Brian Pennington

A blog about Cyber Security & Compliance



500 European Business Leaders attend the PCI Security Standards Council Community Meeting

This week business leaders and security professionals gathered in Nice, France to discuss payment based security and especially PCI DSS and P2Pe. 

Jeremy King PCI Security Standards Council International Director said, The new European Commission Payment Services Directive 2 along with the European Banking Authority Guidelines for Securing Internet Payments have clear and detailed requirements for organisations in protecting cardholder data. Add to that the soon to be released General Data Protection Regulation which covers all data security, and you have a massive increase in data security, which when implemented will impact all organisations in Europe and beyond, 

These regulations will force organisations to take security seriously, and PCI provides the most complete set of data security standards available globally. Establishing good data security takes time and effort. Organisations need to know these regulations are coming and put a plan in place now for ongoing security

With 70% of all card fraud coming from Card-Not-Present (CNP), a figure that surpasses the previous 2008 record which was set during the EMV chip migration, it is a critical time for the industry. 

A significant amount of the conference was spent on new and developing technologies including::

  • Cloud – Daniel Fritsche of Coalfire presented on Virtualisation and the Cloud
  • Mobile – several presentations including the Smart Payments Association
  • Point to Point Encryption (P2PE) – Andrew Barratt of Coalfire delivered a panel discussion
  • Tokenisation – A presentation by Lufthansa Systems 

Jeremy King added. PCI is committed to helping organisations globally improve their data security. Our range of standards, and especially our supporting documents, are designed to help all companies improve and protect their data security. The annual Community Meeting is a big part of our efforts to engage with companies from all sectors, sharing and exchanging information to ensure they have the very best level of security 

We must work together to tackle card-not-present fraud with technologies such as point-to-point encryption and tokenisation that devalue data and make it useless if stolen by criminals.

Attendees included experts from Accor Hotels, , British Telecommunications, Capita, Coalfire Systems Limited, Accor Hotels, Lufthansa, Virgin Trains, Vodat International and hundreds of others.

Cloud, Contactless, e-Commerce, Tokenization and surging forward

VISA Europe has issued it’s Annual Report for 2014

The headline numbers from 2014

  • Visa accounts 509m
  • Point-of-sale spending €1.417tr
  • Point-of-sale growth 8.7%
  • Clearing & settlement transactions processed €16.1bn

Visa Europe is a payments business. Our company is owned by some 3,078 banks and payment providers from 37 European countries. Together, we are making payments faster, more convenient and more secure than ever before

A highlight for 2014 was the surge in contactless

Across Europe, more than 100 million Visa cards are contactless, as are 1.8 million Visa terminals. Hundreds of big-name merchants are rolling-out contactless and annual transaction volumes exceeded 460 million which is 263% higher than the previous year and the value of those transactions is 283% higher than the previous year.

The very same terminals can be used for Visa contactless mobile payments – like Apple Pay and its Android smartphone equivalents. by Visa takes off across Europe by Visa is the new digital wallet solution from Visa Europe, which brings more speed and simplicity to online payments.

From its initial launch markets of France, Poland, Spain and the UK, by Visa will expand to Germany, Ireland, Italy, Norway and Sweden by the end of the 2015. Pilots will also be launched in the Czech Republic, Greece and Slovakia in 2015, taking the total number of countries offering the service to 12.

e-commerce spending continues to escalate

Today, e-commerce accounts for €1 in every €5.26 of spending on European Visa cards. This equates to 19% of our transaction volumes. Growth remains strong across all European countries.

Cloud-based payments

Visa’s Cloud-based Payments programme is now live for contactless payment services on Android smartphones. Members in ten markets are already bringing Visa Cloud-based Payment services to market, reporting a number of early successes, with further launches to be announced during 2015.

Tokenisation – our vision

Payment Tokenisation will act as a platform for innovation to help the development of scalable payment services via a variety of mobile technologies. Reducing the cost and complexity to deliver new and innovative services to cardholders will be a key benefit. Payment Tokens will also improve the security of digital payments.

The full report can be found here.

What you need to know about tokenization.

