The state of mobile payments in 2015

CurrentC coming summer 2015

CurrentC is expected to be available in mid 2015, and it will combine mobile payments and loyalty benefits. Merchant Content Exchange (MCX), a company owned by a consortium of U.S. retailers including CVS, Best Buy, Lowe's, Sears, Target, and Walmart, backs the CurrentC platform.

Small-scale trials are currently underway in undisclosed U.S. markets, according to IDG News Service, but some critics express doubts about CurrentC. "MCX seems completely unaware of how people actually shop at its partner stores," Forbes says. CurrentC doesn't support credit cards, to help merchants avoid those fees. Instead, CurrentC uses debit cards, which don't provide the same level of fraud protection as credit cards. The system will also initially use QR codes instead of NFC or another wireless technology.

Disney 'MagicBand' at the Magic Kingdom
"If you want to imagine how the world will look in just a few years ... skip Silicon Valley and ... (go) to Disney World," according to Wired.

Disney World guests can wear a "MagicBand," a waterproof, plastic wristband that contains a short-range RFID chip and a 2.4-GHz wireless transmitter. MagicBand is also a mobile payment system, and it lets guests at Disney resorts purchase food, beverages and merchandise, and gain admission to attractions.

"You don't need to carry cash, because the MagicBand is linked to your credit card," Wired says. "You don't need to wait in long lines."

Apple Pay lifts Google Wallet
Google Wallet, a mobile-payment and wallet system that uses NFC to enable payments between compatible devices and point-of-sale (PoS) readers, was released in 2011. However, the system failed to gain traction, partially because some wireless providers supported the then-rival Softcard payment system, previously (and unfortunately) known as Isis.

In February 2015, Google acquired Softcard, integrated it with Google Wallet and announced its Wallet app would be preinstalled on compatible devices from AT&T, T-Mobile and Verizon Wireless later this year. You can use Gmail attachments to send money from your Google Wallet, too, even if the recipient doesn't use Gmail. Apple Pay's success ironically ignited interest in Google Wallet, and today more stores accept NFC payments from both competitors.

Jawbone, UP4 and Amex
Jawbone, which makes fitness trackers, portable speakers and other consumer electronics, recently entered the world of mobile payments. In mid April, the company announced that its upcoming UP4 ($200) activity-tracker wristband would let wearers make contactless payments via pre-registered American Express cards at PoS terminals this summer. UP4 will use Jawbone's app to link Amex cards to UP4 for NFC wireless payments. (Microsoft Band is another wearable with some mobile payment capabilities.)

For UP4 transactions, Amex will provide retailers with tokens instead of consumers' credit card numbers, according to PC World, and Jawbone says it won't store credit card numbers or receive sensitive data about user transactions.

'Microsoft Payment,' Windows 10 and 'tap to pair'
Microsoft will likely enter the mobile payments space in a big way. Here's the gist of what's known so far, according to The Motley Fool: The payment platform may be called "Microsoft Payment;" the company filed official forms to become a money transmitter in the United States and already received permission to act as one in Idaho; and Windows 10's "tap to pair" feature could be used to transmit payments via NFC.

From PC World: "For now, we can only imagine what Microsoft might do. Perhaps the company is cooking up a direct mobile payment competitor to Apple Pay — though any effort on that front may be hamstrung by Windows Phone's meager adoption."

Microsoft's Band wearable already lets you pay for goods at Starbucks.

PayPal, Paydiant and mobile payments
PayPal has been an ecommerce force for years. In March, news broke of PayPal's plan to acquire startup Paydiant, a platform that companies use to build branded mobile-payment and loyalty-card services. Subway, Capital One and retail consortium Merchant Customer Exchange (MCX) already use Paydiant's platform, according to the IDG News Service. Paydiant lets consumers pay for items via their mobile devices using NFC and QR codes.

PayPal also said in March that it would sell NFC-equipped versions of its credit card readers to merchants.

Samsung Pay, NFC and MST
In March, Samsung announced Samsung Pay, which uses two different wireless technologies: NFC and magnetic secure transmission (MST). Startup LoopPay developed the latter, which has been embedded as a copper ring inside the new Samsung Galaxy S6 smartphones, according to Computerworld.

