Will PCI DSS 3.2 Make Payments More Secure?

The latest iteration of the payment standard, which includes multifactor authentication, made its debut, but some security experts don’t think it goes far enough.

The latest iteration of the Payment Card Industry Data Security Standard—PCI DSS 3.2—adds new requirements and clarifies others.PCI DSS is a compliance specification that is typically a requirement for any organization that handles payments, including online and traditional brick-and-mortar retailers.Among the biggest changes in the PCI DSS 3.2 standard—the successor to the PCI DSS 3.1 standard announced in April 2015—is the wider applicability for requirement 8.3, which details the use of multifactor authentication.  The PCI DSS 3.0 standard, released in November 2013, required the use of multifactor authentication only for remote network access. With the PCI DSS 3.2 standard, all personnel with non-console administrative access to the cardholder data environment are required to have multifactor authentication.”Previously, this requirement applied only to remote access from untrusted networks,”  PCI Security Standards Council CTO Troy Leach said in a statement. “A password alone should not be enough to verify the administrator’s identity and grant access to sensitive information.”

Additionally, the PCI DSS 3.2 standard is different from its predecessor specification in that the term “multifactor authentication” is used, rather than the prior term, “two-factor authentication.”

“Clarified correct term is multifactor authentication, rather than two-factor authentication, as two or more factors may be used,” the PCI DSS 3.2 summary of changes document explains.The expanded requirement for multifactor authentication is a good thing for payment card security, said John Bambenek, threat intelligence analyst at Fidelis Cybersecurity. “Doing two-factor authentication for all access will be time-consuming, but straightforward, in my opinion,” Bambenek told eWEEK. “For those organizations that have to do penetration tests that will mean dedicating more time and, likely, more money.”Beyond the expanded use of multifactor authentication, PCI DSS 3.2 also adds focus on making sure that organizations stay compliant after they change things in their IT environment. In PCI DSS 3.2, the 6.4.6 requirement is a new control that requires organizations to make sure that change control processes include verification of PCI DSS requirements, which could be affected by a change. The basic idea is to help organizations avoid falling out of PCI DSS compliance as a result of a change.For organizations moving from PCI DSS 3.1 to PCI DSS 3.2, the biggest challenge will be the internal overhead and increased costs they will incur to be compliant to the new standard, said Brian NeSmith, CEO at network security startup Arctic Wolf Networks. “The standard requires more frequent testing and assessments, and this only benefits the PCI compliance-services vendors,” NeSmith told eWEEK. “It does not remove the burden of figuring out what method or device to use to ensure continuous security between the compliance tests and assessments.”With the volume of high-profile retail breaches in recent years, PCI DSS doesn’t exactly have a spectacular track record in the eyes of many in the security community.”Every company that has been spectacularly hacked in the last three years has been PCI-compliant. Sony, Target, Anthem, pick your favorite,” Mark Longworth, CEO of mobile security startup Shevirah, told eWEEK.Fidelis’  Bambenek noted that compliance-driven security often doesn’t move anywhere near as fast as the risks. The gap between compliance and actual risks is also a real concern for NeSmith. Overall, the new PCI DSS 3.2 standard misses the mark by focusing on detecting and reporting security control failures rather than protecting against threat detection use cases, he said.”If a thief gets into your house through an unlocked door, adding another lock on the door doesn’t make you safer,” NeSmith said. “What you really need to do is make sure to lock the door, but if you forget, you need to be able to detect the break-in and make sure the police show up before the thief gets away.”Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.
Source: eWeek

Talari SD-WAN Technology Now Supports Microsoft Azure, Hyper-V

The company’s virtual appliances already worked with VMware and AWS, but now will also support Microsoft’s cloud and virtualization platforms.

Talari Networks is now including Microsoft’s cloud and virtualization technologies among the platforms the company’s software-defined WAN products will support.Company officials announced that a new virtual appliance, the VT800, will support Microsoft Azure and Hyper-V environment. Prior to the VT800, Talari offered virtual appliances that supported VMware’s ESX virtualization technology and integration with Amazon Web Services’ (AWS) cloud technologies. Now customers with Microsoft infrastructures can offer Talari’s software-defined WAN (SD-WAN) capabilities natively in their environments.The networking space is continuing to use cloud- and virtualization-based services in the WAN, and Talari needs to be able to support all of the leading technologies, according to President and COO John Dickey. “Talari has always focused on offering customers a high degree of flexibility when it comes to acquiring and deploying an SD-WAN solution,” Dickey said in a statement, adding that the vendor will continue to expand its SD-WAN deployment options. “Our work with Microsoft, Amazon and VMware as delivery options for the VT800 are the latest milestones on our journey to bring a comprehensive, partner integrated SD-WAN solution to market.”