BluePay have produced a great graphic that provides a simple explanation of how Tokenization works.


The hospitality industry increases it’s adoption of Tokenization and P2Pe

The 2014 and 16th edition of the Hospitality Technology magazine Restaurant Technology Study has produced an 18 page report. 

Of specific interest to me was Chapter 5 Payment Security – “End of Swipe-and-Sign Looms”, the chapter states:-

The U.S. payment industry is in a period of transition. October 2015 will mark the end of swipe-and-sign. While card brands are committed to swapping mag-strip for EMV chip-based cards, the standard for authentication remains under debate: signature capture or PIN. While PIN authentication is considered the more secure option, there’s concern that Americans, who tend to have a variety of credit cards, would struggle to manage multiple PINs.

As the restaurant industry, and U.S. merchants at large, take a wait-and-see approach, HT (Hospitality Technology) measures the industry’s current and planned payment security practices in its 2014 Restaurant Technology Study.

The food service industry, with its fragmented technology, has historically been a target for card data theft. The sunset for swipe cards will be a welcome improvement. EMV preparedness is on restaurants’ radar, with 70% of those surveyed agreeing that it is important to have a well-defined roadmap for EMV preparedness.

When asked about their organization’s current approach to preparing for EMV

  • 26% report having some form of road-map in place; likely due to the lack of a standard
  • 37% will make this a priority in the year ahead.

What’s more, confusion with the current PCI DSS remains:-

  • 86% reporting that their organizations are “in compliance” but far fewer are able to identify compliance with some of the 12 specific requirements
  • 72% report that their organization maintains a policy that addresses information security for employees and contractors (item 12 of the PCI DSS).

With payment security an on going process and a moving target, restaurants are leveraging third parties for assistance. More than half of those surveyed outsource their PCI compliance efforts (54%), and nearly as many (52%) have purchased some form of breach protection or insurance.

Respondents were further asked about their organizations’ use of tokenization and point-to-point encryption (P2PE). Though not a requirement of PCI DSS, these technologies can reduce scope by shrinking the footprint where cardholder data is located throughout the organization.

  • 43% use P2PE and 33% plan to add the technology by 2016
  • 36% use Tokenization and an additional 30% have future implementation plans

The full report can be found here..    

Most European organizations believe using a European cloud is easier from a regulatory and compliance perspective

Perspecsys Infograph from research at InfoSec Europe Conference

A summary of the 2013 PCI SSC North America Community Meeting by Matt Getzelman

The most valuable technical information was presented during the ‘Assessors Only’ session on Tuesday afternoon.  The SSC covered the upcoming changes to the PCI DSS and PA-DSS standards.  There was an open Q&A session with excellent insight on the industry’s concerns and the SSC’s intent with many of the proposed changes.  Some of the key announcements and observations were:

  • ASV Changes – A lot of information was presented about upcoming changes to the Approved Scanning Vendor (ASV) baseline (which is currently in progress).  The SSC has created a task group to deal with the issue around “Scan Interference”.  The task force will deal with this issue and communicate clear expectations to the rest of the industry.  A number of “hints” were dropped with regard to web-based vulnerabilities and how they will play a bigger role in ASV scans (and the revised baseline) going forward.

  • PCI DSS 3.0 – Business as Usual – Clarifications on this new section within the 3.0 standard in the sense of no assessor validation or documentation will be required.  This is merely a section on implementation best practices for continuous PCI DSS compliance.

  • PCI DSS 3.0 – Template Changes – New to the 3.0 release, the SSC has created a reporting template that they would like all QSA organizations to use.  The reporting instructions had previously been outlined in a separate document.  They are now included within the standard itself.

  • PCI DSS 3.0 – Scope – The SSC made some significant improvements to its intent around PCI DSS scope of validation.  These clarifications were covered again during the assessor and general sessions.  Most importantly the following:  Systems that affect the security of the cardholder data environment should be considered as in-scope for the assessment.  During one of the Open Forum sessions, we asked if this would include A/V servers, patching servers, DNS systems, etc…and the SSC confirmed yes.  It’s important to note that they indicated that this will include originating web-servers for ecommerce outsourcing solutions. 

