<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: trader]]></title>
    <link>http://securityratty.com/tag/trader</link>
    <description></description>
    <pubDate>Tue, 19 Feb 2008 21:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Stop Me if This Sounds Familiar]]></title>
      <link>http://securityratty.com/article/07468c09eca48cc8bfe532a83b3d394a</link>
      <guid>http://securityratty.com/article/07468c09eca48cc8bfe532a83b3d394a</guid>
      <description><![CDATA[My favorite book from last year was Charlie Munger's &quot;Poor Charlie's Almanack&quot; , there are so many fascinating parts in the book I can't go into them all here. Charlie Munger is Warren Buffett's...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.poorcharliesalmanack.com/index.html" style="float: left;"><img alt="Cover3rd" class="at-xid-6a00d83451c75869e2010535d3d4a3970c " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e2010535d3d4a3970c-120wi" style="margin: 0px 5px 5px 0px;" /></a>
 My favorite book from last year was Charlie Munger&#39;s <a href="http://www.poorcharliesalmanack.com/index.html">&quot;Poor Charlie&#39;s Almanack&quot;</a>, there are so many fascinating parts in the book I can&#39;t go into them all here. Charlie Munger is Warren Buffett&#39;s partner at Berkshire Hathaway, the book is a collection of a number of his speeches, and serves as a great backdrop for today&#39;s events, an &#0160;investing education, and a way to think through complex problems (&quot;invert! always invert!&quot;). It goes without saying that I think you should buy this book.&#0160;</p><br /><div>Chapter Three is a collection of Munger&#39;s unscripted remarks at Berkshire Hathaway and Wesco annual meetings. The below sections were transcribed by <a href="http://www.tilsonfunds.com/">Whitney Tilson</a>, &#0160;from annual meetings around the 2003-4 time period, and are pretty interesting given our current financial predicament.</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-weight: bold; ">Warnings About Financial Institutions and Derivatives</span></p><p><span style="font-weight: bold; ">Risks of Financial Institutions</span><br />The nature of a financial institution is that there are a lot of ways to go to hell in a bucket. You can push credit too far, do a dumb acquisition, leverage yourself excessively---its not just derivatives [that can bring about your downfall].</p><p>Maybe it&#39;s unique to us, but we&#39;re quite sensitive to financial risks. Financial institutions make us nervous when they&#39;re trying to do well.</p><p>We&#39;re exceptionally goosey of leveraged financial institutions. If they start talking about how good their risk management is, it makes us nervous.</p><p>We fret way earlier than other people. We&#39;ve left a lot of money on the table through early fretting. It&#39;s the way we are -- you&#39;ll just have to live with it.</p><p><span style="font-weight: bold; ">Derivatives</span><br />The system is almost insanely irresponsible. and what people think are fixes aren&#39;t realy fixes. It&#39;s so complicated I can&#39;t do it justice here - but you can&#39;t believe the trillions of dollars involved. You can&#39;t believe the complexity. You can&#39;t believe how difficult it is to do the accounting. You can&#39;t believe how big the incentives are to have wishful thinking about values and wishful thinking about ability to clear.</p><p>People don&#39;t think about the consequences of the consequences. People start by trying to hedge against interest rate changes, which is very difficult and complicated. Then, the hedges make the [reported profits] lumpy. So they use the new derivatives to smooth this. Well, now you&#39;ve morphed into lying. This turns into a Mad Hatter&#39;s Tea Party. This happens to vast, sophisticated corporations.</p><p>Somebody has to step in and say, &quot;We&#39;re not going to do it - it&#39;s just too hard.&quot;</p><p>I think a good litmus test of the mental and moral quality at any large institutions [with significant derivative exposure] would be to ask them, &quot;Do you really understand your derivatives book?&quot; Anyone who says yes is either crazy or lying.</p><p>It&#39;s easy to see [the dangers] when you talk about [what happened with] the energy derivatives - they went kerflooey. When [the companies] reached for the assets that were on their books, the money wasn&#39;t there. When it comes to financial assets, we haven&#39;t had any such denouement and the accountings hasn&#39;t changed so the denouement is ahead of us.</p><p>Derivatives are full of clauses that say if one party&#39;s credit gets downgraded then it has to put up collateral. It&#39;s like margin - you can go broke [just putting up more margin]. In an attempt to protect themselves, they&#39;ve introduced instability. Nobody seems to recognize what a disaster of a system they&#39;ve created. It&#39;s a demented system.&#0160;</p><p>In engineering people have a big margin of safety. But in the financial world, people don&#39;t give a damn about safety. They let it balloon and balloon and balloon. It&#39;s aided by false accounting. I&#39;m more pessimistic about this than Warren is.