Epson Stylus SX405 – packs a punch

Epson have always offered good value multifunction inkjet printers and their new offering the Stylus SX405 seems to follow in the footsteps of its predecessors. It offers the functionality of three machines in one and with a very reasonable price tag too, costing just £70 from competitive retailers. Running costs for these types of printers is usually very high but the SX405 manages to reduce it running cost by using four individual printer ink cartridges. This is an advantage as is means that only the colors that get used need to be replaced therefore keeping the cost to a minimum. The cost of the Epson SX405 ink cartridges themselves is about average for a printer in this class, but if you want to save money there are compatible Epson inks available for half the price of the originals. It terms of functionality the SX405 has the edge on it competitors, it offers a wide range of features including photo quality printing as well as scanning photo copying and direct photo printing from memory cards an digital cameras thanks to its built in memory card reader and PictBridge connection. In terms of its performance it falls down slightly as its slower than a lot of the other printers in this class, although it makes up for this by producing superior print quality. The scanner and photo copier are good performers with the scanner producing sharp accurate results on a wide range of documents and images and the photo copier strikes a good balance between speed and quality. Overall the SX405 is a good performer and offers good value for money.

Testing the Epson Stylus S21

Epson budget inkjets from the past have always been good performs but lacked value for money in terms of running costs in the price of their printer ink cartridges. Being a budget printer many people will buy it thinking that Epson S21 ink cartridges with be cheaper than replacement printer cartridges for other more expensive printers, and then be shocked to find that they are the same cartridges that are used by a lot of the more expensive printers so therefore cost the same. The S21 is a budget printer so doesn’t has a huge array of features, it just prints. Easy to set up The S21 is plug and play compatible and connects using standard USB connection. Power to the printer is supplied via its own power cable and the installation using the step by step software instruction is simple enough. It is well built and the quality of the materials feel as though they should withstand frequent use with the exception of the paper feed which clips onto the back of the machine and feels a bit flimsy. The downsides of the S21 are the operating noise and the print in which it speeds. The noise is particularly bad when the printer loads a sheet of paper. The printing speed is very poor even for a budget printer, Epson state the S21 as being bale to produce 25 pages per minute, where they got that figure from because in the real world the S21 produces only 3 pages per minute in standard quality setting printing black text. Overall the Stylus S21 is not a bad printer is just not a very good one and it is well worth considering spending a little bit more money and getting a lot more fro your money.

Smart Card Security

Smart cards provide computing and business systems the enormous benefit of portable and secure storage of data and value. At the same time, the integration of smart cards into your system introduces its own security management issues, as people access card data far and wide in a variety of applications.

The following is a basic discussion of system security and smart cards, designed to familiarize you with the terminology and concepts you need in order to start your security planning.

What Is Security?

Security is basically the protection of something valuable to ensure that it is not stolen, lost, or altered. The term "data security" governs an extremely wide range of applications and touches everyone's daily life. Concerns over data security are at an all-time high, due to the rapid advancement of technology into virtually every transaction, from parking meters to national defense.

Data is created, updated, exchanged and stored via networks. A network is any computing system where users are highly interactive and interdependent and by definition, not all in the same physical place. In any network, diversity abounds, certainly in terms of types of data, but also types of users. For that reason, a system of security is essential to maintain computing and network functions, keep sensitive data secret, or simply maintain worker safety. Any one company might provide an example of these multiple security concerns: Take, for instance, a pharmaceutical manufacturer:

Type Of Data	Security Concern	Type Of Access
Drug Formula	Basis of business income. Competitor spying	Highly selective list of executives
Accounting, Regulatory	Required by law	Relevant executives and departments
Personnel Files	Employee privacy	Relevant executives and departments
Employee ID	Non-employee access. Inaccurate payroll, benefits assignment	Relevant executives and departments
Facilities	Access authorization	Individuals per function and clearance such as customers, visitors, or vendors
Building safety, emergency response	All employees	Outside emergency response

What Is Information Security?

Information security is the application of measures to ensure the safety and privacy of data by managing it's storage and distribution. Information security has both technical and social implications. The first simply deals with the 'how' and 'how much' question of applying secure measures at a reasonable cost. The second grapples with issues of individual freedom, public concerns, legal standards and how the need for privacy intersects them. This discussion covers a range of options open to business managers, system planners and programmers that will contribute to your ultimate security strategy. The eventual choice rests with the system designer and issuer.

