Tim Tickel

IDTrust is an SSI (Self-Sovereign Identity) framework deployed on the Hedera Hashgraph network, leveraging distributed ledger consensus for high throughput, low-latency credential issuance and verification. It enables decentralized identifiers (DIDs) and verifiable credentials (VCs) in line with W3C standards, allowing identity proofs to be cryptographically signed and verified without a central authority. WISeID is WISeKey’s PKI and credential management infrastructure, which uses an X.509 certificate hierarchy anchored in the WISeKey Root of Trust. It supports multi-factor authentication, strong cryptographic key storage (including on secure hardware elements), and issuance of device/user certificates via OCSP/CRL for revocation control. It also includes mobile and hardware token integration for signing and encryption, allowing it to bind identities securely to both humans and IoT endpoints. SEALCOIN is a DePIN (Decentralized Physical Infrastructure Network) and IoT transaction platform that runs on Hedera. It uses the QAIT token for micropayments, metering, and autonomous machine-to-machine transactions. SEALCOIN’s architecture integrates post-quantum cryptography and WISeID PKI to authenticate devices before allowing them to transact, ensuring integrity of both the transaction metadata and payload. Transactions are recorded on Hedera’s gossip-about-gossip consensus layer, providing tamper-evident logs while keeping computational overhead low compared to proof-of-work chains. From a technical standpoint, WISeID could interoperate with IDTrust by acting as a trusted credential issuer (anchoring PKI certificates as verifiable credentials on Hedera) and SEALCOIN could serve as the settlement layer for identity-driven transactions within IDTrust-enabled ecosystems. https://lnkd.in/eqWPXjMF

12

3 Comments

FINRA firms should be aware of a vulnerability in web applications built with React Server Components (RSC), which could allow unauthorized access to internal systems. Nation-state threat actors are purportedly exploiting this vulnerability to gain access to systems and sensitive files on servers built using RSC. The vulnerability has the potential to allow threat actors to take control of a firm’s entire system if exploited. ▶️ Learn more: https://bit.ly/491YXrX

39

PCI DSS has a fundamental design flaw. Enforcement is outsourced to acquiring banks, who have every commercial reason not to irritate their merchant customers. They don’t want to build or fund large teams of PCI specialists capable of accurately assessing the compliance of millions of merchants, so they push the burden downstream. Merchants are told to self‑assess, which means the people least equipped to understand PCI DSS end up determining their own compliance status. The results are predictable. The downstream ecosystem has repeatedly shown it cannot be trusted to secure cardholder data. If an ecosystem consistently fails to meet the minimum bar, the logical conclusion is that it shouldn’t be allowed anywhere near sensitive payment data in the first place. What makes this even more absurd is that banks absolutely could design a tamper‑proof, foolproof, merchant‑proof payment system. The technology exists. The cryptography exists. The outsourcing options exist. What doesn’t exist is the incentive. The current model is profitable and low‑liability. Fraud losses, compliance costs, breach penalties and operational burdens are all pushed onto merchants. A truly secure system would flip that responsibility back onto the banks and card brands, but they have no interest in owning that liability. On top of that, a foolproof system would wipe out the entire PCI compliance industry, which has become a revenue stream in its own right. So we’re left with a system built on 1970s architecture, protected by a standard that relies on self‑attestation, enforced by organisations with no incentive to enforce it, and surrounded by an ecosystem that has proven it cannot secure the data it handles. If the industry genuinely wants secure payments, it needs to stop pretending PCI DSS is a security standard and start treating it for what it is: a liability‑shifting mechanism. Real security will only arrive when the organisations with the power to fix the system are also the ones who bear the consequences when it fails. #payments #security #pcidss #compliance #fintech #cybersecurity #riskmanagement #dataprotection #infosec #governance #standards #paymentsindustry #merchantservices #regulation #technology

21

15 Comments

After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV).  Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program

145

11 Comments

Friendly reminder that stablecoins are effectively loans from the issuer to you. Since Circle/Tether can freeze funds at any time, they hold the kill switch on your liquidity. We haven't seen this weaponized at scale yet, but the infrastructure to target political adversaries, enforce sudden sanctions, or respond to regulatory pressure is already built-in. It’s a feature, not a bug. https://lnkd.in/gBSFjBPm

4