Visa Inc. · NYSE:V
Visa — Technical Presentation (November 2014)
21 slides from Visa's technical presentation, Nov 12, 2014
Slide 1: Strategies to Effectively Manage Data Compromise Events
Strategies to Effectively Manage Data Compromise Events Glen Jones and Justina Jow Cyber Intelligence & Investigations Visa, Inc. 12 November 2014 Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Data Breach Landscape ‒ Cyber Threat Landscape ‒ Point-of-Sale (POS) Malware ‒ Data Compromise Trends • Investigation Process ‒ Prevention and Detection Strategies ‒ Investigation Procedures • Upcoming Events and Resources 3 | Strategies to Effectively Manage Data Compromise Events – Novemb
Slide 4: Data Breach Landscape
Data Breach Landscape Glen Jones, Senior Director Global Forensic Intelligence, Visa Inc. 4 | Strategies to Effectively Manage Data Compromise Events – November 2014 Visa Public
Slide 5: Cyber Threat Landscape
Cyber Threat Landscape Payment card data theft over last 8 years Noticable increase in Mobile Memory- Windows XP Advanced Persistant malware resident support Threat (APT) attacks (Android) malware sunset date 2007 2008 2009 2010 2011 2012 2013 2014 2015 Data capture Memory- APT-style Privatized High
Slide 6: Point-of-Sale (POS) RAM Scraping
Point-of-Sale (POS) RAM Scraping Merchant Network Cardholder POS Hardware POS Software Visa Issuing Acquiring Bank Bank 6 | Strategies to Effectively Manage Data Compromise Events – November 2014 Visa Public
Slide 7: Point-of-Sale (POS) RAM Scraping (cont.)
Point-of-Sale (POS) RAM Scraping (cont.) • Authorization data is temporarily stored in clear text system memory • Cybercriminals attack memory space as it’s the easiest path to the data • RAM scrapers generally use logic to identify track 1 and 2 data • Some malware use the Luhn algorithm to validat
Slide 8: Point-of-Sale (POS) Malware Characteristics
Point-of-Sale (POS) Malware Characteristics • Core Functionality: ‒ RAM-scraping ‒ Key logging ‒ Command-and-Control communications ‒ Data exfiltration • Additional Botnet Functionality: ‒ Upload ‒ Download ‒ Run ‒ Self-deletion capability (reported in recent versions) 8 | Strategies to Effectively
Slide 9: Visa Inc. CAMS Compromise Events – Entity Type by Month
Visa Inc. CAMS Compromise Events – Entity Type by Month 2 3 2 3 4 2 3 4 12 13 14 2 12 3 13 4 14 -1 -1 -1 -1 -1 -1 -1 -1 -1 -1 -1 p- p- p- n- n- n- l l l v v ay ay ay ar ar ar Ju Ju Ju No No Se Se Se Ja Ja Ja M M M M M M Brick & Mortar Ecommerce Processor / Agent Source: Compromised Account Managemen
Slide 10: Visa Inc. CAMS Compromise Events Top Market Segment (MCC)
Visa Inc. CAMS Compromise Events Top Market Segment* (MCC) • Restaurants and retailers are leading market segments in 2014 • Insecure remote access and poor credential management continue to be attack vectors RESTAURANTS OTHER RETAIL QSR'S B2B SUPERMARKETS LODGING 2011 2012 2013 Jun-14 * Market Segm
Slide 11: Investigation Process
Investigation Process Justina Jow, Senior Investigator Cyber Intelligence & Investigations, Visa Inc. 11 | Strategies to Effectively Manage Data Compromise Events – November 2014 Visa Public
Slide 12: Prevention and Detection Strategies
Prevention and Detection Strategies Communication Incident PCI Response Compliance Organization Readiness Remain vigilant and be prepared!!! Fraudsters target the weakest link and can evolve quickly 12 | Strategies to Effectively Manage Data Compromise Events – November 2014 Visa Public
Slide 13: What To Do Before You Are Compromised
What To Do Before You Are Compromised* • Review and understand the fraud investigation procedures: What To Do If Compromised – Located on the Protect Your Business section under Merchants on Visa.com – http://usa.visa.com/download/merchants/cisp-what-to-do-if-compromised.pdf • Actively review Alerts
Slide 14: What To Do Before You Are Compromised (cont.)
What To Do Before You Are Compromised* (cont.) • Designate and empower an internal breach response team – Educate employees on indicators of compromise and how to respond – Create mock exercise to test and refine procedures – Develop breach response communications • Identify and establish relationsh
Slide 15: What To Do If Compromised
What To Do If Compromised* • Indicators of a Data Breach – Visa notification of Common Point of Purchase (CPP) identification – Customer complaints of fraudulent activity on payment cards – Law enforcement notification – Bank reports of fraud after legitimate use – Abnormal activity/behavior of Poin
Slide 16: What To Do If Compromised (cont.)
What To Do If Compromised* (cont.) • Notification – Immediately report suspected or confirmed unauthorized access or data exposure to the Visa Risk group Visa Cyber Intelligence & Investigations usfraudcontrol@visa.com or 650-432-2978, option 4 • Evidence preservation (page 7 from WTDIC) – Do not ac
Slide 17: Initial Investigation Process
Initial Investigation Process Receive Suspected Fraud Incident Common Validation of Assign to Visa Tracking Case Case Triage Point of CPP Investigator Created Purchase (CPP) report Risk Associate Send Case Details to Acquirer • Small merchant incidents (L3/L4) • Visa will notify merchant’s acquirer
Slide 18: Merchant Responsibilities
Merchant Responsibilities* • Notification - Alert your acquiring bank immediately • Initial Containment - Immediately contain and limit the data exposure and minimize data loss • Preservation - Preserve evidence and facilitate the investigation • Forensic engagement - Visa may require an onsite fore
Slide 19: Acquirer Responsibilities
Acquirer Responsibilities • Notification • Report any suspected breach to Visa immediately • Coordinate the investigation until its completion • Organize conference calls with merchant / acquirer / Visa • Provide ongoing updates • Forensic engagement Work with the merchant to obtain an approved PCI
Slide 20: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Training tab on www.visa.com/cisp • “BlackPOS” Malware Deconstructed ‒ 10 December 2014, 10 am PST • Secure Technologies for Payments ‒ 21 January 2015, 10 am PST Visa Data Security Website – www.visa.com/cisp • Alerts, Bulletins • Best Practices, Wh
Slide 21: Questions?
Questions? Visa Confidential