The Elements Of Data Security

In implementing a security system, all data networks deal with the following main elements:

1. Hardware, including servers, redundant mass storage devices, communication channels and lines, hardware tokens (smart cards) and remotely located devices (e.g., thin clients or Internet appliances) serving as interfaces between users and computers



2. Software, including operating systems, database management systems, communication and security application programs



3. Data, including databases containing customer - related information.



4. Personnel, to act as originators and/or users of the data; professional personnel, clerical staff, administrative personnel, and computer staff

The Mechanisms Of Data Security

Working with the above elements, an effective data security system works with the following key mechanisms to answer:

1. Has My Data Arrived Intact? (Data Integrity) This mechanism ensures that data was not lost or corrupted when it was sent to you



2. Is The Data Correct And Does It Come From The Right Person? (Authentication) This proves user or system identities



3. Can I Confirm Receipt Of The Data And Sender Identity Back To The Sender? (Non-Repudiation)



4. Can I Keep This Data Private? (Confidentiality) - Ensures only senders and receivers access the data. This is typically done by employing one or more encryption techniques to secure your data



5. Can I Safely Share This Data If I Choose? (Authorization and Delegation) You can set and manage access privileges for additional users and groups



6. Can I Verify The That The System Is Working? (Auditing and Logging) Provides a constant monitor and troubleshooting of security system function



7. Can I Actively Manage The System? (Management) Allows administration of your security system

source : http://www.smartcardbasics.com/security.html

System Planning & Deployment

Smart card system design requires advance planning to be successful and to avoid problems. It is highly recommended that you graphically diagram the flow of information for your new system. The first question to consider is 'will the card and system transact information, or value, or both?' If it stores keys or value (i.e.; gift certificates or sports tickets), greater design detail is required than in data-only systems. When you combine information types on a single card, other issues arise. The key to success is not to overrun the system with features that can confuse users and cause problems in management. We recommend that you phase-in each feature set as each one is working. To properly implement a functional smart card system you should be able to answer the following questions. NOTE: These are only general guidelines, provided as a basis for your individual planning. Many other steps may be involved and are not mentioned here. For more extensive planning information regarding identity management and national IDs we recommend that you review the GSA Smart Card Handbook.

Basic Set-Up

1. Is there a clear business case? Including financial and consumer behavior factors?


2. Will the system be single or multi-application?


3. What type of information do I want to store in the cards (ie; data or value)?


4. How much memory is required for each application?


5. If multi-application, how will I separate different types of data?


6. Will card data be obtained from a database? Or loaded every time?


7. Will this data concurrently reside on a database?


8. How many cards will be needed?


9. Are card/infrastructure vendors identified? What are the lead times?

Security Planning

1. What are the security requirements?


2. Does all, or only some of the data need to be secure?


3. Who will have access to this information?


4. Who will be allowed to change this information?


5. In what manner shall I secure this data i.e. encryption, Host passwords, card passwords/PINs or all of these?


6. Should the keys/PINs be customer or system-activated?


7. What form of version control do I want?

Value Applications

1. Should the value in the cards be re-loadable or will the cards be disposable?


2. How will I distribute the cards?


3. How will cards be activated and loaded with value?


4. What type of card traceability should I implement?


5. What is the minimum and maximum value to store on each card?


6. Will there be a refund policy?

General Issuance

1. How many types of artwork will be included in the issuance?


2. Who will do the artwork?


3. What is needed on the card? For example signature panels, Magnetic-Stripe, Embossing etc.

Multi-Application Card Systems

It is highly recommended that you graphically diagram the flow of information as shown below.

Building a smart card system that stores value i.e. gift certificates, show tickets, redemption points or cash equivalents requires an attention to detail not necessary in other information management systems. The key to success is not to overrun the system with features that can confuse users and cause problems in management. We recommend that you phase-in each feature set after the first one is working. Here is a list of some questions that are pertinent to these systems in addition to the above questions.

Deployment

As the minimum steps in deploying a stored value or multi-application system,
establish clear achievable program objectives;

1. Make sure the organization has a stake in the project's success and that management buys into the project


2. Set a budget


3. Name a project manager


4. Assemble a project team and create a team vision


5. Graphically create an information - card and funds-flow diagram


6. Assess the card and reader options


7. Write a detailed specification for the system


8. Set a realistic schedule with inch-stones and mile-stones


9. Establish the security parameters for both people and the system


10. Phase-in each system element, testing as you deploy


11. Reassess for security leaks


12. Deploy the first phase of cards and test, test


13. Train the key employees responsible for each area


14. Set-up a system user manual


15. Check the reporting structures


16. Have contingency plans should problems arise


17. Deploy and announce


18. Advertise and market your system

Smart Card Standards

Primarily, smart card standards govern physical properties, communication characteristics, and application identifiers of the embedded chip and data. Almost all standards refer to the ISO 7816-1,2 & 3 as a base reference.

