Things we're reading today include ...
« May 2011 | Main | July 2011 »
Things we're reading today include ...
Like everyone, I’m completely fed up with passwords and online security.
It just doesn’t hack it anymore, or is that makes it easiest to hack.
The system is thirty years old – I used to use passwords to get onto the company network back in the 1980s. In fact, it’s even older than that. Polybius recorded the use of passwords back in the Roman Military days two millennia ago.
And now the system is broken.
I mean, even back in the 1980s it was more secure because the company made me change my password every four weeks. Today, I am rarely forced to change a password and I’ve just got too darned many of them.
There’s a password for iTunes, a password for email, a password for Amazon, a password for the bank, a password for my airline, a password for my mobile, a password for Google, a password for the credit cards, a password for the lottery …
Yep, there’s a password for everything.
And, like everyone, we’re told to not write the things down but how can you remember so many passwords?
You can’t.
So you put them all in a notepad or secure them somewhere on your PC or put them into some online password manager, but it’s all just crass stupidity.
Even with these secure systems, you just end up making all your passwords variations of the same thing. Even that doesn’t work as some sites use capital and lowercase letters, some are just lower case, some demand numbers whilst others want a minimum of 8 characters … can you ever remember which site demanded which format?
What you end up with is a mess of passwords that you can’t remember.
So you then use the same one for everything, but that has dangers too.
How a cyber-security firm got hacked
“Barr and some of his colleagues, Anonymous then discovered, had committed computer security's biggest sin: They used the same password on multiple accounts. The hackers commandeered Barr's Twitter and LinkedIn accounts, lacing both with obscenities. One of the passwords also opened the company's corporate Google account. Jackpot. In less than 48 hours, the hackers had the keys to the kingdom.”
And then it gets worse.
So how do you create a secure signon?
If you’re a bank, you force customres to logon to the bank with a password and a PIN, and then demand that they put their PIN in again on another device in order to generate a one-time passcode. You then enter the passcode, get another code back, enter online and off you go.
It is ridiculous, and none of it is easy or intuitive.
So what’s the solution?
IP address?
Pattern recognition?
Biometrics?
DNA testing?
It’s a question that’s been asked for a while and has no good answer, although I'm sure lots of password alternative solutions firms will be posting answers to this blog post.
But if there were a solution then some academic would have it nailed by now and the Register recently summarised two such research papers on alternative to passwords.
Neither has a good alternative to passwords.
What they do say is the same thing I’m saying:
“From a usability viewpoint, passwords and PINs have reached the end of their useful life. Even though they are convenient for implementers, for users they are increasingly unmanageable. The demands placed on users (passwords that are unguessable, all different and never written down) are no longer reasonable now that each person has to manage dozens of passwords. Yet we can't abandon them until we come up with an alternative method of user authentication that is both usable and secure.”
Come on folk, give me an alternative.
Here’s my suggestion.
When signing on, you enter your mobile telephone number.
You receive a text with a passcode.
You enter the passcode.
Off you go.
Obviously for more secure sites, you might add a PIN, but nothing as complex as three thousand passwords that are all variations of “123456”.
From Tom's Hardware, 2010
Last year, a major security breach at RockYou.com resulted in the release of 32 million passwords. With such a large data set available, security firm Imperva Application Defense Center (ADC) analyzed and found that, when given the chance, most users will choose a simplistic password.
Imperva found that nearly a third of users chose passwords whose length is equal or below six characters and almost 60 percent of users chose their passwords from a limited set of alpha-numeric characters. Almost half of users used names, slang words, dictionary words or trivial passwords (consecutive digits, adjacent keyboard keys, and so on), with the most common password being "123456".
Here are the most popular passwords from the RockYou.com leak.
Password Number of users
Things we're reading today include ...
I said yesterday that the other topic that keeps coming up is innovation.
Innovation is something that comes and goes in banking like Chief Executives and Heads of Risk … as in it appears and disappears pretty often.
During the build up to the financial crisis, innovation was everywhere.
Then it disappeared for a while.
For example, in 2000 the Top 10 American banks annual reports mentioned the word “innovation” an average of 1.2 times. By 2006, that had risen to an average 6.5 mentions per report. By 2009, it hardly appeared at all, averaging a general 0.3 mentions per report.*
Now it’s on the way back.
I talk about innovation a lot, as demonstrated by the interviews I regularly perform for Infosys in their Finacle Connect Quarterly Journal.
Equally, JP Rangaswami recently spoke at the Financial Services Club about innovation, and said that banking is the last place where innovation occurs because of risk. When he was CIO of Dresdner for example, he was told to innovate but only in areas that wouldn’t disrupt the bank or create risk. In other words, innovate in areas that don’t matter.