</p><p><span style="font-weight: bold; ">Accounting for Derivatives</span><br />I hate with a passion GAAP [Generally Accepted Accounting Principles] as applied to derivatives and swaps. JP Morgan sold out to this type of accounting to front-end revenues. I think it&#39;s a disgrace.</p><p>It&#39;s bonkers, and the accountants sold out. Everyone caved, adopted loose [accounting] standards, and created exotic derivatives linked to theoretical models. As a result, all kinds of earnings, blessed by accountants, are not really being earned. When you reach for the money, it melts away. It was never there.</p><p>It [accounting for derivatives] is just disgusting. It is a sewer, and if I&#39;m right, there will be hell to pay in due course. All of you will have to prepare to deal with a blowup of derivative books.</p><p><span style="font-weight: bold; ">Likelihood of a Derivatives Blowup</span><br />We tried to sell Gen Re&#39;s derivatives operations and couldn&#39;t, so we started liquidating it. We had to take big markdowns. I would confidently predict that most of the derivatives books of [this country&#39;s] major banks cannot be liquidated for anything like what they&#39;re carried on the books at. When the denouement will happen and how severe it will be, I don&#39;t know. But I fear the consequences could be fearsome. I think there are major problems, worse than in the energy field, and look at the destruction there.</p><p>I&#39;ll be amazed if we don&#39;t have some kind of significant [derivatives-related] blowup in the next five to ten years.</p><p>I think we&#39;re he only big corporation in America to be running off its derivative book.</p><p>It&#39;s a crazy idea for people who are already rich - &#0160;like Berkshire - to be in this business. It&#39;s a crazy business for big banks to be in.</p><p>Yo would be disgusted if you had a fair mind and spent a month really delving into a big derivative operation. You would think it was Lewis Carroll. You would think it was the Mad Hatter&#39;s Tea Party. And the false precision of these people is just unbelievable. They make the worst economics professors look like gods. Moreover, there is depravity augmenting the folly. Read the book F.I.A.S.C.O., by law professor and former derivative trader Frank Partnoy, an insider account of the depravity of derivative trading at one of the biggest and best-regarded Wall Street firms. This book will turn your stomach.</p></blockquote><br /><div>These are very blunt warnings from a legendary investor over many years, yet no one listened. It does explain why it is so hard for Infosec to make its case for building margins of safety into the system.</div><br /><br /><br />]]></content:encoded>
      <pubDate>Sun, 02 Nov 2008 19:30:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/derivatives book">derivatives book</category>
      <category domain="http://securityratty.com/tag/book">book</category>
      <category domain="http://securityratty.com/tag/derivatives">derivatives</category>
      <category domain="http://securityratty.com/tag/derivative books">derivative books</category>
      <category domain="http://securityratty.com/tag/books">books</category>
      <category domain="http://securityratty.com/tag/derivatives blowup">derivatives blowup</category>
      <category domain="http://securityratty.com/tag/derivatives operations">derivatives operations</category>
      <category domain="http://securityratty.com/tag/blowup">blowup</category>
      <category domain="http://securityratty.com/tag/favorite book">favorite book</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/stop-me-if-this-sounds-familiar.html">Stop Me if This Sounds Familiar</source>
    </item>
    <item>
      <title><![CDATA[Links for 2008-09-04 [del.icio.us]]]></title>
      <link>http://securityratty.com/article/9019871ff67c04e54d56a31faa30c5ca</link>
      <guid>http://securityratty.com/article/9019871ff67c04e54d56a31faa30c5ca</guid>
      <description><![CDATA[Tech Trader Daily - Barrons Online : Secure Computing Buys Securify; VCs Take A Hit Maybe the most interesting thing about this deal is that Securify is selling out for far less than the amount of...]]></description>
      <content:encoded><![CDATA[<ul>
<li><a href="http://blogs.barrons.com/techtraderdaily/2008/09/03/secure-computing-buys-securify-vcs-take-a-hit/">Tech Trader Daily - Barron&rsquo;s Online : Secure Computing Buys Securify; VCs Take A Hit</a><br/>
Maybe the most interesting thing about this deal is that Securify is selling out for far less than the amount of venture capital it raised.</li>
</ul><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/383881115" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tech trader daily">tech trader daily</category>
      <category domain="http://securityratty.com/tag/barrons online">barrons online</category>
      <category domain="http://securityratty.com/tag/venture capital">venture capital</category>
      <category domain="http://securityratty.com/tag/secure">secure</category>
      <category domain="http://securityratty.com/tag/hit">hit</category>