  • PCI DSS 3.0 – Phase-in Requirements – There are several new requirements that will be considered best practice only until June, 2015.  It’s important to review and analyze these new requirements now to prepare your organization for the upcoming impact to your compliance efforts.  Our favorite is the change to the penetration testing requirements:

Penetration testing must now validate segmentation technologies   

  • Avoid the Silver Bullet – We heard this phrase a lot during the SSC presentations and informal discussions with the card brands.  The SSC wants to dispel the myth that so many merchants seem to be falling prey to.  There is no such thing as a “Silver Bullet” solution that eliminates all PCI DSS scope and responsibility.

  • PA-DSS Template Changes – There was very little content presented on the upcoming changes to the PA-DSS.  We met several key SSC representatives that will allow us to provide direct feedback about the draft standard.  Coalfire has concerns and questions on two major areas in the new draft that we will clarify in the near future:

Hashing requirements for passwords – SDLC guidelines

  • PCI SSC Tokenization Standards – It seems surreal, but the SSC plans on releasing four tokenization standards in 2014. These standards will cover hashing strength and other considerations for using tokenization technologies to reduce scope.  These are not to be confused with the “Tokenization” guidelines recently announced by some card brands.

The original post by Matt Getzelman, PCI Practice Director, can be found here.

Who breached the Data Protection Act in the first half of 2013?

As we have passed the first half of 2013, I thought it would be a good time to publish the entire list of who fell foul of the UK Data Protection Act and were punished by the Information Commissioner (ICO).

There are three types of punishments administered by the ICO

  1. Monetary. The most serious of the actions and one normally reserved for organisational entities.
  2. Undertaking. Typically applied when an organisation has failed to adhere to good business practice and needs the helping guidance of the ICO
  3. Prosecutions. Normally reserved for individuals who have blatantly breached the Act.

Monetary penalty notices

A monetary penalty will only be served in the most serious situations. When deciding the size of a monetary penalty, the ICO takes into account the seriousness of the breach and other factors like the size, financial and other resources of an organisation’s data controller. The ICO can impose a penalty of up to £500,000. It is worth noting that monetary penalties are paid to HM Treasury and not to the ICO. Many argue that the ICO would be a stronger body if it had more money and penalties is a good way to generate more revenue – a self funding government department.

  • 12 July 2013 NHS Surrey. A monetary penalty notice has been served on NHS Surrey following the discovery of sensitive personal data belonging to thousands of patients on hard drives sold on an online auction site. Whilst NHS Surrey has now been dissolved outstanding issues are now being dealt with by the Department of Health.
  • 8 July 2013 Tameside Energy Services Ltd. A monetary penalty notice has been served to Tameside Energy Services Ltd after the Manchester based company blighted the public with unwanted marketing calls.
  • 18 June 2013 Nationwide Energy Services and We Claim You Gain. Monetary penalty notices have been served to Nationwide Energy Services and We Claim You Gain – both companies are part of Save Britain Money Ltd based in Swansea. The penalties were issued after the companies were found to be responsible for over 2,700 complaints to the Telephone Preference Service or reports to the ICO using its online survey, between 26 May 2011 and end of December 2012.
  • 13 June 2013 North Staffordshire Combined Healthcare NHS Trust. A monetary penalty notice has been served to North Staffordshire Combined Healthcare NHS Trust, after several faxes containing sensitive personal data were sent to a member of the public in error.
  • 7 June 2013 Glasgow City Council. A monetary penalty notice has been served to Glasgow City Council, following the loss of two unencrypted laptops, one of which contained the personal information of 20,143 people.
  • 5 June 2013 Halton Borough Council. A monetary penalty notice has been served to Halton Borough Council, in respect of an incident in which the home address of adoptive parents was wrongly disclosed to the birth family.
  • 3 June 2013 Stockport Primary Care Trust. A monetary penalty has been served to Stockport Primary Care Trust following the discovery of a large number of patient records at a site formerly owned by the Trust.
  • 20 March 2013 DM Design Bedroom Ltd. A monetary penalty has been served to DM Design Bedroom Ltd. The company has been the subject of nearly 2,000 complaints to the ICO and the Telephone Preference Service. The company consistently failed to check whether individuals had opted out of receiving marketing calls and responded to just a handful of the complaints received.
  • 15 February 2013 Nursing and Midwifery Council. A monetary penalty has been served to the Nursing and Midwifery Council. The council lost three DVDs related to a nurse’s misconduct hearing, which contained confidential personal information and evidence from two vulnerable children. An ICO investigation found the information was not encrypted.
  • 24 January 2013 Sony Computer Entertainment Europe Limited. A monetary penalty has been served to the entertainment company Sony Computer Entertainment Europe Limited following a serious breach of the Data Protection Act. The penalty comes after the Sony PlayStation Network Platform was hacked in April 2011, compromising the personal information of millions of customers, including their names, addresses, email addresses, dates of birth and account passwords. Customers’ payment card details were also at risk. They failed in their bid to appeal.