Application-specific properties are being debated with many large organizations and groups proposing their standards. Open system card interoperability should apply at several levels: 1). To the card itself, 2). The card's access terminals (readers), 3). The networks and 4). The card issuers' own systems. Open system card interoperability will only be achieved by conformance to international standards.

This site's sponsors are committed to compliance with ISO and ITSEC security standards as well as industry initiatives such as EMV, MULTOS, the Open Card Framework and PC/SC specifications.

These organizations are active in smart card standardization: The following standards and the organizations that maintain them are the most prevalent in the smart card industry:

ISO - International Standards Organization This organization facilitates the creation of voluntary standards through a process that is open to all parties. ISO 7816 is the international standard for integrated-circuit cards (commonly known as smart cards) that use electrical contacts on the card, as well as cards that communicate with readers and terminals without contacts, as with radio frequency (RF/Contactless) technology. Anyone interested in obtaining a technical understanding of smart cards needs to become familiar with what ISO 7816 and 1443 does NOT cover as well as what it does. Copies of these standards can be purchased through ANSI American National Standards Institute. ANSI's address and phone is: 11 West 42nd Street, New York, NY 10036 - For more information and copies of standards, see the ISO website or call (212) 642-4900.

ISO 7816 Summary - This is a quick overview of what the 7816 specifications cover. As these can be in revision at any time, check with ISO for the latest updates. Some of these are frozen and some are in revision; please check with ANSI for the most current revision. ISO 7816 has six parts. Some have been completed; others are currently in draft stage.

ISO 7816-1: Physical Characteristics, 1987; defines the physical dimensions of contact smart cards and their resistance to static electricity, electromagnetic radiation and mechanical stress. It also describes the physical location of an IC card's magnetic stripe and embossing area.
ISO 7816-2: Dimensions and Location of Contacts, 1988; defines the location, purpose and electrical characteristics of the card's metallic contacts.
ISO 7816-3: Electronic Signals and Transmission Protocols, 1989; defines the voltage and current requirements for the electrical contacts as defined in part 2 and asynchronous half-duplex character transmission protocol (T=0). Amendment 1: 1992, Protocol type T=1, asynchronous half duplex block transmission protocol. Smart cards that use a proprietary transmission protocol carry the designation, T=14. Amendment 2: 1994, Revision of protocol type selection.
ISO 7816-4: Inter-industry Commands for Interchange; establishes a set of commands for CPU cards across all industries to provide access, security and transmission of card data. Within this basic kernel, for example, are commands to read, write and update records.
ISO 7816-5: Numbering System and Registration Procedure for Application Identifiers (AID); sets standards for Application Identifiers. An AID has two parts. The first is a Registered Application Provider Identifier (RID) of five bytes that is unique to the vendor. The second part is a variable length field of up to 11 bytes that RIDs can use to identify specific applications.
ISO 7816-6: Inter-industry data elements; physical transportation of device and transaction data, answer to reset and transmission protocols. The specifications permit two transmission protocols: character protocol (T=0) or block protocol (T=1). A card may support either but not both. (Note: Some card manufacturers adhere to neither of these protocols. The transmission protocols for such cards are described as T=14).
ISO 7816-7: Inter-industry command for Structured Card Query Language (SCQL); This document specifies the concept of a SCQL database (SCQL = Structured Card Query Language based on SQL, see MS ISO 9075), and the related inter-industry enhanced commands.
ISO 7816-8: Commands for Security Operation; this document codifies internal card commands for security operations.
ISO 7816-9: Commands for Card Management; specifies a description and coding of the life cycle of cards and related objects, a description and coding of security attributes of card related objects, functions and syntax of additional inter-industry commands, data elements associated with these commands, and a mechanism for initiating card-originated messages.
ISO 7816-10: Electrical signals and answer to reset for synchronous cards; this part of ISO 7816 specifies the power, signal structures, and the structure for the answer to reset between an integrated circuit card(s) with synchronous transmission and an interface device such as a terminal.
ISO 7816-11: Personal verification through biometric methods; currently a draft. See the Bio API for more info.