Talari is one in a growing number of vendors in the nascent SD-WAN market, fast-rising part of a rapidly changing enterprise networking space. SD-WANs—part of the larger network virtualization move in the industry—come as enterprise and service providers are increasingly using the cloud to deliver applications and services, their workers are becoming more mobile, the Internet of things (IoT) is growing and the number of mobile devices connecting to the network is increasing.

When traffic from the branch went to the data center, connectivity options like Multiprotocol Label Switching (MPLS) was a good fit. But now, with more unstructured data and more traffic being mobile and coming from the cloud, WANs need to be more scalable, programmable and affordable, and connected directly to the cloud. SD-WAN technologies offer a complement to MPLS.The market will grow quickly over the next several years. Gartner analysts expect the number of enterprises adopting SD-WAN technologies to increase from about 1 percent now to 30 percent by the end of 2019. IDC analysts are forecasting that the market will grow from less than $225 million last year to more than $6 billion by 2020.Customers have a lot of options to sort through, with almost two dozen vendors offering SD-WAN products. That includes established players like Cisco Systems, pure-play companies like Talari, VeloCloud, CloudGenix and Glue Networks, and vendors like Riverbed Technology—which last month introduced its SteelConnect SD-WAN platform—and Silver Peak Networks, which have made the move from the WAN optimization space.Talari officials have said their company has the advantage of having been in the space for almost a decade, even before the term SD-WAN came into use. That enables the vendor to already have a large mix of physical and virtual appliances and assorted software assets on the market, and expanding their support of Microsoft technologies is a continuation of the effort to grow its portfolio.The Talari VT800 is available now from Talari and its channel partners. It supports performance levels of 20 Mb/s, 40 Mb/s, 100 Mb/s and 200 Mb/s, officials said.
Source: eWeek

10 Devices That Could Pay Off for Google's New Hardware Division
By Don Reisinger  |  Posted 2016-05-02 Print

Don Reisinger is a freelance technology columnist. He started writing about technology for Ziff-Davis’ Gearlog.com. Since then, he has written extremely popular columns for CNET.com, Computerworld, InformationWeek, and others. He has appeared numerous times on national television to share his expertise with viewers. You can follow his every move at http://twitter.com/donreisinger.

Source: eWeek

US House Passes Email Privacy Act in 419-0 Vote

The US House of Representatives passed an update to the email privacy act last week in an unanimous vote of 419-0. The bill will now move to the Senate.

The bill updates the Electronic Communications Privacy Act (ECPA) of 1986 and closes a loophole that allowed electronic communications to be obtained without a warrant.

The ECPA has long been criticized by privacy advocates as being outdated, which isn’t hard to imagine as it was passed long before email was one of the most prevalent communications. The loophole allowed law enforcement to use a subpoena, rather than a warrant, to obtain an email older than 180 days, according to a report by Naked Security.

SQL Server 2016 heads for release, but Linux version is still under wraps

SQL Server 2016, Microsoft’s newest database software, is set to become available on June 1 along with a no-cost, developers-only version.

With its new features and revised product editions, Microsoft is determined to expand SQL Server appeal to the largest possible number of customers running in a range of environments. But there’s still no word on the promised SQL Server for Linux, a version of the popular database that Microsoft is hoping will open SQL Server to an entirely new audience.

A broader SQL Server market awaits

Much of what’s new in SQL Server 2016 is aimed at roughly two classes of users: those doing their data collection and storage in the cloud (or moving to the cloud) and those doing analytics work that benefits from being performed in-memory. Features like Stretch Database will appeal to the former, as SQL Server tables can be expanded incrementally into Microsoft Azure — a more appealing option than a disruptive all-or-nothing migration.

Big data features include expanded capabilities for the Hekaton in-memory functions introduced in SQL Server 2014, plus in-memory columnstore functions for real-time analytics. And SQL Server’s close integration with the R language tools that Microsoft recently acquired opens up the database to a range of new applications from a thriving software ecosystem.

HTC Will Reportedly Build the Next 2 Nexus Android Smartphones

HTC, which built the Nexus One and Nexus 9 phones, will build two more of the upcoming smartphone models that will be powered by Android.

