Visa Inc. · NYSE:V
Visa — Investor Presentation (September 2016)
29 slides from Visa's investor presentation, Sep 28, 2016
Slide 1: Effectively Managing Account Data Compromises
Effectively Managing Account Data Compromises Stoddard Lambertson, Director, Fraud and Breach Investigations Craig Johnson, Director, Fraud and Breach Investigations 28 September 2016 9/28/2016 Effectively Managing Account Data Compromises 1
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Account Data Compromise Trends • NEW: Visa What To Do If Compromised Version 5.0 • Investigations Overview / Mitigation and Detection Strategies • Agent Programs: Integrators and Resellers & Franchisee Servicers • Upcoming Events and Resources 9/28/2016 Effectively Managing Account Data Com
Slide 4: Account Data Compromise Trends
Account Data Compromise Trends Craig Johnson Fraud and Breach Investigations 9/28/2016 Effectively Managing Account Data Compromises Visa Public 4
Slide 5: Trends in Data Compromises
Trends in Data Compromises • Criminals are launching more sophisticated attacks targeting merchants and agents with a focus on Integrator Resellers (IR’s) FREQUENCY MAGNITUDE SOPHISTICATION ORGANIZATION 9/28/2016 Effectively Managing Account Data Compromises Visa Public 5
Slide 6: Recent Increase in Ecommerce Breaches
Recent Increase in Ecommerce Breaches Global CAMS Alerts by Entity Type Nov-14 Nov-15 Jun-14 Jul-14 Aug-14 Sep-14 Jun-15 Jul-15 Aug-15 Sep-15 Jun-16 Jul-16 Aug-16 Feb-14 Mar-14 Apr-14 May-14 Feb-15 Mar-15 Apr-15 May-15 Feb-16 Mar-16 Apr-16 May-16 Jan-14 Dec-14 Jan-15 Dec-15 Jan-16 Oct-14 Oct-15 Bric
Slide 7: Small Merchants Targeted Through Integrators / Resellers
Small Merchants Targeted Through Integrators / Resellers Breach Events by Merchant Level 2014 2015 2016* Entity Type % % % Level 1 1% <1% 0% Level 2 1% <1% 1% Visa Inc. Level 3 4% 5% 13% Level 4 93% 91% 84% Breach Events by Integrator Resellers (I/R) Agent 1% 3% 2% Total 100% 100% 100% Source: Compr
Slide 8: Top Market Segments (MCC) Targeted
Top Market Segments (MCC) Targeted • Restaurants and retailers continue to be the two leading market segments through the first six months of 2016 • Integrators and resellers implementing insecure remote access and poor credential management are targeted by hackers 70% 61% 60% 50% 44% 36% 40% 30% 20
Slide 9: Rise in Skimming Attacks
Rise in Skimming Attacks Criminals are targeting mag stripe data • Criminals are shifting their attacks to skimming • Increase in report skimming attacks in the news • Criminals are targeting: – Self-checkout terminals – Automated fuel dispensers – White-label ATMs • Increasing in sophistication of
Slide 10: Guiding Principles for Managing an Account Data Compromise
Guiding Principles for Managing an Account Data Compromise Revised: What To Do If Compromised V5.0 9/28/2016 Effectively Managing Account Data Compromises Visa Public 10
Slide 11: What To Do If Compromised
What To Do If Compromised • Indicators of a Data Breach – Visa notification of Common Point of Purchase (CPP) identification – Customer complaints of fraudulent activity on payment cards – Law enforcement notification – Bank reports of fraud after legitimate use – Abnormal activity/behavior of Point
Slide 12: Compromised Entity Responsibilities Overview
Compromised Entity Responsibilities Overview • Notification – Immediately report suspected or confirmed unauthorized access or data exposure to your acquiring bank and / or Visa Fraud & Breach Investigations usfraudcontrol@visa.com or 650-432-2978, option 4 • Initial Containment – Immediately contai
Slide 13: Compromised Entity Responsibilities Overview Continued
Compromised Entity Responsibilities Overview Continued • Law Enforcement – Notify the appropriate law enforcement agency in the event of an account data compromise. • Communications Plan – Merchants can consult with Visa Corporate Communications for assistance in preparing a public breach response –
Slide 14: Member Responsibilities Overview
Member Responsibilities Overview • Notification – Immediately report to the Visa Risk Management group any suspected or confirmed unauthorized access to any Visa cardholder data. • Coordinate the investigation until its completion – Organize conference calls with merchant / acquirer / Visa – Provide
Slide 15: Investigations Overview / Mitigation and Detection Strategies
