This is a brief presentation which gives some background and examples on AP takeover attacks. There is a full academic report which I will post up soon and cross link as soon as possible.

The following is a mock memo to the CEO of a credit card company. This letter provides a high level overview of the Red Flags rule (see references for background information) and is meant to gain executive management's support in implementing the regulated requirements for complaince with the FACT 2003 Law.

Identity Theft and Compliance with Red Flags Rule Requirements

This memo addresses concerns and requirements related to the Red Flags Rule, which is a component of the “Fair and Accurate Credit Transactions Act of 2003” (FACT 2003). As a creditor organization, we are required to meet certain requirements outlined in sections 114 and elsewhere in the FACT 2003 law. In order to comply with this rule we are required to implement a set of policies and procedures in order to prevent, detect, and mitigate identity theft and data breaches related to our customers’ private and personal information. The FTC originally set a deadline for compliance of November 1, 2008; however, this date has been extended to May 1, 2009. Therefore, it is crucial that we rapidly develop and implement our identity theft prevent program before this date.

Introduction

This summary report will provide a broad overview of public sector and private sector data breach incidents in the United States. The report aims to better educate readers on the extent of the attacks, what vulnerabilities and specifics allow for these attacks, and finally to explain the consequences of these attacks. It should be noted that while many institutions are required to report data breaches, not all attacks are accounted for publicly or are even discovered internally. As the reported numbers and actual number of incidents continue to increase it becomes increasingly important to study past incidents in order to prevent or limit future data breach attacks.

The following presentation is designed to give an overview on the Fair Information Practices. This presentation was originally used in a class project on the creation of an Omnibus Privacy Law in the United States. The Fair Information Practices were originally developed in the United States, but were not actively enacted through laws and regulations there. However, the concepts took hold in the European Union. You can get an overview on the Fair Information Practices here. This presentation was designed to be presented at a congressional hearing in order to help bring the members of congress upto speed on the topic.