Language Selection

English French German Italian Portuguese Spanish

GAO study of RFID technology, policy seen flawed

Filed under
Security

A recently released Government Accountability Office study of radio frequency identity device security is flawed because it omits discussion of technologies and federal policies in the arena, according to smart-card industry executives.

GAO defended the report, saying it relied on information provided by other federal agencies and did not delve deep into individual RFID programs that the agencies are implementing.

The GAO report, titled Information Security: Radio Frequency Identification Technology in the Federal Government, discusses privacy and security aspects of RFID tags used for inventory control as well as contactless smart cards used to make personnel credentials. GAO issued the report May 27.

The report cites several privacy and security issues that RFID units can pose, such as "tracking an individual's movements, profiling an individual's habits, tastes or predilections and allowing for secondary uses of information." According to GAO, "While measures to mitigate these issues are under discussion, they remain largely prospective."

But as Patrick Hearn, business development director for Oburthur Card Systems of Chantilly, Va., stated, federal law, regulations and policies mandate many privacy and security protections for the use of smart cards in federal credentialing programs.

"The security measures-encryption and authentication-listed [by GAO as 'prospective'] all exist today and are incorporated into programs such as the State Department's e-passport program," Hearn wrote in an e-mail comment on the GAO report.

Hearn also cited the existence of the Federal Information Processing Standard 140-2, which applies to contactless smart cards issued to federal employees and contractors, as well as privacy and security rules mandated in the Federal Identity Management Handbook.

Hearn noted that the standards that apply to federal use of contactless smart cards mandate compliance with the Privacy Act of 1974, the e-Government Act of 2002, Office of Management and Budget memorandums relevant to the topic and National Institute of Standards and Technology standards for smart-card security and privacy.

Full Article.

More in Tux Machines

Canonical Patches Nvidia Graphics Drivers Vulnerability in All Ubuntu Releases

It's time to update your Ubuntu Linux operating system if you have a Nvidia graphics card running the Nvidia Legacy 340 or 304 binary X.Org drivers provided on the official software repositories. Read more

Long-term Embedded Linux Maintenance andd New Device From CompuLab

  • Long-term Embedded Linux Maintenance Made Easier
    The good old days when security breaches only happened to Windows folk are fading fast. Malware hackers and denial of service specialists are increasingly targeting out of date embedded Linux devices, and fixing Linux security vulnerabilities was the topic of several presentations at the Embedded Linux Conference Europe (ELCE) in October. One of the best attended was “Long-Term Maintenance, or How to (Mis-)Manage Embedded Systems for 10+ Years” by Pengutronix kernel hacker Jan Lübbe. After summarizing the growing security threats in embedded Linux, Lübbe laid out a plan to keep long-life devices secure and fully functional. “We need to move to newer, more stable kernels and do continuous maintenance to fix critical vulnerabilities,” said Lübbe. “We need to do the upstreaming and automate processes, and put in place a sustainable workflow. We don’t have any more excuses for leaving systems in the field with outdated software.”
  • CompuLab Has Upgraded Their Small Form Factor "IPC" Line To Kabylake
    HARDWARE -- Our friends and Linux-friendly PC vendor, CompuLab, have announced a new "IPC" line-up of their small form factor computers now with Intel Kabylake processors. In the past on Phoronix we tested CompuLab's Intense-PC (IPC) and then the IPC2 with Haswell processors, among other innovative PCs from CompuLab. Now they are rolling out the IPC3 with Intel's latest Kabylake processors.
  • Fanless mini-PC runs Linux Mint on Kaby Lake
    Compulab launched a rugged “IPC3” mini-PC that runs Linux on dual-core, 7th Gen Core i7/i5 CPUs, and also debuted three GbE-equipped FACE expansion modules. Compulab has opened pre-orders starting at $693 for the first mini-PCs we’ve seen to offer the latest, 14nm-fabricated 7th Generation Intel Core “Kaby Lake” processors. The passively cooled, 190 x 160 x 40mm IPC3 (Intense PC 3), which is available in up to industrial temperature ranges, follows two generations of similarly sized IPC2 mini-PCs. There’s the still available, 4th Gen “Haswell” based IPC2 from 2014 and the apparently discontinued 5th Gen “Broadwell” equipped IPC2 from 2015.
  • Compulab IPC3 is a tiny, fanless PC with Intel Kaby Lake CPU
    Compulab is an Israeli company that makes small, fanless computers for home or commercial use. The company’s latest mini PC aimed at enterprise/industrial usage is called the IPC3, and it has a die-cast aluminum case with built-in heat sinks for passive cooling and measures about 7.4″ x 6.3″ x 1.6″.

Games for GNU/Linux

  • Imperium Galactica II: Alliances released for Linux & SteamOS, seems native too
    Imperium Galactica II: Alliances [GOG, Steam] just released for Linux & SteamOS and it looks like it's a native version. Note: My friends at GOG sent over a copy, so big thanks to them. There's no sign of DOSBox or Wine and I had no idea this game had ever been ported to Linux. Pretty awesome really for a game like this to get a proper Linux build when it gets a new release.
  • Nearly five years after the Kickstarter, Carmageddon still isn’t on Linux despite the stretch goal being reached
    The problem here, for me, is that they later did a revamp of the title called Carmageddon: Max Damage. This was to fix some problems, boost sales again and port it to consoles. Carmageddon: Max Damage also never made it to Linux. Fun fact, they actually released a trailer where they just run over a ton of penguins, make from that what you will: Not saying this was trolling the entire Linux gaming community, but it sure felt like it after their previous trolling attempts directed at our official Twitter account.
  • Valve Rolls Out New Steam Client Stable Update with Promised Linux Changes, More
    Today Valve announced the availability of a new stable update of the Steam Client for all supported platforms, including the company's SteamOS operating system for Steam Machines, as well as GNU/Linux, macOS, and Microsoft Windows. Bringing all the new features during the Beta stages of development, the new Steam Client update improves the interaction between the Steam runtime and your GNU/Linux distribution's libraries. This is a huge and long-anticipated milestone for the Steam Client, which, unfortunately, did not work out-of-the-box on all Linux-based operating systems.

Robolinux 8.7.1 Linux OS Is Out and It's Based on Debian GNU/Linux 8.7 "Jessie"

The developers of the Robolinux GNU/Linux distribution have announced today, January 18, 2017, the release and immediate availability of a new stable update based on the latest Debian GNU/Linux 8 "Jessie" operating system series. Still offering a free installer, the Robolinux 8.7.1 "Raptor" edition is now available for download with the usual Cinnamon, MATE 3D, Xfce 3D, and LXDE flavors. It's based on the recently released Debian GNU/Linux 8.7.1 "Jessie" operating system, which means that it ships with its newest Linux 3.16 kernel and over 170 bug fixes and security patches. The GRUB bootloader and login screens have been refreshed too. Read more