HTC is reportedly again being tapped to manufacture two Google Nexus smartphone models running on Android, after building two previous Nexus handsets.The latest rumors about HTC’s move come from well-known news tipster Evan Blass, who posted several tweets on Twitter about his latest observations. Blass’ Twitter name is @evleaks.”HTC is building a pair of Android N devices for Google internally dubbed M1 and S1 #nexus,” Blass posted in an April 27 tweet.He followed his original message up with another related post, “So now I’m hearing that there are going to be both a Maxx 3 as well as a Turbo 3. #dejavu.”

Those two upcoming devices are code-named Marlin (M1) and Sailfish (S1), according to a related rumor report by AndroidPolice. “Google has a long history of naming Nexus devices after aquatic life, the current 5X and 6P are Bullhead and Angler, respectively,” the story reported. “The Nexus 6 was Shamu. The Nexus 5 was Hammerhead, and so on.”

No other details are yet available about the next potential Nexus smartphones at this time.In March, Google’s latest Project Fi smartphone, the Nexus 5X, debuted as the second handset being sold for use with Google’s Project Fi mobile phone services, which start at $20 a month. The Nexus 5X smartphone is made by LG for use with Google’s Project Fi inexpensive monthly wireless service plans, according to an earlier eWEEK story. The Nexus 5X is priced at $349 for a 16GB model or $399 for a 32GB model.Project Fi is Google’s inexpensive mobile phone service that came out in April 2014 under what was then an invitation-only system. Project Fi phone services recently opened to all users who buy or provide a compatible Nexus smartphone that will work with the service. So far, the Nexus 6P by Huawei, the new Nexus 5X and the earlier Nexus 6 are the only three smartphones that will work with Project Fi’s network. Users pay $20 per month for cellular access, plus data fees of $10 per GB only for the data that is consumed each month. The monthly access fee also includes unlimited talk and texting, WiFi tethering and international coverage in more than 120 countries.Both Nexus 5X by LG models feature a 5.2-inch full HD (1,920-by-1,080) LCD display, a 2GHz hexa-core 64-bit Qualcomm Snapdragon 808 processor, an Adreno 418 graphics processing unit and 2GB of LPDDR3 memory. The handsets also feature a Corning Gorilla Glass 3 cover glass and a fingerprint- and smudge-resistant oleophobic coating, as well as a 2,700mAh battery. Both models run on the Android 6.0 Marshmallow operating system and include a 12.3-megapixel rear-facing camera with an f/2.0, infrared, laser-assisted autofocus lens, 4K (30 fps) video capture and broad-spectrum dual flash. The front-facing camera on both devices is a 5-megapixel model with an f/2.2 aperture.The other available Project Fi phone for sale is the Nexus 6P by Huawei. The 6P features a 5.7-inche WQHD (2,560-by-1,440) AMOLED display, a 2GHz octa-core 64-bit Qualcomm Snapdragon 810 processor, an Adreno 430 graphics processor, 3GB of LPDDR4 memory, a 12.3-megapixel rear camera, an 8MP front camera and a 3,450mAh battery. The 6P is 6.27 inches long, 3.06 inches wide and 0.28 inches thick and weighs 6.27 ounces. The phone—which sells for $499 for a 32GB version, $549 for the 64GB version and $649 for a 128GB version—is available in silver, black, white or gold.In April, HTC unveiled its own flagship Android smartphone, the HTC 10 (pictured), to take on Samsung’s Galaxy S7 phones, Apple’s iPhones and others. The HTC 10 includes a myriad of improvements to its processor, cameras, battery and audio system, giving potential buyers of HTC’s latest smartphone lots to consider. The HTC 10 replaces the HTC One M9, incorporating a faster Qualcomm Snapdragon 820 processor, vastly improved front and rear cameras, and upgraded audio capabilities. The latest handset has a metal unibody design and runs on the Android 6.0 Marshmallow operating system.The HTC 10 features a 5.2-inch, Quad HD (2,560-by-1,440-pixel) touch-screen display that is covered with Corning Gorilla Glass, a Qualcomm Snapdragon 820 quad-core 64-bit processor, 4GB of memory, 32GB or 64GB of built-in storage, and a microSD slot that accepts storage cards up to 2TB.
Source: eWeek

Oracle Buys Opower to Read Utility Meters in the Cloud

Opower’s software powers more than 100 global utilities, including Pacific Gas & Electric (PG&E), Exelon and National Grid.