Samsung Pay is expected to be available in the United States and South Korea this summer. The system's support for NFC and MST means Galaxy S6 users will be able to make purchases at many more retail locations than Apple Pay users, because Apple Pay requires NFC-enabled terminals.

"Samsung Pay certainly heats up the competition," Avivah Litan, Gartner analyst, told Computerworld. "But Samsung still has a lot of work to do to improve the user experience before it can effectively compete with Apple."

Hip to be Square for mobile payments
Square's PoS card readers are already a hit with small businesses, including food trucks, restaurants and other local retailers. The Square Wallet mobile app, introduced in 2011, didn't catch on with consumers, however, so the company pulled it and replaced it in 2014 with Square Order, an app that lets people preorder drinks and food from local vendors. Then in March 2015, Square shut down that app, too. The company currently focuses on its Square Cash peer-to-peer mobile payments app for consumers and businesses, as well as its various PoS systems for merchants, including the Square Register app.

Starbucks leads by example
Wired says Starbucks is "the master of mobile payments." A Forbes headline says "Once Again, Starbucks Shows Google And Apple How To Do Mobile Payment." So what's the big deal?

The coffee chain says it nabbed as much as 90 percent of the $1.6 billion spent in U.S. stores via smartphone in 2013. CEO Howard Schultz says the company's loyalty program drives mobile payments. Coffee drinkers purchase Starbucks cards, load them with funds from a credit card, then scan barcodes in the Starbucks app or iOS Passbook wallet to pay for food and drinks at its cafes. The more they buy, the more points they earn toward freebies.

Starbucks is also reportedly testing beverage delivery (via the Postmates service) as an extension of its mobile payment offering.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

VCP510 VMware Certified Professional 5 - Data Center Virtualization

---

QUESTION 1
Which VMware solution uses the security of a vSphere implementation and provides linked-clone
technology to virtual desktops?

A. VMware ACE
B. VMware View
C. VMware Workstation
D. VMware ThinApp

Answer: B

Explanation:
Reference:http://www.vmware.com/files/pdf/VMware-View-4-Composer-DS-EN.pdf(page 1, last
paragraph)

---

QUESTION 2
An administrator has recently upgraded their Update Manager infrastructure to vSphere 5.x.
Several hosts and virtual machines have not been upgraded yet.
Which vSphere component when upgraded will have the least impact to the existing environment?

A. Virtual Machine Hardware
B. ESX Hosts
C. VMFS datastores
D. VMware Tools

Answer: D

Explanation:
VMware Tools isn't a single application but a set of drivers, services and user processes that's
installed in a guest operating system. They add a wide assortment of functionality to VMware
infrastructures -- everything from improving color depth and video resolution in the vSphere Client
to memory optimization.
Typically, an outdated version of VMware Tools doesn't have an immediate impact. But with every
update to vSphere, you'll likely have to update VMware Tools on every virtual machine.

---

QUESTION 3
An administrator is using Update Manager 5.x to update virtual appliances in a vSphere
environment. The environment is using the vCenter Server Virtual Appliance (vCSA).
What would cause the remediation to fail?

A. Updating of the appliance can only be done if the vCenter Server Virtual Appliance (vCSA) has
been put into Maintenance Mode.
B. Remediation must be configured on the Appliance Administration page before use.
C. Remediation of the vCenter Server Virtual Appliance (vCSA) with Update Manager is not
supported.
D. Remediation requires the hosts to be connected to vCenter using an IPv4 address.

Answer: D

Explanation:
Update Manager 5.0 does not support virtual machine patch baselines.If a host is connected to
vCenter Server by using an IPv6 address, you cannot scan and remediate virtual machines and
virtual appliances that run on the host.

---

QUESTION 4
An administrator is working to update the hosts and virtual machines in a vSphere 5.x deployment
using Update Manager Baselines.
Other than host patches, which three items require a separate procedure or process to update?
(Choose three.)

A. Operating system patches
B. Virtual Appliance updates
C. Virtual Machine Virtual Hardware upgrades
D. VMware Tools on machines without VMware Tools already installed
E. Application patches within the virtual machine

Answer: A,D,E

Explanation:
Operating system patches are related to operating system so they need a separate procedure
altogether. Same is the case with VMware tools and applications patches because applications
are stand alone pieces of code that need separate procedure to apply a patch.

---

QUESTION 5
A series of Auto Deploy ESXi 5.x hosts, which utilize vSphere Standard Switches, are unable to
boot. In prior testing, all of the hosts were able to boot successfully.
Which two conditions might cause this issue? (Choose two.)

A. The Hosts are unable to connect to the SAN.
B. The TFTP server is down.
C. The DNS server is down.
D. The DHCP server is down.

Answer: B,D

Explanation:
If the TFTP server is down, ESXi will not boot because it needs TFTP to get the information.
Similarly, when DHCP is down, it will not assign the IP addresses and ESXi needs IP address to
boot properly.

---

Best VMware Certification, VMware VCP510  Training at certkingdom.com

Detecting advanced threats with user behavior analytics

Using big data and machine learning to assess the risk, in near-real time, of user activity

This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.

Day after day, an employee uses legitimate credentials to access corporate systems, from a company office, during business hours. The system remains secure. But suddenly the same credentials are used after midnight to connect to a database server and run queries that this user has never performed before. Is the system still secure?

Maybe it is. Database administrators have to do maintenance, after all, and maintenance is generally performed after hours. It could be that certain maintenance operations require the execution of new queries. But maybe it isn’t. The user’s credentials could have been compromised and are being used to commit a data breach.

With conventional security controls there’s no clear cut answer. Static perimeter defenses are no longer adequate in a world where data breaches increasingly are carried out using stolen user credentials. And they have never been of much use against malicious insiders, who abuse their privileges. Today’s BYOD environment can also leave a static perimeter in tatters as new rules have to be continually added for external access.

A new approach called User Behavior Analytics (UBA), can eliminate this guesswork using big data and machine learning algorithms to assess the risk, in near-real time, of user activity. UBA employs modeling to establish what normal behavior looks like.

This modeling incorporates information about: user roles and titles from HR applications or directories, including access, accounts and permissions; activity and geographic location data gathered from network infrastructure; alerts from defense in depth security solutions, and more. This data is correlated and analyzed based on past and on-going activity.

Such analysis takes into account -- among other things -- transaction types, resources used, session duration, connectivity and typical peer group behavior. UBA determines what normal behavior is, and what constitutes outlier or anomalous activity. If one person’s anomalous behavior (i.e., midnight database queries) turns out to be shared by others in their peer group, it is no longer considered medium or high risk.

Next, UBA performs risk modeling. Anomalous behavior is not automatically considered a risk. It must first be evaluated in light of its potential impact. If apparently anomalous activity involves resources that are not sensitive, like conference room scheduling information, the potential impact is low. However, attempts to access sensitive files like intellectual property, carries a higher impact score.

Consequently, risk to the system posed by a particular transaction is determined using the formula Risk = Likelihood x Impact.

Likelihood refers to the probability that the user behavior in question is anomalous. It is determined by behavior modeling algorithms.

Meanwhile, impact is based on the classification and criticality of the information accessed, and what controls have been imposed on that data.

Transactions and their computed risks can then be associated with the user who is making the transactions, to determine the risk level. The calculation of user risk typically includes additional factors, such as asset classification, permissions, potential vulnerability, policies, etc. Any increase in these factors will increase the risk score of that user.

Custom weighting values can be used for all the factors in these calculations, to automatically tune the overall model.

In the end, UBA collects, correlates, and analyzes hundreds of attributes, including situational information and third-party threat information. The result is a rich, context-aware petabyte-scale dataset.

UBA’s machine learning algorithms can not only weed out and eliminate false positives and provide actionable risk intelligence, but also revise norms, predictions, and overall risk scoring processes based on the information collected.

Changes in information classification as well as operational changes (such as new departments, new job codes, or new locations) are automatically incorporated into the system’s datasets. For example, if an IT administrator is temporarily granted a higher level of system access, their risk scores will be altered during that period of time. UBA can also, in automated fashion, determine what custom weighting values have the most operational significance in reducing false positives.

