Adam Shostack's latest post reminds us that It Depends What The Meaning of "Credit Report" Is.
For what purpose were social security numbers originally created - was it perhaps something to do with social security?
Social security numbers have been widely reused and repurposed as general personal identifiers, especially in the context of financial services. For this reason, many people are thinking of identity theft as something executed for the purposes of financial fraud.
But someone called Pablo is apparently using Margaret's social security number for an entirely different purpose - to pose as a legal migrant. This interferes (not surprisingly) with Margaret's ability to claim unemployment benefit.
Any piece of data - and especially an identifier - changes its meaning when it is used for a different purpose in a different context. This is of course nothing new - but the opportunities to repurpose data are hugely amplified by the latest service-oriented protocols including XML and web services.
This story should remind us that we need to be purpose-agnostic, not just when we are designing service-oriented data systems, but also when we are thinking of security threats against such systems.
See also
Purpose-Agnostic (July 2005)
Collaboration and Context (January 2006)
Context and Presence (Category)
No comments:
Post a Comment