Visa Inc. · NYSE:V
Visa — Technical Presentation (August 2015)
31 slides from Visa's technical presentation, Aug 5, 2015
Slide 1: Payment Card Data and Protected Health Information Security Practices
Payment Card Data and Protected Health Information Security Practices Andrew Sierra – Merchant Risk Lester Chan – Merchant Security August 5, 2015
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Global Data Compromises • Cyber Threats and Attacks • Latest Data Breaches • Monetizing PII/PHI versus Payment Card Data • Differences Between Security Standards • Threats and Risks to Payment Card Data PII/PHI • Going Above and Beyond Security Standards • Key Takeaways 3 Payment Card Data
Slide 4: Global Data Compromises
Global Data Compromises Compromise Cases by Region 1200 • Global data compromise events grew 23% in 1000 2014 over those managed in 2013 11% • The U.S. is the largest contributor, mainly due to # of compromises 800 LAC 13% 16% 15% its large mag stripe infrastructure and an 11% CEMEA 600 21% 11% incr
Slide 5: Data Compromises: Breach trends by merchant level and MCC
Data Compromises Breach trends by merchant level and Merchant Category Code Breach Events by Merchant Level Percent of Breach Events by MCC 45% Entity Type 2012 2013 2014 38% % % % 32% Level 1 <1% 1% 1% Merchant 21% Level 2 <1% 1% 1% 19% 15% Level 3 1% 4% 4% 10% 7% Level 4 95% 92% 93% 4% 4% 3% 4% 4%
Slide 6: Data Compromises: Common breach patterns
Data Compromises Common breach patterns Entry Card Data Theft Monetization • Hackers targeting internet-exposed • Payment card data is extracted with • Payment data is used to commit remote access systems as initial specialized, difficult to detect malware fraud, often across countries via intrusion
Slide 7: Latest Data Breaches
Latest Data Breaches Lester Chan – Merchant Security CISSP, CISA, CISM, Certified HIPAA Professional
Slide 8: Healthcare Data Breaches Per Year
Healthcare Data Breaches Per Year Number of records 90,000,000 80,000,000 70,000,000 60,000,000 50,000,000 40,000,000 30,000,000 20,000,000 10,000,000 0 2010 2011 2012 2013 2014 2015 * Source: Forbes, Health Data Breach At Anthem Is A Blockbuster That Could Affect 80 Million, February 5, 2015 8 Paym
Slide 9: Largest Healthcare Data Breaches
Largest Healthcare Data Breaches Xerox Blue Cross 1 million 2 million Montana Nemours Dept of Health 1 million IBM 1 million 1.9 million Advocate GRM Medical Grp 1.7 million 4 million AvMed Community 1.2 million Health Systems 4.5 million SAIC 4.9 million 9 Payment Card Data and Protected Health Inf
Slide 10: Office of Personnel Management Breach
Office of Personnel Management Breach Not healthcare but PII breach with significant impact On July 9, OPM Records include 1.1 million discloses that 21 fingerprint records 21 million million PII records were compromised by hackers. On June 12, the U.S. government determined an 14 million Stolen rec
Slide 11: Exfiltration and Monetizing Payment Card Data
Exfiltration and Monetizing Payment Card Data Fraudsters can easily monetize stolen payment card data Data Exfiltration Sold on Darknet Price per Account • Cards are stolen with POS • Offered for sale on cyber malware crime websites • Offer money-back • Selling for $5 - $50 • Stolen card data is enc
Slide 12: Exfiltration and Monetizing PII and PHI
Exfiltration and Monetizing PII and PHI Stolen PII/PHI are more useful to fraudsters Data Exfiltration Sold on Darknet Price per Account • Target phishing, • Offered for sale on • Selling for $20 - $200 credentials compromised cyber crime websites per account • PII/PHI is identified and • Used to co
Slide 13: Dumps, "Fullz", and Payment Card Data on the Darknet
Dumps, “Fullz”, and Payment Card Data on the Darknet 13 Payment Card Data and Protected Health Information Security Practices | 8/5/2015 Visa Public
Slide 14: Breach Impact to Victims
Breach Impact to Victims Significant impact to victims of payment card fraud and PII/PHI theft Consumer Stolen Actions Possible Consequences Issue New Card Counterfeit Fraud Payment Card Credit Fraudulent Monitoring Prescriptions Stolen Identity Contact SSA Fraudulent Loans PII/PHI & Accounts File P
Slide 15: PCI DSS and HIPAA Security
Payment Card Industry (PCI) Data Security Standard (DSS) Health Insurance Portability and Accountability Act (HIPAA) Security
Slide 16: Health Insurance Portability and Accountability Act
Health Insurance Portability and Accountability Act HIPAA Security is one section of the HIPAA Rule 16 Payment Card Data and Protected Health Information Security Practices | 8/5/2015 Visa Public
Slide 17: Regulatory Requirements for Healthcare Data
Regulatory Requirements for Healthcare Data HIPAA Security Rule (1996) • Administrative, Physical, and Technical Safeguards for Protected Health Information (PHI) • Goal is to protect the confidentiality, integrity, and availability of PHI • Compliance by April 21, 2005 (April 21, 2006 for small hea
Slide 18: PCI Security Standards Council (PCI SSC)
PCI Security Standards Council (PCI SSC) 1 Industry-wide standards group founded in 2006 3 PCI DSS applies to any entity that stores, Visa, American Express, Discover, JCB and MasterCard processes, or transmits cardholder data 2 Responsible for development and 4 Trains and certifies data security co
Slide 19: Differences between PCI DSS and HIPAA Security
Differences between PCI DSS and HIPAA Security Key differences in security standards HIPAA • Store, process, or transmit PCI DSS • Applies to Covered Entities payment card data Security • Penalties can include civil • Requires self assessment and criminal questionnaire for small • Required versus Mo
Slide 20: Changes to PCI DSS Versus HIPAA Security
Changes to PCI DSS Versus HIPAA Security Staying ahead latest threats and risks 20 Payment Card Data and Protected Health Information Security Practices | 8/5/2015 Visa Public
Slide 21: Going Above and Beyond PCI DSS and HIPAA Security
Going Above and Beyond PCI DSS and HIPAA Security
Slide 22: Threats and Risks to Payment Card Data and PII/PHI
Threats and Risks to Payment Card Data and PII/PHI Targeted attacks and growing threats Targeting companies with low security Exploit weaknesses with root kits, POS malware Database stores of payment card data and/or PII/PHI Email attachments with various exploits Keyloggers used to harvest login cr
Slide 23: Security Standards Compliance
Security Standards Compliance Higher education, hospitals, etc. have multiple regulatory requirements • Hospitals have HIPAA, JCAHO, PCI DSS, Sarbanes-Oxley, FDA, etc. • Some are challenging environments to assess, multiple locations, stores, parking, kiosks, etc. • Validate compliance independently
Slide 24: Layered Security Approach
Layered Security Approach Policies, Procedures & Training PCI DSS HIPAA Security Other secure technologies – EMV chip, tokenization, point-to-point encryption SIEM, WAF, Vulnerability IDS/IPS, APT threat Application scanning and protection whitelisting penetration testing PCI DSS HIPAA Security 24 P
Slide 25: Maturing Information Security
Maturing Information Security Validate to Version 3.1 Implement P2PE, EMV Chip, and Proactive Security Controls Tokenization After April 2015, all merchants must EMV Chip - Creates a unique • Use two-factor authentication validate to PCI DSS version 3.1. especially for remote access cryptogram for e
Slide 26: Additional Security Controls for Large Merchants
Additional Security Controls for Large Merchants SIEM •Security intelligence and correlation •Alerts and notification •Tuning Vulnerability Management •Frequency of scans •Zero day vulnerabilities •Remediation and tracking Antivirus •Keep signatures updated •Ensure settings cannot be altered Patch M
Slide 27: Examples of Small Merchant Security Safeguards
Examples of Small Merchant Security Safeguards* 1. 2. 3. 4. 5. Conduct Change Install Enable Remote Segment Employee Default Antivirus Access Only Network Training & Passwords When Needed Awareness Ease of Easy Medium Easy Medium Easy Implementation Cost None Medium None Medium Low Effectiveness Med
Slide 28: Key Takeaways
Key Takeaways Lessons Learned 1. PII/PHI versus payment card data – PII/PHI is typically worth more on the darknet than payment card data 2. Hackers targeting path of least resistance – Hackers know companies that have weak or low security controls 3. After liability shift, fraud will migrate to oth
Slide 29: Visa is hosting a must-attend event on cyber security and payments
Visa is hosting a must-attend event that will focus on trends and developments related to cyber security, mobile payments, e-commerce and Visa’s global authentication strategy. In order to secure the future of commerce all stakeholders including merchants, acquirers, agents and Visa need to collabor
Slide 30: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Under Merchant Resources/Training on www.visa.com • Implementing Effective Penetration Testing, August 25, 2015 • The Importance of Containment and Remediation of Compromised Payment Processing Environments, September 2, 2015 Visa Online Merchant Too
Slide 31: Thank you for attending! Questions? Comments?
Thank you for attending! Questions? Comments?