Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Hotel Company Investigates Data Breach, Card Fraud
Newest First  |  Oldest First  |  Threaded View
amanda travis
amanda travis,
User Rank: Apprentice
7/5/2014 | 1:40:00 AM
Re: No perfect security
Thanks for this post. I find it very interesting. A proposed credit card hotline is the latest issue to fuel the fiery debate over the Consumer Financial Protection Bureau. The hotline would essentially take calls from concerned customers, and the agency would compile grievances about charge card companies. It pays to be very careful in choosing sources for this matter to avoid scam.
catvalencia
catvalencia,
User Rank: Apprentice
5/26/2014 | 11:54:15 AM
Re: Dont think its just these properties.
Scams are everywhere. So please watch out for this bogus tricks folks! Always be wary of individuals selling stuff door to door, as a number are rip-off artists. Apart from Girl Scouts attempting to get people hooked on diabolically addicting cookies, there are a number of door-to-door scams out there.
AaronP916
AaronP916,
User Rank: Apprentice
2/6/2014 | 5:06:43 PM
Dont think its just these properties.
I don't think it's solely limited to those properties.  I stayed in two of their other properties in North Austin, and one of theirs in Chandler, AZ.  American Express called to inform me that my card number was stolen and was attempted to charge items in South Africa.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/6/2014 | 8:18:56 AM
Re: No perfect security
Great analogy about "teaching to the test." Meeting a compliance reg is only a part of the solution. The real security goal is to ensure that everyone at all levels -- users, techies, security experts, etc. -- understand the organizations's overarching security goals, are grounded in best security practices and are kept up to date on emerging tech trends that add to security risks (like your example of  IP video surveilance cameras). Thanks for the thoughtful response!
jagibbons
jagibbons,
User Rank: Strategist
2/5/2014 | 7:51:19 PM
Re: No perfect security
Being in or out of compliance is evaluated against a set of tests that are designed to provide evidence of various practices. Behing each test there a principle that the test is evaluating. You can pass the test and still be doing things that violate the principle.

Here's a brief example. I can put in video surveillance to make sure my cashiers are skimming credit numbers. That helps me protect credit card data. However, if my video recording actually sees the card numbers that the customer is handing to my cashiers, I now have a copy of that credit card on the video surveillance that may not be as secure as my point of sale units.

The intent, or principle, is about protecting card data. By focusing on one area of protection instead of looking holistically, I can unintentionally violate that principle while achieving 100% compliance on the test. Likewise, I can spend all my time locking down my network to protect our systems, but when that lockdown becomes so draconian that my staff decide to take shortcuts to make their jobs easier, security suffers.

It's like with standardized testing in schools. It's better for all society if kids learn the subject, rather than just learn enough to spit out the answers to a test.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/5/2014 | 2:09:26 PM
Re: No perfect security
...if companies are maintaining compliance by focusing on strong security practices that target the intent of the PCI DSS, the likelihood of a breach goes down.

Thats an interesting way to look at PCI-DSS. What do you mean by intent versus strict compliance. 
jagibbons
jagibbons,
User Rank: Strategist
2/3/2014 | 12:33:04 PM
No perfect security
Even if you are indisuptably 100% compliant with the PCI Data Security Standards, you can suffer a breach. There is no such thing as perfect security. However, if companies are maintaining compliance by focusing on strong security practices that target the intent of the PCI DSS, the likelihood of a breach goes down. More importantly, being in compliance and having that be part of the corporate culture should make it easier and less costly to deal with a breach once it is discovered.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Black Hat USA 2022 Attendee Report
Black Hat attendees are not sleeping well. Between concerns about attacks against cloud services, ransomware, and the growing risks to the global supply chain, these security pros have a lot to be worried about. Read our 2022 report to hear what they're concerned about now.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-35942
PUBLISHED: 2022-08-12
Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data ...
CVE-2022-35949
PUBLISHED: 2022-08-12
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js con...
CVE-2022-35953
PUBLISHED: 2022-08-12
BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next. Some links in BookWyrm may be vulnerable to tabnabbing, a form of phishing that gives attackers an opportunity to redirect a user to a malicious site. The issue was patche...
CVE-2022-35956
PUBLISHED: 2022-08-12
This Rails gem adds two methods to the ActiveRecord::Base class that allow you to update many records on a single database hit, using a case sql statement for it. Before version 0.1.3 `update_by_case` gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgra...
CVE-2022-35943
PUBLISHED: 2022-08-12
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter ...