Visa Inc. · NYSE:V
Visa — Third Party Risk Management Basics Webinar (February 2015)
25 slides from Visa's conference presentation, Feb 26, 2015
Slide 1: Third Party Risk Management Basics Webinar
Third Party Risk Management Basics Webinar 26 February 2015 Stan Hui – Payment System Security Oscar Munoz – Third Party Risk Roxanne Baumann – Third Party Risk Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Data Breach Landscape • Merchant Due Diligence • Third Party Risk • Agent Registration and the MSSIP • Questions and Answers 3 | Third Party Risk Management Basics | 26 February 2015 Visa Public
Slide 4: Data Breach Landscape
Data Breach Landscape Stan Hui 4 | Third Party Risk Management Basics | 26 February 2015 Visa Public
Slide 5: Visa Inc. CAMS Compromise Events Entity Type by Month
Visa Inc. CAMS Compromise Events Entity Type by Month Brick & Mortar Ecommerce Processor / Agent Source: Compromised Account Management System (CAMS) – Original “IC” and “PA” Alerts 5 | Third Party Risk Management Basics | 26 February 2015 Visa Public Visa Public 5
Slide 6: Visa Inc. CAMS Compromise Events Top Market Segment (MCC)
Visa Inc. CAMS Compromise Events Top Market Segment* (MCC) • Restaurants and retailers are leading market segments in 2014 • Insecure remote access and poor credential management continue to be attack vectors RESTAURANTS OTHER RETAIL QSR'S B2B SUPERMARKETS LODGING 2011 2012 2013 2014 * Market Segmen
Slide 7: Recent Threats due to POS Integrators
Recent Threats due to POS Integrators • POS Integrators support merchant POS software installations • Typically merchant setup includes Remote Access Services (RAS) for monitoring and software support • Integrators have access to POS system - however PCI compliance not maintained • Multiple POS Inte
Slide 8: POS Malware Mitigation Strategies
POS Malware Mitigation Strategies • Confirm all of your POS vendors, resellers and integrators are employing sufficient measures to prevent attacks and unauthorized access • Ensure that overall payment processing environment is securely configured and maintained in accordance with the PCI DSS. • Ens
Slide 9: POS Malware Early Warning Signs and Best Practices
POS Malware Early Warning Signs and Best Practices • Unexplained remote POS logins - Is it normal for a user to login at 3:00 AM? • Unexplained outbound HTTP web traffic from the POS • Look for the existence of new, unexplained executables on the POS Best Practices • Identifying, Containing, & Mitig
Slide 10: Merchant Due Diligence
Merchant Due Diligence • Requirement 2.6 – Shared hosting providers must protect each entity’s hosted environment and cardholder data • Requirement 12.3.9 – Activation of remote-access technologies for vendors and business partners only when needed by vendors and business partners, with immediate de
Slide 11: Third Party Risk
Third Party Risk Oscar Muñoz 11 | Third Party Risk Management Basics | 26 February 2015 Visa Public
Slide 12: Third Party Agent Program Objective
Third Party Agent Program Objective Visa operates a globally consistent Third Party Agent program across all Visa Inc regions. Its main objectives are: • Identify payment system participants • Elevate security and transparency in the Visa payment system • Ensures consistent financial, operational, s
Slide 13: Main Players in the Visa Payments Ecosystem
Main Players in the Visa Payments Ecosystem Third Party Agent (TPA): An entity, not defined as a VisaNet processor, that provides payment related services, directly or indirectly, to a Visa client and / or stores, processes or transmits cardholder account numbers VisaNet Processor (VNP): A Visa clie
Slide 14: Key Initiatives
Key Initiatives We group our initiatives into three areas: Education and Transparency Direct Awareness Engagement 14 | Third Party Risk Management Basics | 26 February 2015 Visa Public
Slide 15: Drive Education and Awareness
Drive Education and Awareness Empower Third Party Agents and clients with knowledge so that their business thrives Third Party Agent Security Alerts Webinars Visa Online Access website Third Party Agents Clients Help Third Parties stay informed about Help clients effectively manage Third Party indus
Slide 16: Increase Transparency
Increase Transparency Empower clients and merchants to make informed decisions Visa Global Registry of Service Providers • Valuable source of information for registered service providers who meet Visa program and industry requirements. • The listed agents have been registered with Visa by at least o
Slide 17: Foster Partnership
Foster Partnership Engage Third Party Agents directly and build strong partnerships Visa Processor and Agent Conference • Individual breakout sessions specially tailored to Payment Facilitators, VisaNet Processors • Interactive platform with panel discussions and networking opportunity with Third Pa
Slide 18: Client Benefits
Client Benefits • Provides an additional risk reduction framework • Drives compliance with industry data security standards such as the PCI DSS • Establishes a brand risk reduction baseline to mitigate possible bad business practices that may occur in the ISO sales process • Complements regulatory g
Slide 19: Agent Benefits
Agent Benefits • Publication on the Visa Global Registry of Service Providers (www.visa.com/splisting) • The industry source to find registered and compliant agents • A dynamic, searchable, exportable, filterable, and interactive directory of agents • Includes over 3400 unique agents and growing • P
Slide 20: Agent Registration and the Merchant Servicer Self Identification Program
Agent Registration and the Merchant Servicer Self Identification Program (MSSIP) Roxanne Baumann 20 | Third Party Risk Management Basics | 26 February 2015 Visa Public
Slide 21: Third Party Agent Registration
Third Party Agent Registration TPA Registration 101 The Third Party Agent Registration Program is a Visa-mandated program established to ensure that Visa clients comply with the Visa Rules, Payment Card Industry Data Security Standard (PCI DSS) and other applicable security standards regarding their
Slide 22: Merchant Servicer Self-Identification Program (MSSIP)
Merchant Servicer Self-Identification Program (MSSIP) MSSIP 101 The MSSIP allows Merchant Servicer Agents to easily provide their business information, merchant information and Payment Card Industry Data Security Standards (PCI DSS) compliance validation documentation directly to Visa. In turn, Visa
Slide 23: Merchant Servicer Self-Identification Program (MSSIP)
Merchant Servicer Self-Identification Program (MSSIP) MSSIP Overview • MS provides their information to Visa via the MSSIP tool on Visa.com • Company information, PCI DSS compliance validation materials, merchant customer information (so Visa can identify the merchant’s acquirer) • Registration by t
Slide 24: Upcoming TPA / VNP Events and Resources
Upcoming TPA / VNP Events and Resources Visa at the 2015 ETA in San Francisco – www.electran.org Save the Date: 2015 Visa Payment Security Symposium – August 12-13, 2015 Visa Third Party Agent Website – www.visa.com/third-party-agent • Alerts, Bulletins • Best Practices, FAQs • Latest News The Visa
Slide 25: Upcoming Merchant Events and Resources
Upcoming Merchant Events and Resources Upcoming Webinars – Training tab on www.visa.com/cisp • Data Breach Findings for Small Merchants ‒ 25 March 2015, 10 am PST Visa Data Security Website – www.visa.com/cisp • Alerts, Bulletins • Best Practices, White Papers • Webinars PCI Security Standards Counc
Visa — Third Party Risk Management Basics Webinar (February 2015) on 6ix