Undertakings are formal agreements between an organisation and the ICO to undertake certain actions to avoid future breaches of the Data Protection Act, typically this involves, Encryption, Training and Management Procedures.

  • 16 July 2013 Janet Thomas. An undertaking to comply with the seventh data protection principle has been signed by Janet Thomas. This follows a report made by a member of the public that approximately 7,435 CV files, containing personal data, were being stored unprotected on the website
  • 9 July 2013 Health & Care Professions Council (HCPC). An undertaking to comply with the seventh data protection principle has been signed by the Health & Care Professions Council (HCPC) after an incident in which papers containing personal data were stolen on a train in 2011.
  • 12 June 2013 (issued 10 September 2012) Bedford Borough Council. An undertaking to comply with the seventh data protection principle has been signed by Bedford Borough Council relating to the removal of legacy data from a social care database.
  • 2 June 2013 (issued 18 September 2012) Central Bedfordshire Council. An undertaking to comply with the seventh data protection principle has been signed by Central Bedfordshire Council relating to the removal of legacy data from a social care database and in relation to the preparation of planning application documentation for publication.
  • 31 May 2013 Leeds City Council. A follow up has been completed to provide an assurance that Leeds City Council has appropriately addressed the actions agreed in its undertaking signed November 2012.
  • May Prospect. A follow up has been completed to provide an assurance that Prospect has appropriately addressed the actions agreed in its undertaking signed January 2013.
  • 21 May 2013 (issued 9 November 2011) News Group Newspapers. An undertaking to comply with the seventh data protection principle has been signed by News Group Newspapers, following an attack on the website of The Sun newspaper in 2011.
  • 26 April 2013 The Burnett Practice. An undertaking to comply with the seventh data protection principle has been signed by The Burnett Practice. This follows an investigation whereby an email account used by the practice had been subject to a third party attack. The email account subject to the attack was used to provide test results to patients and included a list of names and email addresses.
  • 4 April 2013 East Riding of Yorkshire Council. An undertaking to comply with the seventh data protection principle has been signed by the East Riding of Yorkshire Council, following incidents last year in which personal data was inappropriately disclosed.
  • 25 January 2013 Mansfield District Council. An undertaking to comply with the seventh data protection principle has been signed by the Managing Director of Mansfield District Council. This follows a number of incidents where personal data of housing benefit claimants was disclosed to the wrong landlord.
  • 16 January 2013 Prospect. An undertaking to comply with the seventh data protection principle has been signed by the union Prospect. This follows an incident in which two files containing personal details of approximately 19,000 members of the union had been sent to an unknown third party email address in error.


  • 23 May 2013 A former manager of a health service based at a council-run leisure centre in Southampton has been prosecuted under section 55 of the Data Protection Act for unlawfully obtaining sensitive medical information relating to over 2,000 people.
  • 8 April 2013 A Hertfordshire estate agent has been prosecuted under section 17 of the Data Protection Act after failing to notify with the ICO.
  • 12 March 2013 A former receptionist at a GP surgery in Southampton has been prosecuted under section 55 of the Data Protection Act for unlawfully obtaining sensitive medical information relating to her ex-husband’s new wife.