      <category domain="http://securityratty.com/tag/deal">deal</category>
      <category domain="http://securityratty.com/tag/amount">amount</category>
      <category domain="http://securityratty.com/tag/vcs">vcs</category>
      <category domain="http://securityratty.com/tag/buys">buys</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/383881115/anton18">Links for 2008-09-04 [del.icio.us]</source>
    </item>
    <item>
      <title><![CDATA[Are Stolen Credit Card Details Getting Cheaper?]]></title>
      <link>http://securityratty.com/article/a67e13e215d163e122340bffab059502</link>
      <guid>http://securityratty.com/article/a67e13e215d163e122340bffab059502</guid>
      <description><![CDATA[What is shaping the prices of stolen credit card details? The investments the cybercriminals or real life scammers ( through credit card cloning or ATM skimming ) put into the process of obtaining the...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp3.blogger.com/_wICHhTiQmrA/SHzyYjwnXTI/AAAAAAAAB6c/9rHV8A0Ggz4/s1600-h/ccz.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SHzyYjwnXTI/AAAAAAAAB6c/WQG5_Cal0xY/s200-R/ccz.JPG" style="border: 0pt none ;" /></a>What is shaping the prices of stolen credit card details? The investments the cybercriminals or real life scammers ( through <a href="http://ddanchev.blogspot.com/2007/02/credit-card-data-cloning-tactic.html">credit card cloning</a> or <a href="http://www.snopes.com/fraud/atm/atmcamera.asp">ATM skimming</a>) put into the process of obtaining the details, or can we even talk about investments being made where an experienced scammer has just purchased 1GB of raw credit cards data from a novice botnet master who isn't really aware of the actual value of his "botnet output"?<br />
<br />
Depends on which economic theory you believe in, or whether or not you'll take the "bottom-up approach" or the "top-down" one. And since I'm not aware of the existence of "the invisible hand of the underground market" and centralized power to increase the supply or decrease it to boost prices for the stolen credit card details, also indicating the existence of underground cartels putting everyone in a "price taker" position.<br />
<br />
The basics of demand and supply for anything underground will always apply unless of course, The more they want, the cheaper it gets, the less they want, the higher the price on per credit card basis gets, since the investment on behalf of the malicious party that originally stolen them is virtually the same, and he can theoretically break-even in every single case since the credit card details were obtained efficiently. It's up to the seller to follow or entirely ignore economic behavior, and do what they feel like doing with this good which must on the other hand reach its market liquidity as soon as possible, else it becomes obsolete. The current market model can be further explained as a good example of competitive equilibrium :<br />
<br />
"<i>Competitive market equilibrium is the traditional concept of economic equilibrium, appropriate for the analysis of commodity markets with flexible prices and many traders, and serving as the benchmark of efficiency in economic analysis. <b>It relies crucially on the assumption of a competitive environment where each trader decides upon a quantity that is so small compared to the total quantity traded in the market that their individual transactions have no influence on the prices.</b></i>"<br />
<br />
This can be easily explained in a single sentence - it's a mess and every participant is doing whatever they want to, so generalizing on the prices charged for stolen credit card numbers would be unrealistic, since it's the price a single seller with no real impact on the "average" market price for the same good. As for the average market price itself, it would be hard to measure it depending on the quality of the sample you want to rely on, since this is a type of market where sellers don't have to report price changes in their goods for the purpose of statistical research.<br />
<br />
<a href="http://www.finjan.com/Content.aspx?id=827#SecurityTrendsReport">A recently released report by Finjan</a>, with whom I've been on the same page of several high profile incidents so far, <a href="http://news.yahoo.com/s/nm/20080715/wr_nm/cybercrime_finjan_dc">touches this very same topic</a> :<br />
<br />
"<i>Prices charged by cybercriminals selling hacked bank and credit card details have fallen sharply as the volume of data on offer has soared, forcing them to look elsewhere to boost profit margins, a new report says. Researchers for Finjan, a Web security firm, said the high volumes traded had led to bank and credit card information becoming "commoditized" - account details with PIN codes that once fetched $100 or more each might now go for $10 or $20. In its latest quarterly survey of Web trends, the California-based company said cybercrime had evolved into "a major shadow economy ruled by business rules and logic that closely mimics the legitimate business world.</i>"<br />
<br />
