New Scoring System Protects Credit Card Transactions

Daily Science Journal (Nov. 11, 2007) — As this year's holiday season approaches, your credit card transactions may be a little more secure thanks to standards adopted by the payment card industry. The latest incarnation of these standards include the Common Vulnerability Scoring System (CVSS) Version 2 that was coauthored this year by researchers at the National Institute of Standards and Technology and Carnegie Mellon University in collaboration with 23 other organizations.

When you make an electronic transaction--either swiping a card at a checkout counter or through a commercial Web site--you enter personal payment information into a computer. That information is sent to a payment-card "server," a computer system often run by the bank or merchant that sponsors the particular card. The server processes the payment data, communicates the transaction to the vendor, and authorizes the purchase.

According to NIST's Peter Mell, lead author of CVSS Version 2, a payment-card server is like a house with many doors. Each door represents a potential vulnerability in the operating system or programs. Attackers check to see if any of the "doors" are open, and if they find one, they can often take control of all or part of the server and potentially steal financial information, such as credit card numbers.

For every potential vulnerability, CVSS Version 2 calculates its risks on a scale from zero to 10, assesses how the vulnerability could compromise confidentiality (exposing private information such as credit card numbers), availability (could it be used to shut down the credit card system") and integrity (can it change credit card data"). The CVSS scores used by the credit card industry are those for the 28,000 vulnerabilities provided by the NIST National Vulnerability Database (NVD), sponsored by the Department of Homeland Security.

To assess the security of their servers, payment card vendors use software that scans their systems for vulnerabilities. To promote uniform standards in this important software, the PCI (Payment Card Industry) Security Standards Council, an industry organization, maintains the Approved Scanning Vendor (ASV) compliance program, which currently covers 135 vendors, including assessors who do onsite audits of PCI information security. By June 2008, all ASV scanners must use the current version of CVSS in order to identify security vulnerabilities and score them.

Requiring ASV software to use CVSS, according to Bob Russo, General Manager of the PCI Security Standards Council, promotes consistency between vendors and ultimately provides good information for protecting electronic transactions. The council also plans to use NIST's upcoming enhancements to CVSS, which will go beyond scoring vulnerabilities to identify secure configurations on operation systems and applications.

Adapted from materials provided by National Institute of Standards and Technology, via EurekAlert!, a service of AAAS.

Read the rest of this entry »

Computing Breakthrough Could Elevate Security To Unprecedented Levels

Daily Science Journal (Aug. 17, 2007) — By using pulses of light to dramatically accelerate the development of quantum computers, University of Michigan researchers have made strides in technology that could foil national and personal security threats.

It's a leap, they say, that could lead to tougher protections of information and quicker deciphering of hackers' encryption codes.

A new paper on the results of this research, "Coherent Optical Spectroscopy of a Strongly Driven Quantum Dot," appears in the Aug. 17 issue of Science. Duncan Steel, the Robert J. Hiller Professor at Michigan Engineering's Department of Electrical Engineering and Computer Science and the Department of Physics, is one of the lead authors of the paper. Faculty from the University of California-San Diego and the Naval Research Laboratory in Washington, D.C., also contributed.

The researchers used short, coherent pulses of light to create light-matter interactions in quantum dots---particles so small that the addition or deletion of electrons changes their properties. They found they could control the frequency and phase shifts in the optical network, which is crucial in powering an optically driven quantum computer, Steel said.

Optically driven quantum computers can crack highly encrypted codes in seconds. The fastest of today's desktop computers would require 20 years.

Part of what makes quantum computers so fast is that they are multitask masters.

"Quantum computers are capable of massive parallel computations," Steel said. "That's why these machines are so fast."

And the technology the researchers used to power them in this study is relatively cheap.

"We're particularly excited about our findings because they show that we can achieve these results by using quantum dots and readily available, relatively inexpensive optical telecommunications technology to drive quantum computers," Steel said. "Quantum dots replace transistors in these computers, and our results show that it only takes a few billionths of a watt to drive it."

U-M researchers are using quantum dot systems to pave the way for numerous quantum level applications, such as quantum dot dressed state lasers, optical modulators and quantum logic devices.

This discovery in quantum dot spectroscopy is an important stepping stone to building a quantum computer for the future.

Spectroscopy is the study of the interaction between light and matter.

Adapted from materials provided by University of Michigan, via EurekAlert!, a service of AAAS.

Read the rest of this entry »

Scientists Will Be Assessing Methods To Stop Identity Theft

Daily Science Journal (Aug. 12, 2007) — The National Physical Laboratory (NPL) is part of Biotesting Europe, a new €358,000 biometrics project, part-funded by the European Union. The project will ensure that future testing procedures and facilities meet the needs of systems users and developers, building confidence in this growing industry.

Biometric recognition systems measure unique behavioural or physical traits to recognise people. These can be as varied as iris images, fingerprints, the structure of veins in the hand, or even an individual's typing rhythm. Currently they are predominantly used in national government systems for border control or criminal justice. They could equally be used in a domestic context to reduce identity theft by helping to secure bank accounts or corporate IT systems. For example the use of fingerprint readers when paying by credit or debit card could make identity fraud more difficult.

With a range of approaches and technologies available for biometric recognition and new ones constantly in development, the field is a fast moving one. Before investing in systems, buyers need to be assured of the usability and reliability of products. Similarly, technology developers benefit from independent testing regimes that allow them to prove their products and trial them in combination with existing systems.

There is a need for a European network of resources for testing systems and products. This network would improve access to testing and avoid duplicating existing facilities. Before significant additional investment is made, there is a need for an audit of the resources currently available and the needs of customers.

NPL has expertise in the evaluation and calibration of biometric systems.

The results that emerge from Biotesting Europe will provide a clear direction for the future development of shared resources for biometric testing.

Notes: Biotesting Europe is a nine month project that will be completed by early 2008. It is co-ordinated by the European Biometric Forum, with partnership from the UK's National Physical Laboratory, Germany's Fraunhofer-Institut für Graphische Verarberaitung, and the European Commission Joint Research Centre.

Adapted from materials provided by National Physical Laboratory, via EurekAlert!, a service of AAAS.

Read the rest of this entry »