Also read

An overview of EU security legislation and the impact of cyber incident reporting

The European Network and Information Security Agency (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens.

ENISA has responded to the growing threat posed by cyber security incidents by producing an overview paper of current legislation and the impact of incident reporting.

I have summarised the ENISA paper below.

ENISA started the paper by quoting five recent incidents to support their findings and conclusions:-

  1. In June 2012 6.5 million (SHA-1) hashed passwords of a large business-focussed social network appeared on public hacker forums. The impact of the breach is not fully known, but millions of users were urged to change their passwords and their personal data could be at risk.
  2. In December 2011, the storm Dagmar affected power supplies to electronic communication networks in Norway, Sweden and Finland. As a result millions of users were without telephony or internet for up to two weeks.
  3. In October 2011 there was a failure in the UK datacentre of a large smartphone vendor. As a result millions of users across the EU and globally could not send or receive emails, which severely affected the financial sector.
  4. Over the summer 2011, a Dutch certificate authority experienced a security breach, allowing attackers to generate fake PKI certificates. The fake certificates, the result of the breach, were used to wiretap the online communications of around half a million Iranian citizens. Following the breach many Dutch e-government websites were offline or declared unsafe to visit.
  5. In April 2010 a Chinese telecom provider hijacked 15% of the world’s internet traffic through Chinese servers for 20 minutes, routing traffic to some large e-commerce sites, such as and as well as the .mil and .gov domains, et cetera. As a result, the internet communications of millions of users were exposed (to eavesdropping).

The five quoted incidents are just the tip of the iceberg, as you will find out later in the post, but to give an insight into UK breaches read my post on who the UK’s Information Commissioner has caught this year for breaching the current Data Protection Act here.

Article 13a of the Framework directive: “Security and Integrity”

The Telecoms reform passed into law in 2009, adds Article 13a to the Framework directive, regarding security and integrity of public electronic communication networks and services. Article 13a states:

  • Providers of public communication networks and services should take measures to guarantee security and integrity (i.e. availability) of their networks.
  • Providers must report to competent national authorities about significant security breaches.
  • National authorities should inform ENISA and authorities abroad when necessary, for example in case of incidents with impact across borders.
  • National authorities should report to ENISA and the European Commission (EC) about the incident reports annually.

Article 13a also says that the EC may issue more detailed implementation requirements if needed, taking into account ENISA’s opinion.

The EC, ENISA, and the national regulators have been collaborating for the past 2 years to implement Article 13a and to agree on a single set of security measures for the European electronic communications sector and a modality for reporting about security breaches in the electronic communications sector to authorities abroad, to ENISA and the EC.

In May 2012 ENISA received the first set of annual reports from Member States, concerning incident that occurred in 2011. ENISA received 51 incident reports about large incidents, which exceeded an agreed impact threshold. The reports describe services affected, number of users affected, duration, root causes, actions taken and lessons learnt. While nationally incident reporting is implemented differently, with different procedures, thresholds, et cetera, nearly all national regulators use a common procedure, a common template and common thresholds for reporting to the EC and ENISA.

Article 4 of the e-Privacy directive: “Security of processing”

The Telecoms reform also changed the e-Privacy Directive, which addresses data protection and privacy related to the provision of public electronic communication networks or services. Article 4 of the e-Privacy directive requires providers to notify personal data breaches to the competent authority and subscribers concerned, without undue delay.

The obligations for providers are:

  • to take appropriate technical and organisational measures to ensure security of services,
  • to notify personal data breaches to the competent national authority,
  • to notify data breaches to the subscribers or individuals concerned, when the personal data breach is likely to adversely affect their privacy
  • to keep an inventory of personal data breaches, including the facts surrounding the breaches, the impact and the remedial actions taken.

Article 4 also says that the EC may issue technical implementing measures regarding the notification formats and procedures, in consultation with the Article 29 Working Party, the European Data Protection Supervisor (EDPS) and ENISA.