Oracle is going into the meter-reading-by-cloud business.A mere one week after buying Textura, a construction management and engineering SaaS software provider, Oracle on May 2 added Opower, a publicly traded provider of customer engagement and energy efficiency cloud services to utilities.The transaction is valued at approximately $532 million, or $10.30 per share, net of Opower’s cash.The acquisition is the fifth thus far this year — second in the cloud services sector — for the Redwood City, Calif.-based database, middleware, apps and data center hardware company.

Opower’s software powers more than 100 global utilities, including Pacific Gas & Electric (PG&E), Exelon and National Grid. Opower’s big data platform stores and analyzes more than 600 billion meter reads from 60 million utility end customers, enabling utilities to proactively meet regulatory requirements, decrease the cost to serve, and improve customer satisfaction.

Oracle Utilities and Opower thus will become the largest provider of mission-critical cloud services to utilities, said Rodger Smith, Senior Vice President and General Manager, Oracle Utilities Global Business Unit.Oracle will be going head-to-head with companies such as Silver Spring, VertexOne, WaterWorks, Muni-Link and UtiliyTrakR. Go here to see a listing of sector leaders.The transaction is expected to close in 2016, subject to Opower’s stockholders tendering a majority of Opower’s outstanding shares and derivative securities exercised prior to the closing of the tender offer, certain regulatory approvals and other customary closing conditions.

For more information, go here.
Source: eWeek

Ubuntu Founder Pledges No Back Doors in Linux

VIDEO: Mark Shuttleworth, founder of Canonical and Ubuntu, discusses what might be coming in Ubuntu 16.10 later this year and why security is something he will never compromise.

Ubuntu developers are gathering this week for the Ubuntu Online Summit (UOS), which runs from May 3-5, to discuss development plans for the upcoming Ubuntu 16.10 Linux distribution release, code-named “Yakkety Yak.”In a video interview with Mark Shuttleworth, founder of Ubuntu Linux and Canonical, he discusses Ubuntu 16.10, including the Mir display server and his views on security including the use of encryption.Ubuntu 16.10 is set to debut in October and follows the Ubuntu 16.04 update, which was released on April 21. While it’s not yet entirely clear what exact features will land in Ubuntu 16.10, one candidate is the Mir display server. The Ubuntu community–and Shuttleworth in particular–has been talking about migrating to Mir since at least 2013. The promise of Mir is a unified display technology that will work across desktops, mobile devices and even TVs. While there is some controversy among members of the Linux community over the transition to Mir, Shuttleworth emphasized that few people will ever know the difference.”I can’t say when Mir will drop into Ubuntu as the default display system, but I can say when it does, no one should notice it,” Shuttleworth told eWEEK. “That’s our commitment: The set of experiences that people enjoy about Ubuntu–they can count on.”

One thing that Ubuntu Linux users will also continue to rely on is the strong principled stance that Shuttleworth has on encryption. With the rapid growth of the Linux Foundation’s Let’s Encrypt free Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate platform this year, Shuttleworth noted that it’s a good idea to consider how that might work in an integrated way with Ubuntu.

Overall, he said, the move to encryption as a universal expectation is really important.”We don’t do encryption to hide things; we do encryption so we can choose what to share,” Shuttleworth said. “That’s a profound choice we should all be able to make.”Shuttleworth emphasized that on the encryption debate, Canonical and Ubuntu are crystal clear.”We will never backdoor Ubuntu; we will never weaken encryption,” he said.Watch the video interview with Mark Shuttleworth below:

Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.

www.eweek.com/enterprise-apps/slideshows/ubuntu-16.04-linux-debuts-with-support-until-2021.html

Source: eWeek

Canadian Web Hosting Joins Vancouver Internet Exchange

Canadian Web Hosting has announced that it has joined the Vancouver Internet Exchange (VANIX), a network neutral, independent exchange based in Vancouver that interconnects multiple IP networks including networks of ISPs, content delivery, and multiple leading networks like Canadian Web Hosting’s Canadian CloudStream Backbone Network.

Canadian Web Hosting continues to expand its base of operations and services in Vancouver and is increasingly focused on their goal of delivering the industry’s lowest latencies for customers on the west coast and across Canada. Today, VANIX is the second largest IX in Canada and with such a strong internet community, Canadian Web Hosting’s customers will continue to push for faster, more efficient internet paths to British Columbia’s businesses and residents.