This is a complex dilemma and not an easy one to solve.
For example, in our annual survey of banks, we found that most believe regulation occurs outside the industry but not inside. Industry innovation only happens when regulators force banks to innovate, such as when SEPA or Same-Day Payments is forced upon us.
But there are two questions that came up recently which illustrate the issues with innovation in banks well.
The first was: how to measure the business value of innovation.
The second was: we want to innovate, but have to choose something easy.
Let’s tackle that first area: how do you measure the business value of innovation?
Many people say that you cannot be innovative if you have a business case.
If it has a business case, then it’s been done before therefore it’s not innovative.
But that doesn’t wash with a bank.
Banks need to know the cost and returns, the timescales and technologies, the impact and implications … banks need the I’s dotted and the T’s crossed.
That stifles innovation obviously but it doesn’t matter as banks only need to fast follow.
Fast following is the heart of the art of banking, not innovation.
So, I would propose that if you want to measure the business value of innovation then measure what others are doing and if it looks worthwhile, copy it.
That’s what banks do well and proves to be the reliable pulse of most innovations in banking.
See if it works elsewhere and, if yes, copy it.
The alternative approach is of course to suck it and see.
Banks will willingly put a toe in the water of innovation and try things out.
Oh it looks worthwhile, let’s suck it and see in a pilot and, if yes, roll it out.
They have pilot programs all over the place.
Some have so many pilots, they should run an airline.
The problem with pilot programs however, is that there’s no commitment to it.
So they often fail to prove a business case this way and it gets shelved.
That’s the reason so many bankers will turn around to you and say: “been there, done that, tried it, failed” … sure.
If Steve Jobs viewed the world that way, we’d never have seen an iPod, iPhone or iPad.
The real art of innovation is therefore to look at things that seem to work and then absorb them into something that really does work.
Not easy, especially if you don’t take innovation seriously, but it is practicable.
Then we have that second area: innovate in an area that’s easy.
The issue for most bankers is that they want to innovate, but there are forbidden zones all over the bank.
Oh and just for a gratuitous moment, it gives me a chance to post a tune:
You can’t touch this.
All over the bank: “You can’t touch this”.
That’s required by regulation: you can’t touch this.
There’s a compliance issue here: you can’t touch this.
This is subject to audit: you can’t touch this.
We have to have this for legal reasons: you can’t touch this.
I could go on, but the point is clearly made in today’s comment from Iain G. Mitchell, QC, on cloud computing from my post yesterday:
“Functionally, it might not matter where the data is stored, but it's hugely important legally. Most cloud computing providers will use a network of servers distributed all over the world and will not be able to say where, at any given time, your data is stored. It is normally a breach of data protection regulations for data to be exported out of the EU, so, unless you know that all of your cloud computing provider's servers are physically located in the EU, you might well find yourself in breach of data protection regulations.”
You can’t touch this.
It came up again recently in an interview with Financial Services Club friend Aden Davies, innovation technician at HSBC:
“Ever wondered why banks don't respond when you send irate tweets about problems with your account? You might think they're silently hoping you'll be sucked back into the cyber-ether. But it's more likely concerns about compliance are keeping them quiet. Case law from 1924 means financial services companies can't publicly identify an individual who has an account with them - which makes responding to customer queries via quasi-public forums such as Twitter a legal minefield, according to Aden Davies, innovation technician at HSBC.”
You can’t touch this.
If innovation is to occur, you have to touch everything with no sacred cows and, between legal, compliance, regulatory and financial measures, innovating within a bank will always be the most difficult thing you can try to do.
*note: there’s lies, darned lies and statistics in there somewhere lol
Things we're reading today include ...
It seems that I’ve been locked in debates over the past couple of weeks about two themes and two subjects only Cloud Computing and Innovation.
Cloud Computing is a topic I’ll pick on today and then maybe talk a little more about Innovation tomorrow.
So what’s the problem with Cloud Computing?
It’s rubbish is the problem.
Not the idea of Cloud Computing which at its basis is just scalable computing through the internet, but the fact that it has now gained a panacea and utopian status of being all things to all people.
It’s Salesforce.com, Azure, Exalogic, Amazon and more.
Put in “Cloud Computing” to Google, who also provide clouds, and you get sponsored adverts from HP, Intel, Siemens and more all talking about clouds.
It’s Software as a Service, Platform as a Service, and Infrastructure as a Service.
It’s public clouds, private clouds, hybrid clouds.
It’s every and any darned thing you want and, as a result, it’s lost its meaning.
So I go to these conferences around the world and they’re talking about clouds and the audience is dying to know what they’re going to say.
The CIO bank attendees have heard about Cloud Computing, but have no idea how to articulate what it is to their Board and CEO, how to justify it, how to present it as meaningful and how to get a decision.
The Board and CEO have heard of cloud, but hear it’s dangerous. They think it’s the reason why Sony and Citi got hacked, and that Amazon servers were out for days causing businesses to lose money.
They see it as risky and a loss of control.
The experts know this is not the case as, in its simplest form, if you run your bank on anyone’s technology you might as well think of it as a cloud.
But the risk of losing scale, resilience, security and control is the core issue at a bank’s heart, and they’re not willing to take that risk with cloud, especially if no-one can define it.
Talk to anyone and they define it different ways.
And in all of this confusion, the decision maker is left confused.
But here’s my take on it.
We are moving from a world of finance where technology was core to efficiency in its first wave, and differentiation was core in its second.
Initially, mainframe compute power and then BPO and virtualisation created efficient computing capabilities for financial firms.
Then the ease of modular computing, service-oriented architectures and Ajax Web 2.0 has made computing applications the differentiating factor between a winning bank and an also-ran bank.
Now we are moving to an age where computing and applications just don’t matter.
Everything will be utility computing through the cloud.
Just like the iTunes app store and Google’s Gmail for consumers, who really don’t care how it’s done and who does it as long it’s there, banks will gradually move to clouds.
The art will then be as to how you put your apps and resilience together through the cloud, rather than how you build and manage your internal fortress.
The move will happen in three stages.
First, banks will move towards clouds for shared service applications such as marketing databases (Salesforce.com). The second wave will move core infrastructure onto private clouds and then, in third wave, towards hybrid and public clouds.
It will just be a natural evolution over time.
And the concerns of the managerial team will disappear over time.
Before you know it, all banks will be in the clouds.
By that time, computing and applications for banks will be just like Gmail and iTunes for consumers – just stuff you plug and play, and pick and choose from.
Like a smorgasbord of utilities, the trick will be to make your plate of edibles the most attractive to the target audience you are trying to reach.
And, by this time, we will all think of technology, software and infrastructure like electricity and the internet – just something you plug into and don’t care how it works.
In the meantime, we will have a period of total confusion where, very rapidly, Cloud Computing will get a bad name.
It will lose its resonance and be viewed as just another IT hype cycle, because every Tom, Dick and Harry is claiming that their offering is cloud.
This was evidenced by Gartner Group who spoke at one of my recent events about Cloud Computing and, by the end, had failed to present a single Magic Quadrant.
I asked: “where’s you Magic Quadrant for the Cloud?”
And they answered: “it’s too early yet and the market too ill-defined to create one.”
Yea.
In other words, the markets a mess and we’re waiting for it to sort itself out.
So am I.
Things we're reading today include ...
We had a meeting of the Financial Services Club last week that looked at fraud and mobile malware with the Serious Organised Crime Agency and the International Systems Security Association (ISSA).
It was an interesting meeting, as I’m particularly intrigued by stories about mobile as this is our hot space right now.
Every bank is getting into mobile payments, mobile billpay, mobile balance checks, mobile banking ... it’s a huge opportunity as I’ve written about so many times.
I’m not writing much about the issues with mobile that banks are experiencing as many are yet to come into the public domain.
One that is in public domain is the coordinated ZeuS attack from Q4 last year:
“According to S21sec, the new variant of the ZeuS trojan first infects the victim’s PC. Then a web application purporting to be from a bank asks the victim to input their mobile phone number and details of their device. Third, the victim is asked via text message to install an application on to the phone. This application can then be used to intercept any text messages the victim sends.”
But I have a little bit more interest in what’s happening today and Joshua Pennell from ISSA talked through a whole load of new man-in-the-middle and mobile malware attacks that are growing by the day.
I mentioned one of these myself recently about Justin Bieber, but suspicious downloading is one thing.
It’s just another variation of phishing.
What concerned me more is the mobile hi-jacking capability where you think you are on your mobile carrier’s network but you’re not.
The idea is that a cybercriminal places a signal box near to the location of the person they are targeting.
The person then sees their mobile signal disappear and come back stronger. Something that happens all the time in my part of town.
What the mobile user does not realise is that their mobile service has now been hijacked and all of their texts, apps and downloads are being filtered by the cybercriminals service.
Sounds difficult?
I thought so until someone mentioned to me that this was just an example of using the Sure Signal Service.
Then the penny dropped as I use that service!
Sure Signal is for mobile customers who live in an area that is too weak to get a decent mobile service from their carrier.
This happens to many customers who move home and the result is that they cannot actually use the mobile carrier’s service and want to leave.
So they get sent a Sure Signal box.
The box works off the broadband network of the house and the result is five bars for calls plus 3G.
Oh, and of course, the same is true for anyone else in that vicinity.
Good idea...