Excluding the presence of <a href="http://ddanchev.blogspot.com/2008/06/price-discrimination-in-market-for.html">price discrimination</a> for a while, as well as open topic offers in the lines of "how much for X amount of Y?" answered as "how much are you willing to pay?", it's all a matter of the seller in a particular situation.<br />
<br />
Furthermore, in real-life market there's always the scarcity problem, however, in the underground market there's no shortage of resources despite the ever growing wants of the buyers. Generalizing even more, take for instance the butterfly effect of a price change in petrol, and result of which is inevitable increase of prices in every single aspect of your life, but in the underground market mostly due to the malicious economies of scale achieved, a price increase in renting a botnet would have no effect in the prices charged for the stolen credit card details obtained through the infected hosts. How come? Basically, the price and resources for malware infection are prone to decrease, if we take a malware infected host as a static foundation for the basis of any upcoming cybercrime activities using it.<br />
<br />
Perhaps the most disturbing part is that the market for stolen credit card details is so mature, and its entry barriers so low these days, that the confidential data that cannot be efficiently obtained through real-life means like credit card cloning or ATM skimming on a large scale, is now purchased online for the purpose of abusing it in real-life by<a href="http://blog.wired.com/27bstroke6/2008/06/citibank-atm-se.html"> embedding the valid information into plastic cards</a>.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=c5gmVJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=c5gmVJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=yABcqJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=yABcqJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=iuXpaj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=iuXpaj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Ctkd2j"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Ctkd2j" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=KJLEOJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=KJLEOJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=6teEcJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=6teEcJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=XpeGzj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=XpeGzj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/336435935" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 15 Jul 2008 11:36:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/price">price</category>
      <category domain="http://securityratty.com/tag/average market price">average market price</category>
      <category domain="http://securityratty.com/tag/market price">market price</category>
      <category domain="http://securityratty.com/tag/credit card">credit card</category>
      <category domain="http://securityratty.com/tag/credit card details">credit card details</category>
      <category domain="http://securityratty.com/tag/details">details</category>
      <category domain="http://securityratty.com/tag/market">market</category>
      <category domain="http://securityratty.com/tag/competitive market equilibrium">competitive market equilibrium</category>
      <category domain="http://securityratty.com/tag/credit card basis">credit card basis</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/336435935/are-stolen-credit-card-details-getting.html">Are Stolen Credit Card Details Getting Cheaper?</source>
    </item>
    <item>
      <title><![CDATA[Links for 2008-05-30 [del.icio.us]]]></title>
      <link>http://securityratty.com/article/b8e94cf5fae99224def8e54359479886</link>
      <guid>http://securityratty.com/article/b8e94cf5fae99224def8e54359479886</guid>
      <description><![CDATA[Tech Trader Daily - Barrons Online : Sourcefire Rejects $7.50/Shr Bid From...]]></description>
      <content:encoded><![CDATA[<ul>
<li><a href="http://blogs.barrons.com/techtraderdaily/2008/05/30/sourcefire-rejects-750shr-bid-from-barracuda/">Tech Trader Daily - Barron&rsquo;s Online : Sourcefire Rejects $7.50/Shr Bid From Barracuda</a></li>
</ul><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/301669194" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 30 May 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tech trader daily">tech trader daily</category>
      <category domain="http://securityratty.com/tag/50shr bid">50shr bid</category>
      <category domain="http://securityratty.com/tag/barrons online">barrons online</category>
      <category domain="http://securityratty.com/tag/sourcefire rejects">sourcefire rejects</category>
      <category domain="http://securityratty.com/tag/barracuda">barracuda</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/301669194/anton18">Links for 2008-05-30 [del.icio.us]</source>
    </item>
    <item>
      <title><![CDATA[Société Générale plans to close loopholes by year end]]></title>
      <link>http://securityratty.com/article/1f90762af72ccd7d2255d947cefc217f</link>
      <guid>http://securityratty.com/article/1f90762af72ccd7d2255d947cefc217f</guid>
