​We’ve seen an increase in attacks that circumvent a single point of failure, allowing criminals to access systems undetected, and to compromise card data. A significant change in PCI DSS 3.2 includes multi-factor authentication as a requirement for any personnel with administrative access into environments handling card data. Previously this requirement applied only to remote access from untrusted networks. A password alone should not be enough to verify the administrator’s identity and grant access to sensitive information,

Microsoft’s long-term vision is to be able to create large data centers several miles off the coast, operating 600 feet under the surface with only a network connection. Power would be generated from offshore sources, either from wind power or turbines driven by ocean currents. These data centers would consist of a series of unmanned data center modules, effectively larger versions of the Project Natick deployment.

​While the sustainability profile is excellent, Microsoft is perhaps more focused on the potential business benefits of Project Natick. These include:

• Improved speed and agility, with the ability to deploy within 90 days
• A lower total cost of ownership (TCO) than land-based data centers.
• Low-latency delivery of cloud services to the large populations along coastlines.
• Better physical security than land-based data centers.

​The Breach Level Index has to be inclusive of minor loss of data all the way up to the largest reported breaches, such as that of the 150 million records stolen from the Shanghai Roadway Marketing Service reported in March 2012.
The Breach Level Index must fit the information readily available for each breach and it must be easy to understand and calculate. It should include weighted values for number of records, type of data, source of the breach and whether or not the data has been used for nefarious purposes.
The Breach Level Index is open ended in that there is no upper limit, although to date the largest breach scores just under a 10. The Index is logarithmic (base 10) so just as in the scales for volcanoes and earthquakes, a score of 7, for instance, is 100 times more severe than a score of 5. 
​

​To make the Breach Level Index easily understandable to a broad swath of society, we think it makes sense to map the Index scores to a simple five-step scale, similar to the Saffir-Simpson scale. The following table shows how Index scores map to this scale. To put it into context, the California Department of Support Services breach would be a Category 3 data breach, while the LinkedIn breach would be Category 4. 

​For many people, an equally mysterious topic is the mathematics surrounding cryptography. Cryptography was so intimidating a topic for many people studying for the CISSP certification exam, that the ISC2 removed it as one of the 10 core domains of the CISSP common body of knowledge. There are now 8 domains and cryptography is now but a sub-topic within the security engineering domain.

The book is indeed made for the non-mathematician reader who won’t be overwhelmed by that math in the book.

The first half deals with various types of payment systems. Gomzin describes ancient systems of bartering, then progressing to modern commodities and digital currencies.

For those looking to understand the cryptography behind payment systems and specifically Bitcoin; Slava Gomzin has a new book Bitcoin for Nonmathematicians: Exploring the Foundations of Crypto Payments (Universal Publishers ISBN-13: 978-1627340717), that provides a good overview of the topic.

​Backup recovery is your last line of defense to having to pay out a ransom to the attackers; it's your last bastion in the event that the worst has happened. Your ability to recover from this attack with minimal data loss and/or service interruption amounts to whether or not the system backups and/or disaster recovery sites were compromised as a part of the attacker methodology. Whether or not your backups were compromised depends on how well your backup systems and/or network and/or recovery sites were sufficiently segmented from your main network. Even in the event your organization does not utilize on-site backups at all, instead opting for cloud backup solutions (e.g. Amazon Glacier), if those cloud backup credentials are left in easily accessible locations, or if passwords are reused, our hypothetical adversary could easily delete all backup instances, resulting in 100% data loss if there is no other backup solution in place. The secure, off-site, enterprise backup solution could easily be defeated through password reuse and/or poor password management

Advanced persistent threats (APTs) rely on expensive, multi-staged tools that sometimes take years to develop, so, for their own operational security, APT operators need to be able to discover other malware on their target. A low-level malware operating on the same network might catch the attention of a target’s defense grid and risk the entire advanced campaign. So the APT operator must assess the risk of exposure and carefully plan their next steps. For example, they could try to compromise the other attacker’s tool and snatch the stolen data. If the other attacker has a strong foothold, the APT operator might choose an alternative endpoint, vector, or method, or even give up and move on to a new target.

​Companies and governments are still punch-drunk on data, and have believed the wildest of promises on how valuable that data is. The research showing that more data isn't necessarily better.

Many organizations are still downplaying the risks. Some simply don't realize just how damaging a data breach would be. Some believe they can completely protect themselves against a data breach, or at least that their legal and public relations teams can minimize the damage if they fail. And while there's certainly a lot that companies can do technically to better secure the data they hold about all of us, there's no better security than deleting the data.

Some organizations understand both the first two reasons and are saving the data anyway. The culture of venture-capital-funded start-up companies is one of extreme risk taking. These are companies that are always running out of money, that always know their impending death date. They are so far from profitability that their only hope for surviving is to get even more money, which means they need to demonstrate rapid growth or increasing value. This motivates those companies to take risks that larger, more established, companies would never take. They might take extreme chances with our data, even flout regulations, because they literally have nothing to lose. And often, the most profitable business models are the most risky and dangerous ones.