Visa Inc. · NYSE:V
Visa — Technical Presentation (September 2018)
19 slides from Visa's technical presentation, Sep 5, 2018
Slide 1: Payment Fraud Disruption Webinar: Threats from Website Add-ons and E-commerce Trends
Payment Fraud Disruption Webinar: Threats from Website Add-ons and E-commerce Trends Stoddard Lambertson & Sam Cleveland Payment Fraud Disruption September 5, 2018 Visa Public
Slide 2: Agenda
Agenda • Global Compromise Trends • eCommerce Threat Landscape • Tactics and Techniques used by Hackers • What Visa is Doing • Resources for Merchants and Best Practices • Questions 2 Visa Public
Slide 3: Threat Landscape
Threat Landscape 3 Visa Public
Slide 4: Global Compromise Trends
Global Compromise Trends The Paradigmatic Shift Explained Unique Cases by Entity Type Shifting Breach Types Decrease in events involving magnetic stripe data 27% Increase in eCommerce compromises 55% Proliferation of third-party breaches 76% 76% 70% Criminals Moving Beyond Merchants 44% 19% 19
Slide 5: Global Breaches Summary: Q2 2018
Global Breaches Summary: Q2 2018 Global Breaches by Level 2015 2016 2017 2018* Level 1 <1% <1% 2% 4% Level 2 <1% 1% 1% 2% Level 3 4% 13% 15% 28% Level 4 76% 57% 38% 60% Service Provider** 2% 2% 4% 6% Europe*** 17% 27% 39% - Total 100% 100% 100% 100% Large Merchant Breaches Service Provider Breaches
Slide 6: The Threat Landscape
The Threat Landscape Criminals are migrating to the eCommerce space • Increasing numbers and severity of eCommerce agent breaches impacting multiple merchants • Service providers offering easy to implement add-ons to enhance website capabilities • Without proper vetting, third-party add-ons can pres
Slide 7: Criminals Targeting the eCommerce Channel
Criminals Targeting the eCommerce Channel 7 Visa Public
Slide 8: An Overview of Website Add-ons and Scripts
An Overview of Website Add-ons and Scripts What risks do website plugins and scripts pose? What are add-ons and scripts? Criminals are targeting third-party vendors that may be outside of the Website add-ons and scripts are pieces of payments ecosystem – but their services can bring them directly in
Slide 9: How eCommerce Malware Works
How eCommerce Malware Works add-ons.social.com/code.js https://merchant.online/style.css https://merchant.online/shop breached.analytics.com/hacked.js https://merchant.online/form.php 9 Visa Public
Slide 10: How eCommerce Malware Works
How eCommerce Malware Works 10 Visa Public
Slide 11: What Visa is Doing to Help
What Visa is Doing to Help 11 Visa Public
Slide 12: What Visa Is Doing To Help?
What Visa Is Doing To Help? 1. eCommerce Threat Disruption (eTD) Initiative ─ Proactive compromise detection that doesn’t rely on fraud reports ─ Shortens the time-to-remediate from months to days ─ Works to disrupt attackers by taking down their infrastructure 2. Developing Detection Algorithms ─ A
Slide 13: Resources for Merchants and Best Practices
Resources for Merchants and Best Practices 13 Visa Public
Slide 14: Payment Card Industry Resources for Small Merchants
Payment Card Industry Resources for Small Merchants www.pcisecuritystandards.org/merchants/#rfsm Educational Resources Include: Guide To Safe Payments Common Payment Systems Questions To Ask Your Vendors? Glossary of Security Terms 14 Visa Public
Slide 15: Payment Card Industry Guide to Safe Payments
Payment Card Industry Guide to Safe Payments www.pcisecuritystandards.org/pdfs/Small_Merchant_Guide_to_Safe_Payments.pdf • Understanding Merchant Risks • Helps e-Commerce merchants understand their payment systems • Describes how to protect your business with risk reduction security basic recommenda
Slide 16: Payment Card Industry Resources for Small Merchants
Payment Card Industry Resources for Small Merchants www.pcisecuritystandards.org/merchants/#rfsm • Aids small-merchant owners and operators • Provides questions to ask your vendors and service providers • Assists with understanding how vendors support the protection of your customers’ card data and
Slide 17: How can merchants protect themselves?
How can merchants protect themselves? Additional Questions? Contact cisp@visa.com Visa Online Merchant Tool Kit provides helpful information to make a seamless EMV transition • Streamline your chip migration www.VisaChip.com/businesstoolkit Visa Data Security Website www.visa.com/cisp • Alerts, Bull
Slide 18: Additional Visa Resources
Additional Visa Resources Visa has a number of documents for clients to reference Visa Security Alerts (public) www.visa.com/cisp • “Fraudsters Targeting Call Center Chat and Non-Voice Channels” July 2018 • “Protect Against eCommerce Malware” January 2018 www.visaonline (non-public) • Payment Fraud
Slide 19: Q&A
Q&A 19 Visa Public