Articles 30, 31 and 32 of the Data Protection regulation

The EC has proposed to reform the current European data protection framework (Directive 95/46/EC), and has proposed an EU regulation on data protection. The regulation regards organisations that are processing personal data, regardless of the business sector the organisation is in. Security measures and personal data breach notifications are addressed in Articles 30, 31 and 32:

  • Organisations processing personal data must take appropriate technical and organisational security measures to ensure security appropriate to the risks presented by the processing.
  • For all business sectors the obligation to notify personal data breaches becomes mandatory.
  • Personal data breaches must be notified to a competent national authority without undue delay and, where feasible, within 24 hours, or else a justification should be provided.

Personal data breaches must be notified to individuals if it is likely there will be an impact on their privacy. If the breached data was unintelligible, notification is not required, e.g. Tokenised data.

Read my summary of the proposed New EU Data Protection Act here.

Article 15 of the e-Sig and e-ID regulation: “Security requirements”

The EC recently released a proposal for a regulation on electronic identification and trust services for electronic transactions in the internal market. Article 15 in this proposal introduces obligations concerning security measures and incident reporting:

  • Trust service providers must implement appropriate technical and organisational measures for the security of their activities.
  • Trust service providers must notify competent supervisory bodies and other relevant authorities of any security breaches and where appropriate, national supervisory bodies must inform supervisory bodies in other EU countries and ENISA about security breaches.
  • The supervisory body may, directly or via the service provider concerned, inform the public.
  • The supervisory body sends a summary of breaches to ENISA and the EC.

EU Cyber Security Strategy

The European Commission is developing a European Cyber Security Strategy. The roadmap for the strategy refers to Article 13a and mentions extending Article 13a to other business sectors. The Commission has indicated that there will be five main strands:

  • Capabilities and response networks, for sharing information with public and private sector
  • Governance structure including the national competent authorities, to address incidents and develop an EU contingency plan.
  • Incident reporting for critical sectors like energy, water, finance and transport.
  • Pre-commercial procurement of security technology and public-private partnerships to improve security across the single market
  • Global cooperation, to address global interdependencies and the global supply chain.

A European Cyber Security Strategy is an important step to increase transparency about incidents, and ultimately to prevent them or limit their impact.

ENISA’s Review

Security measures and incident reporting, implemented across the EU’s digital society, are important to improve overall security. EU legislation plays an important role here as it allows harmonization across the EU member states. This in turn prevents weak links and unnecessary costs for providers operating cross-border.

The European Commission, in collaboration with the EU Member States, has undertaken a number of legislative initiatives aiming to further improve transparency about incidents. Another important step is the proposed Cyber Security Strategy, which emphasizes incident reporting and the importance of exchange across the EU about incidents and how to address them. We conclude with some general remarks.

Regulatory gaps: In the introduction we gave five examples of cyber incidents with a severe impact on the security or privacy of electronic communications. The 2nd incident, caused by the Dagmar storm, is in scope of existing incident reporting legislation and as such reported to authorities. The proposed regulation on electronic trust providers would also cover the 4th incident. But the remaining incidents (the 1st, 3rd, and 5th) are not clearly in scope or subject of debate between providers and the national regulator.

It is important that national authorities and the EC discuss, agree, and clarify the scope of legislation on electronic communications and address these and other gaps. This can be done without necessarily changing the text of existing legislation, such as the telecom regulatory framework, but rather the interpretation of what the services are, because the landscape of electronic communications is continuously changing (from landline telephones and minitel in the past, to mobile phones, internet and VoIP).

Model security articles: There is a lot of similarity between Article 13a of the Framework directive and Article 15 of the e-Signatures and e-Identities regulation. The former has been taken as a model for drafting the latter. Both articles combine security measures and incident reporting, at a national level and at an EU level. Consistency and standardization in the legislative texts allows for more easy governance by the member states, and more easy implementation by the providers. Furthermore, the combination of national reporting and EU reporting (present in both Article 13a and Article 15) allows national authorities room to adjust to national circumstances, while at the same time providing overview and feedback at an EU level, which allows Member States to optimize implementation and to ensure a harmonized approach across EU member states.

Governing security measures: Mandatory breach reporting receives a lot of media attention and it is arguably the most visible part of the security articles. The ultimate goal is to limit the impact of security and personal data breaches or prevent them altogether by making sure appropriate security measures are taken. This type of governance is crucial and not easy. In security much depends on the technical details of the implementation and these details are hard to capture in (high-level) legislation and subject to change.

