Slide 1: Managing Network Segmentation in Payment Environments
Managing Network Segmentation in Payment Environments Andrew Sierra – Merchant Risk Ed Verdurmen – Data Security Policy Lester Chan – Merchant Security July 22, 2015
Slide 2: Forward-Looking Statements
Forward-Looking Statements The materials, presentations and discussions during this meeting contain forward-looking statements within the meaning of the U.S. Private Securities Litigation Reform Act of 1995. These statements can be identified by the terms “will,” new,” "continue," "could," “accelera
Slide 3: Notice of Disclaimer
Notice of Disclaimer The information, recommendations or “best practices” contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy
Slide 4: Agenda
Agenda • Global Data Compromises • Cyber Threats and Attacks • Payment Card Attack Example • Today’s Network Concerns and Challenges • Network Segmentation in PCI DSS • Segmentation and Flat Network Risks • Securing the Network Perimeter • Examples of Network Segmentation • Zero Trust Principle • Ke
Slide 5: Global Data Compromises
Global Data Compromises Andrew Sierra — Merchant Risk
Slide 6: Global Data Compromises: Compromise Cases by Region
Global Data Compromises Compromise Cases by Region 1200 • Global data compromise events grew 23% in 1000 2014 over those managed in 2013 11% • The U.S. is the largest contributor, mainly due # of compromises 800 LAC 13% 16% 15% to its large mag stripe infrastructure and an 11% CEMEA 600 21% 11% incr
Slide 7: Merchant Data Compromises
Data Compromises Breach trends by merchant level and Merchant Category Code Breach Events by Merchant Level Percent of Breach Events by MCC 45% Entity Type 2012 2013 2014 38% % % % 32% Level 1 <1% 1% 1% Merchant 21% Level 2 <1% 1% 1% 19% 15% Level 3 1% 4% 4% 10% 7% Level 4 95% 92% 93% 4% 4% 3% 4% 4%
Slide 8: Data Compromises: Common breach patterns
Data Compromises Common breach patterns Entry Card Data Theft Monetization • Hackers targeting internet-exposed • Payment card data is extracted with • Payment data is used to commit remote access systems as initial specialized, difficult to detect malware fraud, often across countries via intrusion
Slide 9: Cyber Threats and Attacks
Cyber Threats and Attacks Ed Verdurmen – Data Security and Third Party Risk
Slide 10: Trends in Data Compromises
Trends in Data Compromises Criminals are launching more sophisticated attacks FREQUENCY MAGNITUDE SOPHISTICATION ORGANIZATION 10 | Managing Network Segmentation for Payment Environments | July 22, 2015 Visa Public
Slide 11: Remote Access Brute Force Attack
Remote Access Brute Force Attack Web-based remote Merchant Point of Sale environment access Service 11 | Managing Network Segmentation for Payment Environments | July 22, 2015 Visa Public
Slide 12: Payment Card Attack
Payment Card Attack Attacker will pivot and elevate privileges Payment cards accounts offered for sale on Darknet 1. Attacker steals remote login credentials 2. Attacker performs network reconnaissance 3. Attacker pivots and elevates privileges 4. Attacker gains access to patch management or softwar
Slide 13: Network Segmentation Challenges and Recommendations
Network Segmentation Challenges and Recommendations Lester Chan – Merchant Security CISSP, CISA, CISM
Slide 14: Challenges with Today's Computer Networks
Challenges with Today’s Computer Networks Complex networks make securing them difficult • Reliability and scalability are top network concerns • Wireless, DMZ, datacenter, extranet/intranet, BYOD • Focused on speed, bandwidth, availability • Most networks do not have security in mind • Identity mana
Slide 15: Network Segmentation in PCI DSS
Network Segmentation in PCI DSS Requirement versus Recommendations • According to the PCI DSS*: – Network segmentation of, or isolating (segmenting), the cardholder data environment from the remainder of an entity’s network is not a PCI DSS requirement. However, it is strongly recommended as a metho
Slide 16: Introduction to Network Segmentation
Introduction to Network Segmentation Flat network risks • Method of separating environment systems that store, process, or transmit cardholder data from those that don’t • Network segmentation is just one security control • Once an attacker gains access to the network, can easily access the CDE • Wi
Slide 17: Securing the Network Perimeter
Securing the Network Perimeter Four steps to securing the network perimeter 1. Enable secure remote access – Always use multi-factor authentication 2. Harden devices, update software and review policies – Review configurations and ACLs 3. Build layers of security – Use defense-in-depth and next gen
Slide 18: Examples of Network Segmentation Controls
Examples of Network Segmentation Controls From Flat Networks to Best Practices Low Medium High Flat Network (Good) (Better) (Best) • No subnetting • Understand network • Firewalls separate CDE • Separate login domain data flows from core network for CDE than core • Single domain • CDE is separated b
Slide 19: Improving Security with Proper Segmentation
Improving Security with Proper Segmentation Practices and Principles • Cardholder Data Environment – Ensure properly scoped and segmented • Manage ingress/egress to CDE – only allow specific subnet and restrict protocols – Why allow port 80 (HTTP) or 21 (FTP) outbound from the CDE? – DENY from ANY t
Slide 20: Introduction to the Zero Trust Principle
Introduction to the Zero Trust Principle Next Generation Secure Network • Proposed by Forrester Research • Embed security into network DNA • Design from the inside out • Design with compliance in mind • Inspect and log all traffic • Zero Trust – “Verify and never trust” 20 | Managing Network Segment
Slide 21: Traditional Model vs Zero Trust Model
Traditional Model Zero Trust Model 21 | Managing Network Segmentation for Payment Environments | July 22, 2015 Visa Public
Slide 22: Which one goes to the Internet?
Which one goes to the Internet? Traditional Network Trust Model UNTRUSTED TRUSTED Zero Trust Model UNTRUSTED UNTRUSTED 22 | Managing Network Segmentation for Payment Environments | July 22, 2015 Visa Public
Slide 23: Security Is An Overlay
Security Is An Overlay Edge FW IPS Core Email WCF WAF VPN DAM DLP DB ENC Distribution IPS IPS WLAN FW FW GW NAC Access 23 | Managing Network Segmentation for Payment Environments | July 22, 2015 Visa Public
Slide 24: Zero Trust Drives Future Network Design
Zero Trust Drives Future Network Design MCAP – Micro Core and Perimeter MCAP resources have similar Segmentation Gateway functionality and share global policy attributes • NGFW • Very High Speed • Multiple 10G Interfaces User MCAP • Builds Security into the Network DNA FW WWW MCAP • MCAPs are centra
Slide 25: Key Takeaways
Key Takeaways Lessons Learned 1. Understand your network data flows – Internet ingress and egress, data flows in and out of the CDE, protocols, users and services 2. At minimum, implement ACLs and VLAN properly – Avoid flat networks and review ACLs and policies to make it difficult for an attacker t
Slide 26: Visa event announcement on cyber security and payments
Visa is hosting a must-attend event that will focus on trends and developments related to cyber security, mobile payments, e-commerce and Visa’s global authentication strategy. In order to secure the future of commerce all stakeholders including merchants, acquirers, agents and Visa need to collabor
Slide 27: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Under Merchant Resources/Training on www.visa.com • Payment Card Data and Protected Health Information Security Practices, August 5,2015 • Implementing Effective Penetration Testing, August 25, 2015 • The Importance of Containment and Remediation of
Slide 28: Thank you for attending! Questions? Comments?
Thank you for attending! Questions? Comments?