... and then there’s the other illustration of mobile that adds a further dimension to this.
The mobile tracker.
We all know that your geolocation is always on when you have a mobile signal, but who has a right to know about this?
In Germany, where spying is rife, apparently it’s a hot issue right now ever since German politician Malte Spitz discovered that his mobile operator was tracking his every move.
And the issue is that they were storing this information for months ... in fact, they had his whole life mapped out over a period of six months. Every move from every day for 180 days.
Here’s how it looks over just two days...
... hot stuff and a real topical issue therefore is: what is the security of mobile and, if compromised, who is at fault: the carrier, the handset manufacturer, the retailer, the customer, the bank, the regulator...
Things we're reading today include ...
Our biggest stories of the week are ...
Are payments infrastructures fit for purpose?
On Wednesday 22nd June, we are running a private dinner meeting of the Financial Services Club in London to launch the results of our recent survey: "Are payments infrastructures fit for purpose?" which was completed by 350 payments professionals worldwide.
It amazed me to see the back office of one of the largest operations in the world in action today. Yes, I’m talking about Amazon. A place you would think would be a seamless operation of high technology but, in reality, is a bit of a mess ...
Oh, for them good old cheque days
June 9th 2065: we just celebrated grandad's hundredth birthday. He was a banker, and he recorded a speech for us to play to the family. We decided to share his speech as it captures a moment of history that many …
Two out of five businesses switch banks due to fraud
I regularly write about fraudulent aspects of finance, and it’s getting worse. As I say in my presentations: “with five billion points of data breach, how can you keep secure?” and this is a key question, as every mobile device...
Poor are #1 prey for financial predators
It’s fairly obvious that the less you have of something you want, the more you want it; whilst the more you have, the less you need it. It’s not true of everything I guess as, for example, I don’t have...
The major general news stories of the week include ...
Banks' D-Day in Westminster: as it happened June 8, 2011 - The Telegraph
Our coverage of the grilling by MPs of banks and their bosses.
Should the UK switch from banking to manufacturing? - BBC
Should Britain bid farewell to the golden eggs of banking?
Lloyds plans IPO for branches as sale kicks off - The Independent
Lloyds Banking Group is ramping up plans to float more than 600 of its branches as a new bank on the stock exchange if prices offered by bidders are too low.
Northern Rock set to be sold alongside Lloyds branches - The Telegraph
The biggest shake up of high street banks to come out of the credit crisis is set to begin with the sale of Northern Rock and 620 Lloyds Banking Group branches.
Europe's Banks Too Fragile to Absorb Greek Default - Business Week
Efforts to resolve Greece's debt crisis are complicated by the failure of European regulators to make banks raise enough capital to withstand a sovereign default
European Central Bank risks being 'wiped out' by bail-outs - The Telegraph
The European Central Bank is "looking increasingly vulnerable" and may face "hefty losses" as a result of propping up indebted eurozone countries, a leading think-tank has warned.
US regulator 'almost ended Barclays' Protium deal' - The Telegraph
US regulators would have shut down Barclays' controversial Protium deal over questionable accounting practices had the bank not moved first, regulatory filings show.
ING: paying the price - Financial Times
Chief executive Jan Hommen is in an awkward position – a unique business with such brand value should be worth much more
Dimon confronts Bernanke over banking rules - The Independent
Jamie Dimon, chief executive of JPMorgan Chase, one of Wall Street's most powerful banks, took his complaints about too much regulation directly to the chairman of the Federal Reserve last night, challenging Ben Bernanke to prove that new banking rules are not crimping the economic recovery.
Square Raising New Round, Joining Billion Dollar Valuation Club - Techcrunch
There are a bevy of startups in the process of raising big rounds of capital at billion dollar or higher valuations - something that was a rare occurrence even a few months ago. We're tracking most of these deals (and have written about the ones we've confirmed ). Now, we've ...
If you like the Finanser, check out the books of the blog: the new Complete Banker Series
The Financial Services Club is sponsored by:
For details of sponsorship email us.
On Wednesday 22nd June, we are running a private dinner meeting of the Financial Services Club in London to launch the results of our recent survey: "Are payments infrastructures fit for purpose?" which was completed by 350 payments professionals worldwide.
As a taste of what came out of this, respondents were asked to take a view about each of the core infrastructures chosen - SWIFT, the EBA, Equens, Eurogiro, VocaLink, STET, CHIPS, Fedwire -and assess whether they are "innovative", "leading-edge", "fit for purpose", "challenging" or "out-of-date".
Based upon this feedback, four infrastructure providers were viewed as pushing the boundaries while three were "out-of-date" and "challenging".
Who are they?
Find out by registering at: FSClub Dinner.
Members of banks, payments infrastructures, press and media can attend free of charge as our guest.
