krw att.bizzzzzzzzzz> writes:

re:
http://www.garlic.com/~lynn/2008e.html#59 independent appraisers

Spy vs. Spy is somewhat implying that the attacks and countermeasures
are of equal difficulty with equal rewards.

In many of the situations the difficulty of the attacks dramatically
increases ... and the economic rewards for the attackers can start to
become less than the cost of the attacks ... resulting in the number of
vulnerability points that require further measures radically
decreases. in some cases the order of the problems drops from billions
to thousands to tens.

lots of posts mentioning threats, vulnerabilities, exploits, fraud, etc
http://www.garlic.com/~lynn/subintegrity.html#fraud

it is also somewhat the theme discussed in this old post
http://www.garlic.com/~lynn/aepay3.htm#riskm The Thread Between Risk Management and Information Security

also mentioned in this recent post
http://www.garlic.com/~lynn/2008e.html#65 Banks failing to manage IT risk - study

for additional topic drift on the theme, frequently mentioned in other
posts, in the mid-90s, the x9a10 financial standard working group had
been given the requirement to preserve the integrity of the financial
infrastructure for all retail payments ...the result was the x9.59
financial industry standard
http://www.garlic.com/~lynn/x959.html#x959

part of the effort was detailed, end-to-end threat and vulnerability
study. one of the vulnerabilities identified was skimming information
from transactions and using the information in a form of replay attacks
for fraudulent financial transactions. another threat/vulnerability
identified was data breaches and security breaches involving retained
logs of prior transactions (required by numerous business processes)
... again the crooks would use the information for a form of replay
attacks for fraudulent financial transactions. This two combined
represent the majority of the news items related to identity fraud.

The straight-forward solution was to continue to dramatically increase
the security and protection of all these points of vulnerability ...
which amounts to potentially hundreds of millions of points with
potentially billions of attackers. This is somewhat discussed in posts
on the theme of dealing with "naked transactions"
http://www.garlic.com/~lynn/subintegrity.html#payments

A common countermeasure has been to dramatically increase the use of
encryption technologies to deal with the threat. However, because of the
enormous numbers of places requiring access and use of the information,
we started making the claim that even if the planet was buried under
miles of information hiding encryption ... it still wouldn't eliminate
the information leakage (drastically increase in countermeasure costs
with diminishing protection).

the approach taken in the x9.59 financial transaction standard wasn't
attempting to eliminate all those points of leakage ... but to eliminate
the usefullness of the information to the crooks for performaing
fraudulent transactions (i.e. eliminate the replay attack
exploit). x9.59 does nothing to protect against skimming attacks or data
breaches and security breaches ... however, the x9.59 financial
transaction standard eliminates the usefullnes of any such information
obtained by the crooks for performing fraudulent transactions.

Sort of the idea was that the inclusion of such activity in identity
fraud statistics has been because the attackers can use the obtained
information to perform fraudulent financial transactions (or "account
fraud"). The x9.59 financial transaction standard did nothing to prevent
the tens of millions of obvious attack points ... it just eliminated
those kinds of attacks as a "real" vulnerability ... since the crooks
were no longer able to use the information for fraudulent purposes (aka
it has made the stealing of the information useless ... where currently
the stealing of the information is extremely worthwhile because it can
be used to perform fraudulent transactions).

the obvious knee-jerk reaction to the vulnerability has been ever
increasing cost of protecting the hundreds of millions of vulnerable
points. the x9.59 financial transaction standard approach was to
eliminate all those kinds of threats. There are still other ways that
crooks can perform fraudulent operations ... but x9.59 drastically
reduced the magnitude of what requires additional countermeasures (since
a whole category of attacks has been totally eliminated).