Caller ID "spoofing" 2971

part of that was boyd and ooda-loops

some of the other web-sites where you find boyd and ooda-loop references are now looking at it from standpoint of business agility and adaptability. boyd would do his briefing to commercial companies and the issues of agility and adaptability are very applicable ... but the historical agile-adapting examples in the core briefings tended to be pulled from military history. the principles are applicable to any sort of compebreastive situations ... but historical short-period agile-adaptible examples are harder to find outside of military history (unless possibly you go all the way to darwin).

with regard to mentioned ach pull-push (dda checking accounts) ... the x9a10 financial standards working group was given the requirement to preserve the integrity of financial infrastructure for all retail payments. as a result we did a pretty detailed threat and vulnerability examination of various retail payment mechanisms; ach, debit, credit, stored-value, etc. when coming up with the x9.59 standard

the requirement for x9.59 was "ALL" ... not just a single transaction type or just retail or just point-of-sale ... but "ALL".

in parallel with work on x9.59 standards work ... a parallel submission was made to nacha (we ghosted the submission, but it was submitted by somebody else since we weren't nacha members at the time): more background

nacha website

which is national organization for ACH payment operations.

as part of some of the authentication work, we were called in to help word-smith the cal. state electronic signature legislation (and then later the federal legislation).

one of the industry groups participating in the electronic signature legislation was also looking at various privacy issues and had done a study of primary driving factors behind privacy regulation and legislation ... and found the two primary driving factors were 1) id theft and 2) denial of service (to individuals by insbreastutions; gov, commercial, etc).

a major component of id theft has been account fraud ... and there has been recent efforts to explicitly differentiate account fraud from other forms of idenbreasty fraud ... also i was asked to give keynote on idenbreasty theft a couple years ago at us treasury's annual conference.

x9.59 finally pbutted in 2000 ... and within the past month or so ... the five year update pbutted (and the updated document should shortly be showing up on the ANSI website). there is also a field defined in the current ISO 8583 standard (credit-debit) for carrying any additional x9.59 payload.

various postings about risk, fraud, exploits, vulnerabilities, etc

--