At the dinner meeting on 22nd June, all attendees will receive a full complimentary copy of the results of the survey. There will also be a one hour panel discussion reviewing the outcomes with representatives from SWIFT, the EBA, Vocalink and Cognizant (Cognizant are our dinner hosts and survey sponsor).
The dinner will be held in The Captains' Room of Lloyd’s of London, One Lime Street, London EC3M 7HA from 6.00pm until 9.15pm.
If you want to come, then register at: FSClub Dinner.
Note: attendance is subject to qualification, and is not guaranteed until you receive confirmation by email.
Speaking of invites, here's another one:
At 3:30pm on the 21st of June 2011 at The Mint Hotel, Tower of London, 7 Pepys Street, City of London, EC3N 4AF, you are invited to attend a thought provoking Corporate Banking Event delivered by a leading panel of experts and sponsored by Temenos.
The forum will focus on key industry concerns surrounding corporate banking including: open account trading, letters of credit, initiatives such as e-invoicing and SEPA and the value-add corporate banks should provide for their customers in order to differentiate themselves.
Panellists include:
Drinks and Canapés will be served after the event and there will be an opportunity to network with your peers and the panel. As this event is sponsored there will be no registration fee payable. Space is limited and is strictly reserved for financial professionals in the banking industry.
If you wish to register please click here.
Things we're reading today include ...
It amazed me to see the back office of one of the largest operations in the world in action today.
Yes, I’m talking about Amazon.
A place you would think would be a seamless operation of high technology but, in reality, is a bit of a mess.
I mean sure, from an external view, it all looks like one great brand with multiple divisions as encapsulated by this slide deck from Erick Schonfield at Techcrunch recently:
The book division doesn’t talk to the music division. The music division won’t talk with the electronics division. The retail business won’t talk with the wholesale business. The wholesale business won’t talk with the cloud business. Oh, and the Kindle division won’t even talk with the book division!
None of them will share customer information with each other and, as a result, no-one knows what customers buy from Amazon as a group, when or with what sort of payment type.
There’s no view on Amazon’s share of wallet or who is cross-selling what to each customer.
They have tried to improve this over the years, but the line of business heads for books, music, electronics, retail, wholesale, cloud and kindle are all at each other’s throats, motivated by their own line of business results.
I heard that Jeff Bezos thought about a mass clearout of all management and replacing them with a new organisational structure that would allow seamless integration of all divisions with a single platform for the company to see a single version of all the customer information in a single view … but no sooner was this mentioned than the Board’s management and Chairman slapped him around the face and he had to back down.
This was due to a number of senior managers questioning his integrity with the Chairman.
Oh, how easy it would be if Amazon were a brand new, fresh business that could change things.
Ah, but Amazon is a brand new business and it has changed things.
Of course, it has divisions – and divisions are meant to do just that, divide – but Amazon’s divisions don’t divide the organisation by customer owners but by logical structure of organisational delivery.
So what sort of business would divide customers across lines of business so that never the twain shall meet?
What sort of business could have customers caught up in several areas of their business, but dealt with as though they were all separate people rather than just one person?
What sort of business could not recognise that a small business customer might be one and the same as their premium accountholder?
What sort of business could ignore the fact that this person is living with that person with two teenagers in the family?
What sort of business would allow their loans business to stop their savings business from making contact with the customer, even though they work for one and the same company?
What sort of business would allow line of business owners to stake their turf for internal gain but at the customer’s loss?
Hmmmm …. I think I could name a few.
And the one’s I’m thinking of have four letters that start with ‘B’ and end with ‘K’.
Why did I blog this?
The answer is in a blog post I placed recently about information wars.
Worth bearing in mind.
Things we're reading today include ...
June 9th 2065
We just celebrated grandad's hundredth birthday.
He was a banker, and he recorded a speech for us to play to the family.
We decided to share his speech as it captures a moment of history that many of us might forget.
Hope you like it ...
I cannot believe that I’m waking up today to celebrate my centennial birthday.
Yes!
Just reached the grand old age of one zero zero years old.
100!
Obviously I wouldn’t be here without Pfizer’s help so thank goodness for elongates.
No, nothing to do with your manhood – although Pfizer’s superpremium plus Viagra for seniors isn’t bad for that department – elongates is the drug they introduced in 2019 that allow almost anyone to defy the ageing process.
So here I am at the grand old age of 100 still able to have an active sex life and run marathons. Admittedly, it takes me four days now – to run the marathon that is – but being relatively healthy and active is pretty good for a senior like me.
I like to regale my great grandchildren with funny stories about how everyone’s life expectancy was around fifty years just a couple of centuries ago. Yes, back in 1889 when Bismarck introduced the pension, the average life expectancy of a German male was just 45. No wonder they made the pension age 65!