By joining VANIX, Canadian Web Hosting continues to expand the availability of its recently launched CloudStream Canadian network backbone. With CloudStream, Canadian Web Hosting continues to deliver on its promise to maximize performance and network scalability, offering up to full gigabit ethernet connections for every server and device. In addition, Canadian Web Hosting has removed any potential of data moving onto the public internet, which in turn increases security, giving customers the reassurance that their network usage remains 100% Canadian. The network is designed to handle and move massive amounts of data for current and future services like cloud hosting, IoT, video, enterprise apps and virtual reality (VR) apps.

“As a leading service provider in infrastructure and cloud hosting services, we understand many of our new and existing customers’ pain points,” said Matt McKinney, chief strategy officer at Canadian Web Hosting. “With so many emerging technologies coming to the forefront that require low latency and high capacity network links, we believe that by joining VANIX our customers are well positioned for the next phase of application and IoT hosting and will be able to meet the most demanding requirements.”

Source: CloudStrategyMag

Qualcomm Is Bringing Deep Learning to Mobile Devices

The vendor’s  Neural Processing Engine SDK will run on smartphones and other devices powered by Qualcomm’s Snapdragon 820 SoCs.

Qualcomm wants to make mobile devices running its Snapdragon 820 processor even smarter.Company officials on May 2 introduced a deep-learning software development kit (SDK) for the ARM-based systems-on-a-chip (SoCs) that will enable device makers to run neural network models on their Snapdragon 820-powered products—including smartphones, security cameras, cars and drones—for such tasks as scene detection, text recognition, object avoidance, face and gesture recognition, and natural language processing.Other devices can do many of the same tasks, but what the Neural Processing Engine SDK will allow are those workloads to be processed without having to be connected to the cloud, according to Qualcomm officials. It’s based on Qualcomm’s Zeroth Machine Intelligence Platform, a software portfolio for machine learning on mobile devices and optimized for the Snapdragon SoC lineup. It’s being used in such Qualcomm software as Snapdragon Scene Detect for visual intelligence and Smart Protect advanced malware detection software.The Neural Processing Engine will help Qualcomm meet the growing demand for mobile experiences that are driven by machine learning and that is not linked to the Internet, according to Gary Brotman, director of product management at Qualcomm.

“With the introduction of the new Snapdragon Neural Processing Engine SDK, we are making it possible for myriad sectors, including mobile, IoT [Internet of things] and automotive to harnesses the power of Qualcomm Snapdragon 820 and make high-performance, power efficient on-device deep learning a reality,” Brotman said in a statement.

That includes on smartphones like Samsung’s Galaxy S7, HP Inc.’s Elite X3, LG Electronics’ G5 and Xiaomi’s Mi 5, but also any other mobile devices. Qualcomm, which is the world’s largest provider of processors to smartphones, is looking to expand its reach into an array of other markets, from automobiles to drones. The tablet market continues to contract, and global smartphone sales are going flat as worldwide markets become saturated. According to IDC analysts, the number of smartphones shipped globally in the first quarter was 334.9 million, up only a little over the 334.3 million shipped during the same period in 2015, the smallest year-over-year growth on record.With the Snapdragon 820, the company is looking to leverage its heterogeneous processing capabilities to gain traction in other growth markets. The SoC includes not only the ARM-based 64-bit Kyro CPU, but also Qualcomm’s Adreno GPU and Hexagon digital signal processor (DSP).Deep learning uses neural networks made up of multiple compute layers that are designed to enable systems to learn through experience and act on what they’ve learned rather than having to constantly be programmed what to do by humans. Most neural networks now are run on powerful server-based environments in data centers, but there is a push on to bring such capabilities to mobile devices. Earlier this year, researchers at the Massachusetts Institute of Technology (MIT) unveiled “Eyeriss,” a 168-core processor they said will enable smartphones and other mobile and embedded devices to run artificial intelligence (AI) algorithms locally, letting much of the work of collecting and processing data be done on the device itself.Qualcomm officials said enabling deep-learning capabilities on mobile devices will help organizations in a broad range of verticals, including automotive, security, health care and imaging. Through the new SDK, the companies will be able to run their own trained neural networks on mobile devices, they said.The vendor’s Snapdragon Neural Processing Engine SDK will be available in the second half of 2016. They initially will be available for the Snapdragon 820 SoCs, and will support such deep-learning frameworks as Caffe and CudaConvNet.
Source: eWeek