Feeds

18th Century warfare to fight Internet crackers

Electronic Citadel

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

The Software & Information Industry Association (SIIA) calls for a fresh approach to protect credit card details from Internet crackers.

According to the SIIA, many businesses today implement an 'eggshell' security model: hard on the outside and soft in the centre. The problem is that there is often little or nothing to prevent hackers from accessing sensitive customer records - once they breach firewall defences.

A technology working group of the SIIA's ebusiness division has come up with an concept called the Electronic Citadel. Sensitive data is encrypted so that it can be validated at any time in the future but the original information may only be recovered during a defined period of time. This is described as the final barrier to protect sensitive data when other defences have been breached.

Many of the ideas in the approach are taken from the builders of military fortifications in the 1800s, the SIAA claims, in a metaphorical flight of fancy.

These builders knew that the most effective defence from intruders was to layer barriers to weaken and stop attackers, while constructing a stone fortress at the heart of the citadel, as a final obstacle to a would-be attacker.

Applying the ideas used to defend against musket-bearing armies to fight off attacks from s'kiddies is an interesting concept and it'll be intriguing to see whether a practical security model is developed, or it remains a footnote in security literature.

The Electronic Citadel method is very much in draft stage, even though many of the cryptographic techniques it applies are well-established.

A white paper on the subject: An Electronic Citadel: A Method for Securing Credit Card and Private Consumer Data in e-Business Sites, which focuses on the architecture, processes and benefits of the citadel method of protecting consumer data, is available for free download from here.

The paper, which has been placed in the public domain with the hope that developers will take up its ideas, was written by Tom Arnold, chief technology officer of CyberSource Corporation and chair of the technology working group of the SIIA ebusiness Division. He was motivated to write about the subject after his own credit card details were obtained from an ecommerce site's database.

The SIAA represents 1,000 software firms. ®

Related Stories

Russian Mafia uses NT flaws to raid Internet banks
Amazon division hacked, thousands of CCs exposed
Online Fraud Museum details CC hacking techniques

Related Links

Electronic Citadel white paper
Combating online fraud in the UK white paper from CyverSource

Beginner's guide to SSL certificates

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.