Now the average human lives to 110 and, for the white collar boys like me, 120 plus is not unheard of.
So I’ve got a few years yet and yes, it has really messed up the old pension plan as they expected me to shuffle off this mortal coil back in 2050 or thereabouts.
And here I still am ... just about fit enough to engage in most of life’s activities and enjoying talking about the past to my grandchildren and their children.
Nothing like the bedtimes when young Laptop – what do they call people these days? – asks me to tell her the one about cheques.
What, you haven’t heard it?
Ah well, here it is again.
Back in the twentieth century when people were transported around in things called cars and jetted around the world in things in the sky called planes – if you don’t know what these are, just ped it (ed: ped is the common lingo for any encyclopaedia style system, most of which are now built into clothing) – we used to have one very strange habit.
It was called “sending a cheque in the post” (this bit normally gets a laugh from the older members of the family, who remember such things as ‘post’).
The process would begin with writing a letter.
Now how did that work?
What we would do first is get a piece of paper.
Paper was everywhere in those days, and it was used to communicate.
The way it would work is that you would use this paper – and normally at this point I would hold up an example of one of my classic letters and pass it around – and then you would write a message on it.
Writing was performed using an instrument called a pen, which was a long thin instrument with fluid inside. The fluid would appear on the paper and then dry, and would be our way of writing words to each other.
This was done so that you could send a message to someone who would receive this information, and that someone could then read what was on the paper and respond accordingly.
We would actually write with our hands, holding this pen instrument, and the words would appear like magic on the paper – a bit like they do today on the illuminator.
So we would write these words on a piece of paper and often you would do this to pay a bill.
Now a bill was something you owed to someone for something.
OK, OK, I know that you would now deal with this by using gimmee.
Oh, and I should say how proud I am of my son’s grandson, Volkswagen – who would have thought? – who has just gained his diploma in gimmee economic theory and practice (ed: gimmee is the global and interplanetary currency of the future, that allows anything to be transacted in any form as long as it has a value that can be measured according to the Goognet Corporation).
Anyways, back then there was no such thing as gimmee. We only had three ways to exchange goods and services using things called cash, cards and cheques.
Cash was the most pervasive form of value exchange and you can still see many examples of cash today but, in the olden days, it was used far more extensively,
Cards you don’t see at all now of course, but these were plastic cards with your name and a unique number written on them. You can see those in the Museum of Money or the Smithsonian if you’re that interested.
But no, the weirdest one by far was the thing called ‘cheque’.
A cheque was a piece of paper – yes, another piece of paper – but this paper was given to you by a financial intermediary called a bank.
Banks were these amazing places that controlled all the value in the world, but many of them disappeared during the early part of the century as they didn’t adapt to the networked economy we live in today.
That’s how Goognet got to takeover with gimmee, but then you know that story don’t you.
So back to writing a letter and putting a cheque in the post.
Now what I’ve done is I’ve written this letter – the information I need to send to the person who will receive the letter, explaining what it is all about – and now I want to give the person some value.
As mentioned, that is normally for getting rid of some debt I owe them, such as a bill for how much electricity or water I used. Sure, I know that’s ridiculous today but back then, it was the way it was.
Now, there’s lots of ways I could give them that value – as mentioned, there was cash and cards – but if you wanted to send a cheque, then you would take the paper issued by the bank.
That piece of paper was personalised with your bank number on there, so they knew it was you. And because the paper was issued by the bank, they would accept it as real value rather than as just a piece of paper.
You would write on the piece of paper how much you wanted to send to the recipient of the letter, and you would put this in an envelope.
An envelope I hear you ask, is just a packet that would hold the two pieces of paper you were about to send.
You see, because the paper had to be physically moved from my house to the house or office of the person I wanted to exchange value with, it needed this wrapper. That was the envelope.
I would write the name and location of the organisation or person I was sending the wrapper to on this envelope and then I would pop it into the post.
Oh, I know, I know. So many things to learn, but I promise you this is one of the last bits of new information I will share with you today.
The post was the postal system.
Now today, you just think something to someone and it’s there, thanks to Goognet, but back then you had to send everything physically.
Nothing was electronic.
So you would put the cheque and the letter in the envelope, put a stamp on the envelope that covered the value required by the people who ran the post to physically take your envelope from your house to the location of the person you wanted to send it to.
About three to five days letter, the cheque would arrive with the person you wanted it sent to.
At this point, my great grandkids normally ask the obvious question: “and what happens with the cheque from there, great gramps?” and, as I know you’re just bursting to ask that question, I’ll finish the story for you.
You see, once the cheque has been physically taken from my house to theirs, they then have to take that piece of paper to their bank.