Investigations Overview / Mitigation and Detection Strategies Stoddard Lambertson Fraud and Breach Investigations 9/28/2016 Effectively Managing Account Data Compromises Visa Public 15
Slide 16: Breach Events by Merchant Level
Breach Events by Merchant Level* Combined level 1, 2, and 3 merchants 14% Level 4 merchants 9/28/2016 Effectively Managing Account Data Compromises * Based on 2016 merchant breaches to date 9/28/2016 Effectively Managing Account Data Compromises Visa Public 16
Slide 17: Investigations
Investigations • Most reported Common Point of Purchases (CPP) result in the detection of a small merchant….which often leads to an Integrator Reseller – A Common Point of Purchase (CPP) is determined when issuers identify a subset of legitimately used cardholder accounts, used at a single common me
Slide 18: Common Point of Purchase (CPP) Process Flow
Common Point of Purchase (CPP) Process Flow Goal is to contain compromises quickly and mitigate Issuer losses by sending at-risk accounts via Proactive Comprised Account Management System (CAMS) alerts Visa Investigations Receive Visa validates Fraud Visa sends Visa sends At- Suspected Merchant and
Slide 19: New Global CPP Reporting Form
New Global CPP Reporting Form 9/28/2016 Effectively Managing Account Data Compromises Visa Public 19
Slide 20: Initial Investigation Process
Initial Investigation Process Understand all of the players in the payment ecosystem and how they may be in scope during the initial investigation Payments is multi dimensional . . . and so are investigations • How many agents are supporting your merchants? • What services are they providing? • How
Slide 21: Majority of Compromises Occur at Small Merchants
Majority of Compromises Occur at Small Merchants • Untrained integrators that deploy weak remote access configurations are the most common reason for small merchant compromises • Common attack vector: web-based and direct remote access services used by POS Integrators and Resellers According to Trus
Slide 22: Merchant Security Safeguards
Merchant Security Safeguards 1. 2. 3. 4. 5. Change Enable Install Remote Use only PCI Use only Default Approved Registered Antivirus Access Only Passwords QIRs Agents When Needed Ease of Easy Medium Easy Easy Easy Implementation Cost None Medium None None None Effectiveness Medium Medium High High H
Slide 23: Visa Security Alert – Integrators Under Attack
Visa Security Alert – Integrators Under Attack www.visa.com/cisp Visa Security Alert also published by the U.S. Secret Service 9/28/2016 Effectively Managing Account Data Compromises Visa Public 23
Slide 24: Qualified Integrator Reseller Program
Qualified Integrator Reseller Program Requirement Clarifications Requirements do not apply to QIR certification does not apply merchants: to vendors: Vendors that do not • Only supporting ancillary apps sell, support or service • Using single-use terminals without Internet segmented from POS PA-DSS
Slide 25: Why Use a QIR?
Why Use a QIR? • Using PCI Certified QIRs helps to ensure a merchant’s PCI DSS compliance status is not jeopardized • Help protect your organization and improve security • Simplifies the vendor selection process – 260 Now on list! 9/28/2016 Effectively Managing Account Data Compromises Visa Public 2
Slide 26: Key Takeaways
Key Takeaways • Merchant breaches continue to occur • Small businesses, integrators / resellers and hospitality continue to be targets • Understand the risks to your business, threats, and how data can be stolen • Implement easy, low-cost, effective security basic controls • De-value payment card da
Slide 27: What To Do Before You Are Compromised
What To Do Before You Are Compromised • Review and understand the fraud investigation procedures: What To Do If Compromised – Located under Resources at www.visa.com/cisp – http://usa.visa.com/download/merchants/cisp-what-to-do-if-compromised.pdf • Ensure an Incident Response (IR) plan is in place -
Slide 28: Upcoming Events and Resources
Upcoming Events and Resources • Upcoming Webinars – www.visa.com/cisp — October 13, 2016 – Third Party Agent Registration Tool Review • Visa Data Security Website – www.visa.com/cisp — Alerts, Bulletins — Best Practices, White Papers — Webinars • PCI Security Standards Council Website – www.pcissc.o
Slide 29: Questions?
Questions? 9/28/2016 Effectively Managing Account Data Compromises Visa Public 29