding and resources to ensure PCI DSS requirements are met.
• 88% of organisations have senior management on the PCI DSS team or working group — a figure that is 100% for Level 1 organizations.
Whilst currently, there is a short fall in compliant businesses, the vast majority of these see PCI compliance as an improvement and have gained the necessary funding to implement it. They have seen what can happen to large corporations such as RBS WorldPay and TJX who both lost vast amounts of card data through breaches, and understand how PCI compliance can improve their security.
This can only be good news for us as consumers as we need to trust our data is being stored securely.