That may be a day or two later, so by now a week has probably passed since I sent them the cheque.
When they get to their bank – and yes, they do have to physically go there in their pod, people carrier or whatever it is they use – then they attach a slip to the cheque that tells the bank their number and name, and the bank then puts the value that I wrote on the cheque into their account.
Mind you, it does not go in straight away as it takes a few days.
Last time I told this story, Thingamajig – yes, that is their name and no, I haven’t got dementia and forgot it – asked why.
So I explained that their bank then has to send the details of what I wrote on the cheque along with their details to my bank.
Eventually, it all gets sorted out and they can then spend the value I wrote on the cheque.
So there you have it my friends.
The good old days of old, where value moves from my hand to yours through three pairs of others -the postal service, their bank and mine – and that is why it used to take us ten days to a month to get things paid.
That’s when the little ones eyes widen and Jedi Knight Pipsqueak – he prefers to be called JKP, as we named him after a major exposure to Star Wars fifty year celebrations and it’s now a little out-of-date – screamed: “but great gramps, gimmee works with just the wave of my hand”, which it does of course as he downloaded Toy Story 28 onto his watch in exchange for two hours gaming time.
“I know, I know JKP”, I sighed, “but things weren’t always this simple my boy.”
And so there you have it boys and girls.
The way we used to do things in the good old days.
Of course, we got rid of such antiquities early in the 21st century, but I still have a fondness for that old cheque process.
After all, back in them days, I could quite happily defer the exchange of value for weeks or months if I wanted to. Not like now, where Goognet knows our every movement.
More on that later but, for now, night night boys and girls.
Oh, and thanks to my very old friend, and even older than I am now colleague, Brett King for a bit of the inspiration for recounting this tale.
\
Things we're reading today include ...
I regularly write about fraudulent aspects of finance, and it’s getting worse.
As I say in my presentations: “with five billion points of data breach, how can you keep secure?” and this is a key question, as every mobile device is now a point of payment or sale.
Equally, as everyone is loosely leaking their private information online socially, can anything remain secret?
It seems not in the age of Wikileaks, Twitter and Facebook.
Now most of the headlines about fraud are grabbed by Sophos in my circle of radar.
I guess it’s because they’re pretty good at monitoring this stuff and capturing the headlines before anyone else.
But I did see a couple of other interesting reports used recently.
One came from Guardian Analytics, whose “2011 Business Banking Trust Study” found the following:
The key line for me from the above is “43% of businesses said they have moved their banking activities elsewhere after a fraud incident” … it’s probably higher for consumers as moving a business account is actually more challenging than moving a personal account.
You need to move all your supplier and customer data across and you no doubt have some form of relationship with the bank. This may be a relationship of some depth if the business has factoring, invoicing, treasury, cash management and other matters handled by the bank.
So for more than two out of five firms to leave if fraud occurs is a substantial exposure.
And such exposures are becoming more often and more frequent. For example:
“The FBI said that between March 2010 and April 2011, it identified twenty incidents in which small to mid-sized organizations had fraudulent wire transfers to China after their online banking credentials were stolen by malicious software.”
Small beans today … big trees tomorrow … especially when you see stories like the one I told recently about Aaron Barr, Head of Cybersecurity for the Federal Division of HBGary who got cyberpwned by the @Anonymous twitter group.
Perhaps, even more interesting, is that many of the presentations I’ve seen recently have been referring to the Verizon “2011 Data Breach Investigations Report”.
Why?
Because of this key paragraph from page four:
“We are often asked whether “the Cloud” factors into many of the breaches we investigate. The question is both easy and difficult to answer. The easy answer is ‘No—not really . We have yet to see a breach involving a successful exploit of a hypervisor allowing an attacker to jump across virtual machines (VMs), for instance. On the other hand, we constantly see breaches involving hosted systems, outsourced management, rogue vendors, and even VMs (though the attack vectors have nothing to do with it being a VM or not). In other words, it’s more about giving up control of our assets and data (and not controlling the associated risk) than any technology specific to the Cloud.”
So this paragraph is used to say that Cloud Computing is not a risk. It is secure. It can be trusted.
No wonder all the cloud providers have this paragraph in all of their PowerPoint decks now, something I’ll come back to in the future.
However, it may be more important to note that of the 761 data breaches Verizon examined in 2010, equivalent to nearly the whole number that occurred between 2004 and 2009, most were attacking retail hospitality and financial services.
This chart explains why (double click image to see chart clearly) …
… in other words, you wanna get money? The easiest place to compromise is a merchants’ terminal.
I guess that’s what makes the Merchant Risk Council, the Antiphishing Working Group, the National Anti Fraud Network, the Payments Council, the Serious Organised Crime Agency and others important.