FIPS (Federal Information Processing Standards) Developed by the Computer Security Division within National Institute of Standards and Technology (NIST). FIPS standards are designed to protect federal assets including computer and telecommunications systems. The following FIPS standards apply to smart card technology and pertain to digital signature standards, advanced encryption standards, and security requirements for cryptographic modules.
FIPS 140 (1-3): The security requirements contained in FIPS 140 (1-3) pertain to areas related to the secure design and implementation of a cryptographic module, specifically: cryptographic module specification; cryptographic module ports and interfaces; roles, services, and authentication; finite state model; physical security; operational environment; cryptographic key management; electromagnetic interference/electromagnetic compatibility (EMI/EMC); self-tests; design assurance; and mitigation of other attacks.
FIPS 201: Currently a draft, this specification will cover all aspects of multifunction cards used in identity management systems throughout the U.S. government.

EMV - Europay, MasterCard and Visa formed EMV Company, LLC and created the "Integrated Circuit Card Specifications for Payment Systems". These specifications are related to ISO7816 and create a common technical basis for card and system implementation of a stored value system. Integrated Circuit Card Specifications for Payment Systems can be obtained from a Visa, MasterCard or Europay member bank.

PC/SC - A Microsoft proposed and implemented standard for cards and readers, called the PC/SC specification. This proposal only applies to CPU cards. They have also built into their CryptoAPI a framework that supports many security mechanisms for cards and systems. PC/SC is now a fairly common middleware interface for PC logon applications. The standard is a highly abstracted set of middleware components that allow for the most common reader card interactions.

CEN (Comite' Europe'en de Normalisation) and ETSI (European Telecommunications Standards Institute) is focused on telecommunications, as with the GSM SIM for cellular telephones. GSM 11.11 and ETSI300045. CEN can be contacted at Rue de Stassart, 36 B-1050 Brussels, Belgium, attention to the Central Secretariat.

HIPAA - The Health Insurance Portability and Accountability Act adopts national standards for implementing a secure electronic health transaction system in the U.S. Example transactions affected by this include claims, enrollment, eligibility, payment and coordination of benefits. Smart cards are governed by the requirements of HIPAA pertaining to data security and patient privacy.

IC Communications Standards - these existed for non-volatile memories before the chips were adopted for smart card use. This specifically applies to the I2C and SPI EEPROM interfaces.

Source : http://www.smartcardbasics.com/standards.html

Smart Card Readers/Terminals

For the sake of clearly defining all of the different hardware devices that smart cards can be plugged into, the industry has adopted the following definitions:

The term 'reader' is used to describe a unit that interfaces with a PC for the majority of its processing requirements. In contrast a 'terminal' is a self-contained processing device.

Both readers and terminals read and write to smart cards. Readers come in many form factors and in a wide variety of capabilities. The easiest way to describe a reader is by the method of it's interface to a PC. Smart card readers are available that interface to RS232 serial ports, USB ports, PCMCIA slots, floppy disk slots, parallel ports, infrared IRDA ports and keyboards and keyboard wedge readers.

Another difference in reader types is the on-board intelligence and capabilities. Extensive price and performance differences exist between an industrial strength intelligent reader that supports a wide variety of card protocols and a home style win-card reader that only works with microprocessor cards and performs all processing of the data in the PC.

The options in terminal choices are just as wide. Most units have their own operating systems and development tools. They typically support other functions such as magnetic-stripe reading, modem functions and transaction printing.

Source : http://www.smartcardbasics.com/readers.html

Types of Chip Cards

Smart cards are defined according to 1). How the card data is read and written, and 2). The type of chip implanted within the card and its capabilities. There is a wide range of options to choose from when designing your system.

Contact Cards

The most common type of smart card. Electrical contacts located on the outside of the card connect to a card reader when the card is inserted.

Increased levels of processing power, flexibility and memory add cost. Single function cards are often the most cost-effective solution. Choose the right type of smart card for your application by evaluating cost versus functionality and determine your required level of security. All of these variables should be weighted against the expected lifecycle of the card. On average the cards typically comprise only 10 to 15 percent of the total system cost with the infrastructure, issuance, training and advertising making up the other 85 percent. The following chart demonstrates some general rules of thumb;

Card Function Trade-Offs

Memory Cards

Memory cards have no sophisticated processing power and cannot manage files dynamically. All memory cards communicate to readers through synchronous protocols. In all memory cards you read and write to a fixed address on the card. There are three primary types of memory cards: 1). Straight, 2). Protected, and 3). Stored Value.