      <description><![CDATA[French bank Société Générale expects to have remedies in place by year end for the technical and procedural flaws that allowed rogue trader Jérôme Kerviel to build a fraudulent trading position...]]></description>
      <content:encoded><![CDATA[French bank Société Générale expects to have remedies in place by year end for the technical and procedural flaws that allowed rogue trader Jérôme Kerviel to build a fraudulent trading position that cost the bank €4.9 billion (US$7.25 billion).]]></content:encoded>
      <pubDate>Thu, 22 May 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/procedural flaws">procedural flaws</category>
      <category domain="http://securityratty.com/tag/billion">billion</category>
      <category domain="http://securityratty.com/tag/cost">cost</category>
      <category domain="http://securityratty.com/tag/fraudulent">fraudulent</category>
      <category domain="http://securityratty.com/tag/position">position</category>
      <category domain="http://securityratty.com/tag/technical">technical</category>
      <category domain="http://securityratty.com/tag/us7">us7</category>
      <category domain="http://securityratty.com/tag/bank">bank</category>
      <category domain="http://securityratty.com/tag/remedies">remedies</category>
      <source url="http://www.networkworld.com/news/2008/052308-société-générale-plans-to-close.html?fsrc=rss-security">Société Générale plans to close loopholes by year end</source>
    </item>
    <item>
      <title><![CDATA[Genius Hacker Released from Prison; Lands Job with IT Firm]]></title>
      <link>http://securityratty.com/article/2b0d3dcff6f8335297448ec57a642b7c</link>
      <guid>http://securityratty.com/article/2b0d3dcff6f8335297448ec57a642b7c</guid>
      <description><![CDATA[When Société Générale announced Jan. 24 that it had lost 4.9 billion (now valued at $7.68 billion) due to risky and unauthorized trading by Mr. Kerviel, the bank depicted the former trader as a...]]></description>
      <content:encoded><![CDATA[When Société Générale announced Jan. 24 that it had lost €4.9 billion (now valued at $7.68 billion) due to risky and unauthorized trading by Mr. Kerviel, the bank depicted the former trader as a devious information-technology whiz.]]></content:encoded>
      <pubDate>Sat, 26 Apr 2008 20:40:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/billion">billion</category>
      <category domain="http://securityratty.com/tag/socit gnrale">socit gnrale</category>
      <category domain="http://securityratty.com/tag/devious">devious</category>
      <category domain="http://securityratty.com/tag/due">due</category>
      <category domain="http://securityratty.com/tag/whiz">whiz</category>
      <category domain="http://securityratty.com/tag/kerviel">kerviel</category>
      <category domain="http://securityratty.com/tag/trader">trader</category>
      <category domain="http://securityratty.com/tag/jan">jan</category>
      <category domain="http://securityratty.com/tag/bank">bank</category>
      <source url="http://digg.com/security/Genius_Hacker_Released_from_Prison_Lands_Job_with_IT_Firm">Genius Hacker Released from Prison; Lands Job with IT Firm</source>
    </item>
    <item>
      <title><![CDATA[Biometrics would not have prevented SocGen incident]]></title>
      <link>http://securityratty.com/article/742082755108b01479e6ffd9bef66811</link>
      <guid>http://securityratty.com/article/742082755108b01479e6ffd9bef66811</guid>
      <description><![CDATA[An early contender for the biggest load of security tosh of the year comes within the report produced by Société Générale in response to the recent trading fraud scandal. The report identifies a...]]></description>
      <content:encoded><![CDATA[
      An early contender for the biggest load of security tosh of the year comes within the report produced by Société Générale in response to the recent trading fraud scandal. The report identifies a number of actions "as part of a structured plan", and the very first one of those is described as follows:

- <strong>Strengthening IT security through the development of strong identification solutions (biometry).</strong>

I cannot see anything to suggest that insufficient authentication and access controls were to blame for the incident. What we had was a breakdown in process, supervision, management and audit controls that should have worked together and flagged an issue long before it became newsworthy. Call me what you like but I just don't see that biometrics would have mitigated any of the risk. Am I missing something?

For example, page 8 of the report (and here I will admit that I haven't read it all, just the bits I can pick out in five quick minutes) lists a number of controls that were bypassed in order to "hide the fictitious nature" of the trading. Given that the purpose of biometrics is to determine identity, I do not see how using a fingerprint, blood sample or iris scan would have prevented the trader from not complying with the list of procedural controls listed such as "no confirmation for internal transactions."