National authorities should exchange knowledge about an effective and efficient combination of high-level legal obligations and technical implementation requirements. For the latter it is important to adopt a bottom up approach (i.e. commonly agreed recommendations), taking into account the (changing) state of the art and the practical experiences of regulators and experts from the private sector.

As a second, but related point, the need to take “appropriate technical and organisational security measures” is mentioned in all the security articles. Although these articles are aimed at different providers and different types of breaches, there is still a large overlap between the security measures that have to be taken. The competent national authorities should collaborate (nationally and at an EU level) to ensure that these security measures are implemented consistently and where there is an overlap, similarly, to allow providers to comply more easily, and to allow equipment vendors to adapt their products accordingly.

Optimizing incident reporting procedures:

  • Incident response versus incident reporting: To prevent incidents from escalating Member states should encourage providers to quickly contact technical experts, incident response teams (like national CERTs), crisis coordination groups, and other organizations relevant in the response phase, should this be necessary. Member states should underline that incident response receives priority. The purpose of mandatory incident reporting to national authorities is supervision over whether or not providers comply with legal requirements, while the purpose of information exchange in the response phase, for example with a national CERT, is to tackle the incident. Member states should encourage transparency and trusted information sharing in the response phase and ensure that response processes are independent and not slowed down by legal reporting requirements. Member states should for instance ensure that incident reporting procedures are easy and quick to apply.
  • Exchange and sharing: Over the past years CERTs have developed effective platforms for collaboration and information exchange. Beyond the response phase, however, there is still little exchange of information about breaches between different national authorities. The EC should continue to support the working groups and platforms for exchanging information between national authorities, about breaches, about lessons learnt and best practices.
  • Granularity and tools: An important aspect of the evaluation of existing legislation on incident reporting should be an analysis of costs and benefits. Both for national and EU level reporting it is important to review over time the thresholds for reporting, the type of information that is reported, the level of detail, and so on. If too few incidents are reported, then it will be difficult to draw meaningful conclusions about common root causes or trends. This would defeat the purpose of the legislation altogether and make the legislation cost ineffective. National authorities should analyse what is a good balance, taking into account the costs and benefits for providers as well as the national authorities. Providers and national authorities should investigate automated tools and computer interfaces to allow for cost-effective incident reporting at a sufficient level of detail, while avoiding the burden of manual and ad-hoc reporting procedures. For example, one could distinguish between small and large incidents and use less reporting detail for the (many) smaller incidents.

ENISA Conslusion

ENISA would like to remark that in recent years a lot of progress has been made, in terms of addressing incidents and increasing transparency about incidents. The national authorities, for example, recently submitted to ENISA and the EC, the first Article 13a incident reports regarding severe incidents that occurred in 2011. The vast majority of national authorities use a single set of security measures and a common reporting template allowing for efficient collection and analysis. ENISA will publish an analysis of the 51 severe incidents in September 2012. From next year, every spring ENISA will collect annual incident reports and publish an analysis of the incidents of the previous year. For example, next spring 2013 ENISA will publish an analysis of the 2012 incidents.

ENISA looks forward to continuing our work with national authorities and the European Commission to support an efficient and effective implementation of Article 13a, Article 4, and the other security articles across the single digital market, and to support collaboration and information exchange between national authorities across the EU, to improve security across the EU’s digital society.

Find the ENISA press release here.


Fraud could be costing UK hotels over £2 billion a year

Credit cardPKF (UK) LLP and the Centre for Counter Fraud Studies at University of Portsmouth (CCFS) have produced a document titled, “the resilience to fraud of the UK hotel sector”.

The document was based upon a series of questions to hotels with the results shown both statistically and graphically.

The survey was supported by HOSPA, the Hospitality Professionals Association, formerly BAHA.

Report Background

There are just over 46,000 hotels and guest houses in the UK, and the hotel industry is a significant sector of the economy, with an annual turnover of around £40 billion. Applying figures derived from the latest global research showing that an average of 5.7% of expenditure is lost to fraud and error, such losses could cost the hotels’ sector more than £2 billion a year.