1. Straight Memory Cards

These cards just store data and have no data processing capabilities. These cards are the lowest cost per bit for user memory. They should be regarded as floppy disks of varying sizes without the lock mechanism. These cards cannot identify themselves to the reader, so your host system has to know what type of card is being inserted into a reader. These cards are easily duplicated and cannot be tracked by on-card identifiers.

2. Protected / Segmented Memory Cards

These cards have built-in logic to control the access to the memory of the card. Sometimes referred to as Intelligent Memory cards, these devices can be set to write protect some or all of the memory array. Some of these cards can be configured to restrict access to both reading and writing. This is usually done through a password or system key. Segmented memory cards can be divided into logical sections for planned multi-functionality. These cards are not easily duplicated but can possibly be impersonated by hackers. They typically can be tracked by an on-card identifier.

3. Stored Value Memory Cards

These cards are designed for the specific purpose of storing value or tokens. The cards are either disposable or rechargeable. Most cards of this type incorporate permanent security measures at the point of manufacture. These measures can include password keys and logic that are hard-coded into the chip by the manufacturer. The memory arrays on these devices are set-up as decrements or counters. There is little or no memory left for any other function. For simple applications such as a telephone card the chip has 60 or 12 memory cells, one for each telephone unit. A memory cell is cleared each time a telephone unit is used. Once all the memory units are used, the card becomes useless and is thrown away. This process can be reversed in the case of rechargeable cards.

CPU/MPU Microprocessor Multifunction Cards

These cards have on-card dynamic data processing capabilities. Multifunction smart cards allocate card memory into independent sections or files assigned to a specific function or application. Within the card is a microprocessor or microcontroller chip that manages this memory allocation and file access. This type of chip is similar to those found inside all personal computers and when implanted in a smart card, manages data in organized file structures, via a card operating system (COS). Unlike other operating systems, this software controls access to the on-card user memory. This capability permits different and multiple functions and/or different applications to reside on the card, allowing businesses to issue and maintain a diversity of ‘products’ through the card. One example of this is a debit card that also enables building access on a college campus. Multifunction cards benefit issuers by enabling them to market their products and services via state-of-the-art transaction and encryption technology. Specifically, the technology enables secure identification of users and permits information updates without replacement of the installed base of cards, simplifying program changes and reducing costs. For the card user, multifunction means greater convenience and security, and ultimately, consolidation of multiple cards down to a select few that serve many purposes.

There are many configurations of chips in this category including chips that support cryptographic PKI functions with on board math co-processors or Java virtual machine hardware blocks. As a rule of thumb - the more functions the higher the cost.

Contactless Cards

These are smart cards that employ a radio frequency (RFID) between card and reader without physical insertion of the card. Instead the card is passed along the exterior of the reader and read. Types include proximity cards which are implemented as a read-only technology for building access. These cards function with a limited memory and communicate at 125 MHz. True read & write contactless cards were first used in transportation for quick decrementing and re-loading of fare values where their lower security was not an issue. They communicate at 13.56 MHz, and conform to the ISO14443 standard. These cards are often straight memory types. They are also gaining popularity in retail stored value, since they can speed-up transactions and not lower transaction processing revenues (i.e. VISA and Mastercard), like traditional smart cards.


Variations of the ISO14443 specification include A, B, and C, which specify chips from either specific or various manufacturers. A=Philips B=Everybody else and C=Sony chips. Contactless card drawbacks include the limits of cryptographic functions and user memory versus microprocessor cards and the limited distance between card and reader required for operation.

Combination Cards

These are hybrids that employ both contact and contactless technology in one card. Combi-cards can also contain two different types of chips in contrast to a Dual-Interface card where a single chip manages both functions.

Operating Systems

The two primary types of smart card operating systems 1). Fixed File Structure and 2). Dynamic Application System. As with card types, selection of a card OS depends on the application the card is developed for. The other defining difference is in the Encryption Capabilities of the OS and the Chip. These are typically distinguished by Symmetric Key and Public Key. See the security section of this site for more information.

1). Fixed File Structure

This type treats the card as a secure computing and storage device. Files and permissions are set in advance by the issuer. These specific parameters are ideal and economical for a fixed type of card structure and functions that will not change in the near future. An example of this kind of card is a low-cost employee multi-function badge.

2). Dynamic Application System

This type of operating system, which includes the MULTOS and JAVA card varieties, enables developers to build, test, and deploy different applications securely. Because the OS and applications are more separate, updates can easily and repeatedly be made. See our software page for more information. An example card is a SIM card for mobile GSM where updates and security are downloaded to the phone and dynamically changed.

Source : http://www.smartcardbasics.com/cardtypes.html