This is also a view shared by Kenneth Paterson of the Royal Holloway in this very insightful <a href="http://www.computerweekly.com/Articles/2008/03/05/229714/royal-holloway-control-the-controllers.htm">article </a>published as part of the latest Computer Weekly Think-Tank on insider threats.

Read the full report <a href="http://www.sp.socgen.com/sdp/sdp.nsf/V3ID/6D44E7AEF3D68993C12573F700567904/$file/comiteSpecialFevrier08gb.pdf">here</a>.

      
   ]]></content:encoded>
      <pubDate>Fri, 07 Mar 2008 16:25:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/controls">controls</category>
      <category domain="http://securityratty.com/tag/procedural controls">procedural controls</category>
      <category domain="http://securityratty.com/tag/report">report</category>
      <category domain="http://securityratty.com/tag/report identifies">report identifies</category>
      <category domain="http://securityratty.com/tag/audit controls">audit controls</category>
      <category domain="http://securityratty.com/tag/biometrics">biometrics</category>
      <category domain="http://securityratty.com/tag/security tosh">security tosh</category>
      <category domain="http://securityratty.com/tag/strong identification solutions">strong identification solutions</category>
      <category domain="http://securityratty.com/tag/computer weekly think-tank">computer weekly think-tank</category>
      <source url="http://www.computerweekly.com/blogs/stuart_king/2008/03/an-early-contender-for-the.html">Biometrics would not have prevented SocGen incident</source>
    </item>
    <item>
      <title><![CDATA[Let's Not Let the Security Staff Become the SocGen Scapegoat]]></title>
      <link>http://securityratty.com/article/dbf23bccab7fc9e4c83b27ecae6cdaed</link>
      <guid>http://securityratty.com/article/dbf23bccab7fc9e4c83b27ecae6cdaed</guid>
      <description><![CDATA[A growing number of commentators are pointing the finger at the Societe Generale security function as being at fault in allowing &quot;rogue&quot; trader Jerome Kerviel to eventually bring the bank to its...]]></description>
      <content:encoded><![CDATA[A growing number of commentators are pointing the finger at the Societe Generale security function as being at fault in allowing "rogue" trader Jerome Kerviel to eventually bring the bank to its knees. Security product vendors are taking the opportunity to position their technology as being solutions that could have prevented this failure.<br />
<br />
It is certainly the case that many forms of control technology can overcome human weakness. But at best, it is misguided to believe that technology failure is the root vulnerability, and at worst, this is an attempt to turn the security staff into the scapegoat. Believe me, the security managers were fully aware of the problem and had warned about it many times.<br />
<br />
It has always been well-recognized in the financial services arena that trading staff do not follow even the simplest security procedures. Sharing of logins on the trading floor is the normal way that they do business. These are people who do not follow the rules. Not only do they not follow the rules, but their management and the bank management also feel that rules should not apply to these people. <br />
<br />
The crux of that problem is that they are treated as golden geese, and any attempt to inhibit their flexibility is avoided, because the result might be fewer golden eggs. It isn't a security failure; it is a governance failure. And it is not a problem unique to SocGen. This is the way financial services firms run their trading floors, and there should be no reason to feel that other banks aren't equally or even more vulnerable to such an incident. <br />
<br />
If you want to douse the flames of the bonfire of the vanities, you have to start at the top, not the bottom. Real improvements in risk management can come about only if top management is sincere in setting an agenda that balances short-term profits with long-term corporate viability and social responsibility.]]></content:encoded>
      <pubDate>Mon, 25 Feb 2008 14:47:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/failure">failure</category>
      <category domain="http://securityratty.com/tag/governance failure">governance failure</category>
      <category domain="http://securityratty.com/tag/management">management</category>
      <category domain="http://securityratty.com/tag/risk management">risk management</category>
      <category domain="http://securityratty.com/tag/technology failure">technology failure</category>
      <category domain="http://securityratty.com/tag/bank management">bank management</category>
      <category domain="http://securityratty.com/tag/staff">staff</category>
      <category domain="http://securityratty.com/tag/security staff">security staff</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <source url="http://blog.gartner.com/blog/security.php?x=0&amp;itemid=3145">Let's Not Let the Security Staff Become the SocGen Scapegoat</source>
    </item>
    <item>
      <title><![CDATA[See, they ain't that scientific either]]></title>
