Archive for July, 2019

Are you sure you don’t want a Capital One card now?

July 31, 2019 Leave a comment

In one of the largest breaches that affects over 6 million Canadians and potentially 100 million US customers, Capital One has revealed that it lost customer data and it was related to Security Misconfiguration. A suspect has been arrested, charged with computer fraud and abuse.

Categories: General

Goodbye Docker: Purging is Such Sweet Sorrow – zwischenzugs

July 28, 2019 Leave a comment

Now that IBM has thrown its hat in the cloud with the $34B purchase of Redhat, you should expect more innovation. This article from another WordPress site helps answer the question of why running docker is not necessary to have containerized solutions. You can minimize the attack surface and remove docker by using open source tools available to use today.

Categories: General

New European rules for mobile banking apps coming to a device near you…

July 26, 2019 Leave a comment

The world is clearly a better place now that we carry computers in our back pocket but we need an increase in security measures for payment transactions and therefore we will require an increase in regulation, such as the PSD2 from European Commission.

The Payment Services Directive mandates compliance by September 2019 and aims to regulate banks, payment service providers and electronic payments to include security features to protect consumers across digital channels. The PSD2 legislation will require financial services in the European Union (EU) to contribute to a more integrated, secure, and efficient payments ecosystem.

The PSD2 directive requires financial institutions to:

  • Provide/Implement a monitoring mechanism in their apps to detect/report signs of malware.
  • Provide security measures in their app to mitigate risk for the user device.
  • Ensure consumers have a secure environment to execute their financial transactions

In Article 2 and Article 9 of the directive, PSD2 highlights Strong Customer Authentication (SCA) and Safe Execution Environment (SEE), which requires de-risking across various threat vectors impacting mobile apps.

These include detecting compromised devices (eg: jailbroken or rooted), unsafe environments (such as a fake or malicious wi-fi), as well as malware and vulnerabilities within the application execution environment. PSD2 also includes RTS (Regulatory Technical Standards), which are regulatory requirements set by the European Banking Authority (EBA) to ensure that payments across the EU are secure, fair & efficient.

To meet these requirements, financial institutions should add strong security capabilities like binary protections to their mobile apps. These controls are designed to protect against known and unknown threats on users’ devices.

Mobile banking apps should also be able to detect when they are installed on risky devices and consider restricting access to high value banking services until those risks have been remediated.

Categories: Mobile, security Tags: ,

Honest, it was like that when I drove up?

July 21, 2019 Leave a comment

It can be comforting to know that McD’s is still running Windows XP for their drive up kiosks…

and is still having logic based software problems like the rest of big enterprise isn’t it?

Categories: General

WebInspect has 3 great new features – Micro Focus Community – 1796294

July 21, 2019 Leave a comment
Categories: General

Malicious Python libraries targeting Linux servers removed from PyPI | ZDNet

July 21, 2019 Leave a comment
Categories: General

Strange Spotify charges with TD accounts

July 21, 2019 Leave a comment
Categories: General