The resulting intelligence can be mined off-line for insights into the enterprise’s security posture, often uncovering unsuspected vulnerabilities, such as the provisioning of more user groups than users, the presence of unused credentials, or users with significantly more or fewer access privileges than they should.

Less obvious malicious behavior, such as sabotage, the theft of an enterprise’s trade secrets, or longer-term activity like financial fraud, will also produce patterns of anomalous behavior that a UBA system can detect.

Finally, if a user is found to pose a significant risk, the system can react accordingly, from blocking further access to imposing risk-based adaptive authentication that will challenge them for a second form of identification. The user’s post-login activities may also be restricted.

UBA is transforming security and fraud management because it enables enterprises to detect when legitimate user accounts/identities have been compromised by external attackers or are being abused by insiders for malicious purposes.

Gurucul is a provider of identity-based threat deterrence technology. The author is a recognized expert in information security, identity and access management, and security risk management. Prior to founding Gurucul, Saryu was a member of the founding team at Vaau, an enterprise role-management start-up acquired by Sun Microsystems. She has held leadership roles in product strategy for security products at Oracle and Sun Microsystems and spent several years in senior positions at the IT security practice of Ernst & Young.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

How data breaches break down by state and sector

The number of data breaches since 2005 are sliced and diced by state and sector, but nobody should be really surprised by the results.

Leaking breaches everywhere
Morgan & Morgan, a personal injury law firm, has compiled data that shows 930 million records have been breached since 2005. In 2010, if you received a notification of a data breach, your chances of becoming a victim of fraud were one in nine. By 2012, those odds had shrunk to one in four. Now, in 2014, it’s one in three. Here is a breakdown by state and sector of the data breaches in the past 10 years.

Data breaches by state
Court Ventures, with 200 million records, pushes California to the top of the state rankings table. Separating the breaches by sector reveals more. We’ll start with Education. (The darker colors indicate the higher number of breaches.)

Data breaches in education
Despite UCLA having the single largest breach since 2005, California doesn’t rank number one overall—Arizona does. That’s thanks to the Maricopa County Community College District. Their security breach in 2013 exposed the personal information of 2.4 million people. In May 2014, a class action lawsuit was filed against them by two students, who sought $2,500 each in compensation.

Data breaches in the financial and insurance sector
New Jersey is currently in first position for total records breached in the financial and insurance sector, thanks to the hack of Heartland Payment Systems in 2009, which may have been the result of a global cyber fraud operation. As of April 2012, the total sum of money awarded to victims of the breach was $1,925.

Despite the breach affecting 130 million people and the settlement notice reaching at least 81.4% of them, only 11 valid claims were submitted and processed.

Government and military breaches
The state, so to speak, at the top of the list for Government and Military data breaches is, as you might have guessed, Washington DC. The agency responsible for most of the compromised records is U.S. Military Veterans, who in 2009 sent a defective hard drive containing a very large Oracle database back to its vendor to be fixed. The vendor determined it couldn’t be repaired and sent it to another firm for recycling. Along the way, 76 million records from the Oracle database on the drive were exposed.

Non-profit breaches
Non-profit organizations have survived relatively unscathed since 2005, with Missouri, in first place, losing ‘only’ 1 million records in data breaches in the last nine years. The 1 million records that were compromised in Missouri were accessed by a dishonest employee of the St. Louis chapter of the Red Cross, who used the information of at least three of the 1 million people affected to commit identity theft.

Breaches in the medical field
It’s believed that Chinese hackers were responsible for the data breach earlier this year of 4.5 million records held by Community Health Systems in Tennessee (putting the state in first place, just ahead of California). Five Alabama residents have filed a class action lawsuit as a result of the breach.

Retail breaches
There has been a slew of retail chain data breaches since late 2013, mostly involving credit and debit card fraud. In January 2014, Target announced a breach affecting 70 million customers, but that still didn’t put them, and the state their headquarters reside in, at the top of the rankings above.

That dubious accolade belongs to TJ Maxx, based in Massachusetts, which suffered a breach of about 100 million records in 2007.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com