      <link>http://securityratty.com/article/7651cdc5b66359c9e168f6101f590181</link>
      <guid>http://securityratty.com/article/7651cdc5b66359c9e168f6101f590181</guid>
      <description><![CDATA[I'm no big fan of overly complex approaches to risk management, and recent economic events have made me even less so
There was a great article in the Economist about a conference for the Ameican...]]></description>
      <content:encoded><![CDATA[<p>I'm no big fan of overly complex approaches to risk management, and recent economic events have made me even less so.</p>

<p>There was a great article in the <a href="http://www.economist.com/finance/displaystory.cfm?story_id=10689043">Economist</a> about a conference for the Ameican Securitization Forum - the wonfderful people that brought us all these complex debt products that are giving banks no end of bellyache. Ironically the conference was held in Las Vegas, and a wonderful quote came from hedge fund manager John Devaney, who said &quot;I'd like to thank the market for dealing me a direct hit. As a trader if you don't get sucker-punched every once in a while, you don't understand what risk is.&quot;</p>

<p>Also, there were a few good <a href="http://www.portfolio.com/news-markets/national-news/portfolio/2008/02/19/Black-Scholes-Pricing-Model">articles</a> last week about how money managers had retreated from the market because they'd lost faith in the ability to model risk effectively.</p>

<p>If only it were so easy for information risk professionals, who often protect far more than just money - we protect innovation, national security, and even human life in some cases. It's not quite so easy for us to take a direct hit.</p>

<p>Financial markets have taken centuries to evolve, yet look at what can happen with their well established risk models. Information risk modeling is still only nascent, and changing at blistering pace. Yes, we need a more structured approach to information risk management - defining and comparing the different risks we face - but technology and business are evolving so fast that we need to temper our expectations about how scientific this can ever become.</p>

<p>The best quote I heard on this topic was from Hugh Voight of Solutionary, who says that &quot;To get from New York to San Francisco, you don't need Google Maps until you get close to the Bay Area. At first, you just need to go West.&quot;</p>

<p>We still just need to &quot;Go West&quot; when it comes to modeling information risk. Bring on the Village People!</p>]]></content:encoded>
      <pubDate>Mon, 25 Feb 2008 10:42:29 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk management">risk management</category>
      <category domain="http://securityratty.com/tag/information risk management">information risk management</category>
      <category domain="http://securityratty.com/tag/information risk">information risk</category>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/information risk professionals">information risk professionals</category>
      <category domain="http://securityratty.com/tag/risk models">risk models</category>
      <category domain="http://securityratty.com/tag/model risk effectively">model risk effectively</category>
      <category domain="http://securityratty.com/tag/direct hit">direct hit</category>
      <category domain="http://securityratty.com/tag/quote">quote</category>
      <source url="http://blogs.forrester.com/srm/2008/02/see-they-aint-t.html">See, they ain't that scientific either</source>
    </item>
    <item>
      <title><![CDATA[Poor IT security to blame in Société Générale fraud]]></title>
      <link>http://securityratty.com/article/8ff54912a56818ded47bd4bb3fefd556</link>
      <guid>http://securityratty.com/article/8ff54912a56818ded47bd4bb3fefd556</guid>
      <description><![CDATA[Inadequate IT security allowed a trader at French bank Société Générale to make a series of unauthorized transactions that ultimately cost the bank 4.9 billion ($7.2 billion), an internal...]]></description>
      <content:encoded><![CDATA[Inadequate IT security allowed a trader at French bank Société Générale to make a series of unauthorized transactions that ultimately cost the bank €4.9 billion ($7.2 billion), an internal investigation has found.]]></content:encoded>
      <pubDate>Tue, 19 Feb 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/billion">billion</category>
      <category domain="http://securityratty.com/tag/ultimately cost">ultimately cost</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/internal investigation">internal investigation</category>
      <category domain="http://securityratty.com/tag/trader">trader</category>
      <category domain="http://securityratty.com/tag/series">series</category>
      <category domain="http://securityratty.com/tag/bank">bank</category>
      <category domain="http://securityratty.com/tag/transactions">transactions</category>
      <source url="http://www.networkworld.com/news/2008/022008-poor-it-security-to-blame.html?fsrc=rss-security">Poor IT security to blame in Société Générale fraud</source>
    </item>
  </channel>
</rss>