These are all groups coming from different directions – government, police, retailers, financial services, regulators – to try to lockdown the fraudsters.
It’s a tough job though, as there are so many points of leakage.
Five billion and growing.
HT to Kamran Meer, Chief Information Security Officer at Habib Bank, for his references and support in writing this article.
The next meeting of the Financial Services Club, London takes place at Speechly Bircham's Conference Centre, 6 New Street Square, London EC4A 3LX from 6.00 p.m. on Thursday 9th June 2011.
The subject will be: Technology Trends: Fraud and Risk, and Mobile Device Insecurity
This Meeting will be based on two presentations.
How SOCA tackles organised crime with Andy Baker, Deputy Director, SOCA
Andy will outline SOCA’s approach to tackling organised crime in the field of financial technology. He will look at intellectual property crime (IPC), cybercrime and fraud, and take you through how this Executive Non-Departmental Public Body (NDPB) of the Home Office is working to prevent and solve these crimes.
Fraud and Risk, and Mobile Device Insecurity with Joshua Pennell of ISSA UK
They watch you sleep, they watch you work, they hold all your personal and professional data, and they sacrifice security for performance and usability. Your mobile devices present attackers with a 24/7 threat surface (and don't think the hackers haven't noticed). This presentation will dive into the world of mobile device security based on research performed by the IOActive team. It will address common threats, ways to better protect devices and show a demo of an attack in the wild.
If you wish to attend please register as follows: Member or Non-Member
Things we're reading today include ...
It’s fairly obvious that the less you have of something you want, the more you want it; whilst the more you have, the less you need it.
It’s not true of everything I guess as, for example, I don’t have a great deal of tomatoes and don’t want more of them because I don’t like them, but generally it’s true for the law of diminishing returns.
The law of diminishing returns is an age-old economic theory that says you get the greatest satisfaction from satisfying a need the first time. The second, third, fourth and more give you less and less satisfaction.
That’s why the first is always the best, even though we save the best till last.
The only reason I’m going on about this is because I was thinking about poverty.
The less cash you have, the more you need it; the more you have, the less you need it.
That certainly seems to be true as the ultrawealthy don’t need more capital. They want it, simply because it makes them feel better; but they don’t need it.
This is the reason why so many rich people turn into philanthropists as, once you’re sitting on a few billion, it’s more than enough to provide a comfortable retirement. If you’re worthy, you can then dedicate the rest to helping the world.
It’s also the reason why poor people are such easy prey. If you have no money, then it’s one of the things you need more than anything else.
Money gives you the basic essentials of life: food, shelter and, if you have enough, it gives you the better things in life such as entertainment and relaxation.
This is why there is such uproar about payday loan firms. Are they predators preying on the weak and needy, or good agents of release for those who are desperate and need help?
This is a debate raging right now about the largest of such firms, Wonga.
Wonga sponsor Blackpool Football Club (just relegated, shame) and sponsored London’s New Year’s Eve last year.
London Mayor Boris Johnson was conflicted about this. In defending the move on London radio station LBC, he said:
“They’re a legitimate outfit and they are licensed to trade in this City and if they want to reduce the cost of travel for people in London then that seems to me to be something that is perfectly acceptable, but what I would say and I would stress this, anybody listening, people should be aware of the extortionate rates of interest that they can charge and people should not enter into irrational and unwise debt obligations.”
Hmmmm … promoting a company that charges “extortionate rates of interest” in their defence is a bit strange.
In response, company founder Errol Damelin says that his critics “are picking on the wrong people. We are the good guys. Yes, we're in a space that is controversial, that is polarising. But it is an important social service. To have social mobility you have to have credit available to people where it’s required and where it's appropriate.”
No easy answers here.
But when people are desperate, they are desperate.
Some people would do anything for a few bucks.
That’s why poor people gamble three times more than better off people, as demonstrated by the latest results from Camelot, the UK operator of the National Lottery. In this time of austerity, the operator has just posted record sales of £5.8 billion in the year through to March 2011, a 6.8% increase on last year.
Like Pavlov’s conditioning, you can make a desperate person do anything.
You can have baby farms in India or just sell body parts for dollars. Some even sell their kidneys for iPads.
A desperate person will do anything.
Maybe that’s why banks stay out of the unbanked and underbanked, as it’s a market that can get you into trouble. Or maybe it’s a reason why banks should get into serving the unbanked and underbanked, as it’s a market that needs regulated assistance.
Either way, this is a debate that’s been going on for a long time, and will rage well into the future.
A song that was inspired by Aloe Blacc being made redundant by Ernst & Young.
Charlie Palloy's “Brother, Can You Spare A Dime?” from 1932 [The Last Great Depression]
Things we're reading today include ...
Recent Comments