Each time the Government’s national fraud Authority make their annual estimate, the figures rise as the estimation improves, and it is already likely that the £1.9 billion losses estimated for the travel, leisure and transportation sectors in January 2011 will be superseded in January 2012. It is a serious issue for companies operating within the sector and one that has far reaching consequences for the health and financial stability of our industry, as well as the quality and price of the service that consumers enjoy.

 Across the UK economy as a whole, the Government’s National Fraud Authority estimates that £38.4 billion is lost to fraud, with £1.9 billion of the losses relating to the leisure, travel and transportation sectors

A summary of the survey results is below:-

Hotel companies performed best in the following areas:

  • 88% of respondents indicated that they had adopted a ‘zero tolerance’ approach
  • 85% indicated that they had arrangements in place to ensure that suspected frauds were promptly reported
  • 85% also indicated that they considered applying all types of sanctions where fraud was found to be present
  • Over 76% had a clear policy on the application of sanctions
  • 69% had reports concerning fraud discussed at board level
  • 89% of respondents indicated that they had adopted a ‘zero tolerance’ approach

Hotel companies performed worst in the following areas:

  • Only 30% sought to estimate the cost of fraud or used losses estimates to make judgements about how much to invest in countering fraud
  • Only 23% reviewed the effectiveness of counter fraud work
  • 35% ensured that counter fraud staff regularly refreshed their skills
  • 88% stated that they had a zero-tolerance approach but only 38% monitored the development of anti-fraud cultures (potentially a worrying contrast between rhetoric and reality)
  • Less than 40% deployed analytical intelligence techniques to detect fraud
  • 27% sought to estimate the cost of fraud or used losses estimates to make judgements about how much to invest in countering fraud

Jim Gee, director of Counter Fraud Services at PKF, chair of the Centre of Counter Fraud Studies at University of Portsmouth and co-author of the report, said that

“hopefully the loss of £2b to the industry through fraud was large enough to grab the attention of hotel bosses at a time when the sector was facing an increasingly challenging operating environment.” 

“The good news is that these losses can be reduced,” he said. “Research shows that fraud can be cut by up to 40% within 12 months. Hoteliers need to be proactive in their approach to tackling fraud – responding and reacting to individual incidents is not enough. To successfully minimise fraud, organisations need to take steps to change human behaviour and to remove opportunities for fraudsters.

Find the full report here.

Also see 77% of Hospitality Sector Mistakenly Believe They Are PCI Compliant.

Eight Ways to Reduce PCI DSS Audit Scope by Tokenizing Cardholder Data

Credit card
Image via Wikipedia

Eight Ways to Reduce PCI DSS Audit Scope by Tokenizing Cardholder Data

Merchants are constantly seeking ways to simplify and reduce the scope of the Payment Card Industry’s Data Security Standard (PCI DSS) compliance by shrinking the footprint where cardholder data is located throughout their organization.

By reducing the scope, these Merchants can dramatically lower the cost and anxiety of PCI DSS compliance and significantly increase the chance of compliance be that an audit or a Self Assessment Questionnaire (SAQ).

The White Paper “Eight Ways to Reduce PCI DSS Audit Scope by Tokenizing Cardholder Data” explores the use of tokenization as a best practice in improving the security of credit card transactions, while at the same time minimising the cost and complexity of PCI DSS compliance by reducing audit scope.

The 8 Ways are

  1. Centralized data vault
  2. Tokens as data surrogates
  3. Tokens as surrogates for masked data
  4. No mathematical relationship between tokens and data values
  5. One-to-one or one-to-many token/data relationships
  6. Format Preserving Tokenization™
  7. Centralized key management
  8. Tokenization as a Service™ (TaaS)

For the full description of the 8 methods simply download the white paper here

Registration is required, some personal email accounts do not work e.g. Hotmail and Gmail. If you are having a problem please leave a comment and I will try to email the paper directly to you.

Also see a Free eBook  “Tokenization for Dummies” here.


Blog at

Up ↑

%d bloggers like this: